Slashdot Mirror
Apple Says It's Already Fixed Many WikiLeaks Security Issues (usatoday.com)
An anonymous reader quotes a report from USA Today: Apple says many of the vulnerabilities to its devices and software that came to light in WikiLeaks' revelations of CIA cyber weapons were already fixed in its latest updates. Late Tuesday, Apple emailed the following statement to USA TODAY: "Apple is deeply committed to safeguarding our customers' privacy and security. The technology built into today's iPhone represents the best data security available to consumers, and we're constantly working to keep it that way. Our products and software are designed to quickly get security updates into the hands of our customers, with nearly 80 percent of users running the latest version of our operating system. While our initial analysis indicates that many of the issues leaked today were already patched in the latest OS, we will continue work to rapidly address any identified vulnerabilities. We always urge customers to download the latest iOS to make sure they have the most recent security updates." For its part, Samsung emailed its own statement Wednesday: "Protecting consumers' privacy and the security of our devices is a top priority at Samsung. We are aware of the report in question and are urgently looking into the matter."
I'm glad to see positive response across the board, from Apple, Samsung, and I'm sure others. Especially Apple and Samsung, though, as I have many devices from both of them in my home.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
why? Because they don't opensource a thing.
Anyone other than me believe that Apple, Samsung et al. (at a minimum) didn't look the other way before the Wikileaks dump? The OS-level issues really were unknowns for a long enough time that the CIA and other agencies could develop and deploy a playbook for hacking high value targets? What about the other elephant in the room... firmware?
Since the CIA & FBI are keeping the vulnerabilities they find secret, these companies just need to start planting spies in the CIA & FBI to find out what bugs they have on their software.
Looking for a computer support specialist for your small business? Check out
I think you're on the wrong side of the usability/security tradeoff for most people.
If you read it "of the technologies available to most people, an IOS device is the most secure", its probably true.
I guess that answers whether the leaks were legitimate. The first spate of news after the leaks tried to paint a "if you've done nothing wrong" picture and adding speculation on if it was even legit.
And, of course, the "if you've done nothing wrong, you have nothing to hide" argument is complete BS when it comes to privacy issues.
TrueCrypt is available to most people; it is free and not too difficult to set up. A safe can be had for $100 or less. If you can afford an iPhone, you can afford a laptop and a safe. Affording TrueCrypt is a given, as it's free. That's not where that AC's argument falls apart.
That argument falls apart when you realize that TrueCrypt hasn't been under active development in quite some time and has, in fact, been abandoned by its developers with a warning that it may be vulnerable. Coupled with the fact that even the most expensive of safes are trivial to crack when compared to decent full disk encryption, which renders the entire "safe" point meaningless as well.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
TrueCrypt FDE on a laptop stored in a safe.
... encased in cement sitting on Mars.
#DeleteChrome
I'm glad to see positive response across the board, from Apple, Samsung, and I'm sure others. Especially Apple and Samsung, though, as I have many devices from both of them in my home.
Keep an eye out for updates on "Unlocked" Phones that have switched networks. For some insane reason phones are marketed as "unlocked" when they can be used on another carrier's network, but *the security updates don't work* if you use them on the other network. These should probably be considered unmarketable and therefore not unlocked--and there should be a convenient way to pull signed security updates from the manufacturer instead of the carrier. Samsung and Apple issuing patches doesn't help if Verizon and AT&T fail to talk to each other enough for users on both networks to get the security updates, regardless of who originally installed a given phone's O/S.
Real lawyers write in C++
Which could have been just after they were tipped off rhat they were going to be leaked.
They weren't patched before they were known because they weren't yet known. They haven't all been patched yet because they've only been known for a handful of days and patches don't write themselves just because you know about the vulnerabilities. Patching any non-trivial issue without introducing other non-trivial issues takes time.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Assuming the safe was cracked, and not destructively broken into, such detection is not reliable. Crack the safe, extract the contents, copy the data, replace the contents, re-lock the safe, and turn the dial back to its original position.
It might not be the simplest of operations for some safes but, again, it's trivial in comparison to cracking decent encryption. If you can crack the encryption, the safe will barely slow you down; if you can't, then I don't care if you have a copy of the encrypted data. The safe is pointless.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
So why was the timing between when they became known to Apple and when they were revealed to the wider audience in such a manner so short? I believe in coincidence;, coincidences happen every day. I just don't trust coincidences.
It's quite possible that someone within WikiLeaks disclosed them privately before disclosing them publicly. That would have been the responsible thing to do.
It's also possible that the CIA leaked the documents themselves after a number of the vulnerabilities had already been discovered. I find this less likely, as there were many vulnerabilities disclosed which have not yet been patched.
Those, of course, are only two possibilities; both of which are pure speculation.
That said, Apple has known about the gaping hole that is hot code pushing for years now and only decided to enforce their already existing rules against it very recently, so it could also be complete incompetence on the part of the vendor.
At any rate, when we've seen that products from all vendors are equally vulnerable, does it really matter who we buy from? I'd say it does not and there's no point in arguing that one is more secure than another now that we've been shown that this simply is not the case.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Apple is actually capable of making things relatively secure and makes choices that are unpopular but increase security (walled garden, deep restrictions on app access to platform, signing Mac apps required by default). They are looking out for people who truly cannot and will not understand security around technical devices.
Samsung meanwhile may talk a good security game, but they put out truly half-assed effort with a billion exploit channels. How about TV's that can record audio and have full android installations to exploit? They put zero thought in how to handle the security implications of this system (to be fair, Amazon and Google are not far behind with Alexa like devices). Samsung and other companies consider user convenience first and security second - if at all.
As for the rest of your absurd anti-Trump fantasy - Russia expected Hillary to win too. They only reason they gathered so much from the DNC was so that they'd have dirt to hold over on Hillary!
Trump had zero to do with Russian hacks, I would love to hear your frothing rabid explanation for how exactly Russia "hacked the election". After all, all the hackers every did was show us what Hillary and the rest of teh elite DNC members said and did when people were not looking. Hillary lost because she is even more Hillary than people thought, not because Russia.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
The CIA got wing of the fact that WikiLeaks were going to do the release and tipped off the manufacturers to reduce the amount of anything to see here.
IF they were deeply committed, they would have fixed them all by now.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
Fine. I hereby declare all claims ordinary. You're welcome. The point being is, what makes something extraordinary, both in claims and evidence. Investigating and monitoring ordinary people? "Extraordinary!"
So you're saying we have known knowns, unknown knowns, and known unknowns?
Isn't it sort of a fact that the security holes haven't even been fully sorted out yet?
Ok.
Apple doesn't fix known exploit for 3 years: /got bored and didn't read the other 3 million search hits.
http://www.cultofmac.com/13261...
Yeah, more or less. Same as ever.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Another one was 14 mins in
https://www.youtube.com/watch?...
Domestic spying is now "Benign Information Gathering"
I can think of more possibilities: the zero day bugs were already discovered independently and were already fixed when the CIA leaks were published.
Less likely, Apple had agreed to delay fixing some bugs. More likely , Apple knew there were some zero day bugs the CIA was making use of but did not know which ones, and was not trying to find out.
Blackberry is more secure than IOS and always has been. Also, less apps in the ecosystem adds an extra level of security.
What if I can't crack the encryption but I am capable of slipping in something to log your keystrokes?
I was just thinking the other day, the insanity of this Russia stuff is just like those idiots that kept claiming Obama was not born in the U.S.
Great comparison.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Then the laptop is still no less secure than the iPhone, to which that can also be done.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.