The CIA Campaign to Steal Apple's Secrets (2015)

https://theintercept.com/2015/03/10/ispy-cia-campaign-steal-apples-secrets/

by colinprince • 7 years ago

223 99 7 years ago

theintercept.com

dang• 7 years ago

Discussed at the time: https://news.ycombinator.com/item?id=9176538.

tgb29• 7 years ago

I hope the CIA steals Apple's ability to innovate

C1sc0cat• 7 years ago

cough A12 cough

nickelcitymario10• 7 years ago

Nothing in this article is surprising. I mean, honestly, if you don't think the CIA is actively trying to gain access to your devices, WTF do you think they do all day?

I'd be more concerned if the intelligence agencies of the world WEREN'T doing this. It's their purpose. It's what we pay them for with our taxes.

Of course we should also always root for tech companies to stay one step ahead. But infosec is an arms race, and I sure hope my own country's intelligence agencies (CSIS and the CSE in Canada) are doing their best to stay ahead of, say, North Korea or Russia.

(Please note: I'm not saying violating our privacy is OK, any more than I'm saying it's cool to launch nuclear weapons. But if anyone's going to have the ability to hack my phone or launch a nuke, I want it to be the people on my own team. This seems like basic self-interest and survival strategy.)

whatshisface• 7 years ago

WTF do you think they do all day?

One would hope that they were trying to gain access to someone else's devices, as opposed to turning the guns towards their own citizens and economy. If a soldier showed up at my door and pointed their gun at me, my reaction wouldn't be "of course you're doing that, your job is to point guns."

penagwin• 7 years ago

Somethings like spying on American phone calls (or just their "metadata") I agree with.

But somethings like breaking encryption, exploiting iPhones, etc. while they may be used against Americans can also be used against others.

Essentially there's an arms race, and we use our tax money to sponsor our government in this race, with the hopes that they'll side with us. There really isn't another option unless you want to give a private entity this power, or not participate in the race (which I don't advise).

yorwba• 7 years ago

One would hope that they were trying to gain access to someone else's devices, as opposed to turning the guns towards their own citizens and economy.

Apple devices are sold all over the world, so there's no way of gaining access to the enemy's devices without that method also being applicable to everyone else. Actually using them on everyone else is a different matter.

everdrive2• 7 years ago

No one outside of America has ever bought an Apple device, obviously.

dictum• 7 years ago

I'm yet to see a clear explanation for citizens not being as much of a risk as, say, a random foreigner located far away from your country.

If anything, a citizen is more capable of carrying out a terrorist attack, or just doing any action some foreign power wants to perform in that country.

The exception for domestic citizens seems to be just a concession for the masses and their representatives, not a pragmatic choice.

Edit: a pragmatic reasoning could be compartmentalization — keeping citizens under the watch of a separate entity (e.g. FBI) but it doesn't explain why domestic mass surveillance should be ruled out.

baddox• 7 years ago

I think it's pretty fair (although naive, obviously) to expect soldiers and intelligence agencies alike to, you know, actually just keep us safe.

DaggerDagger• 7 years ago

Let's be real. It wouldn't be that surprising given how the world actually works. Assuming you aren't an oligarch.

rswail2• 7 years ago

Well, by law, the CIA aren't allowed to spy on US citizens, that's the FBI's job.

However, there's nothing stopping them sharing capabilities with the Five Eyes and asking one of them to spy on a US citizen...

ProAm• 7 years ago

WTF do you think they do all day?

Look for WMD's in middle eastern countries to justify policy?

lostlogin• 7 years ago

Well, all middle eastern countries bar one.

kurthr4• 7 years ago

The CIA is spying on your phone so that the Russians and Chinese don't have to?? Really, you think CIA OpSec is that good... as in so hard to crack that it's worth spending $100 billions (in Rubles and Yuan) to do it some other way? Maybe some political doofus thinks that, but technically savvy folks should know better.

Nope, if you create a weapon you better be prepared for your enemy to use it against you.

Not_a_pizza• 7 years ago

Really you need to think about world governments less like permanent adversaries and more like parents that get annoyed with each other from time to time.

nickelcitymario10• 7 years ago

Not that I think anything I say will convince you to my thinking, but I didn't say "the CIA is spying on your phone so that the Russians and Chinese don't have to". I'm not sure how you got that from what I wrote.

In an ideal world, no one can hack my phone. This is why I support Apple and Google and Microsoft and all the others doing their very best to keep my devices as secure as possible.

In the worst-possible world, enemy nations have hacked my phone. Because if they've hacked my phone, they've also hacked those of my politicians and military.

In the real world, the only way for my country to be able to defend against enemies is to be as-good-as or better than those enemies at hacking my phone.

That's why I support it. Because I have a sneaking suspicion that truly awful people are working hard to hack every device out there, and the best infosec defense is a good infosec offense.

I don't disagree with you that "if you create a weapon you better be prepared for your enemy to use it against you". But a worse scenario than that is for my enemy to beat me to the punch and I'm standing here with sticks and stones.

The thing about an arms race is that once it starts, it's pretty much impossible to get out of. I didn't start the infosec arms race. It would be nice if the race didn't exist at all. But it does.

Only a "political doofus" would prefer to pretend otherwise.

0xdeadbeefbabe• 7 years ago

Well yes, and I also hope we don't know what they do all day.

Another point worth making is that the government can't really be on your team, as they tend to hog the ball/puck.

nickelcitymario10• 7 years ago

"the government can't really be on your team"

That's kind of the root problem of democracy, isn't it? If a government truly is "of the people, by the people, for the people", then they are by definition on their people's team, and their people should trust them.

But, if they can't in fact be on your team, and if you can't trust them, then you can't really have a democracy, can you? You end up with something else, something that looks like democracy but really isn't.

leggomylibro• 7 years ago

Aren't domestic investigations the FBI's job, though? Why does the CIA have jurisdiction to steal the intellectual property of an American company?

java-man2• 7 years ago

Why do they hack computers of congressional staffers?

Why do they explicitly violate the law (re: Iran/Contras)?

Why...

Kalium4• 7 years ago

For operations, you're completely correct!

Research, which is what this article appears to be primarily about, the CIA is permitted to conduct domestically.

marssaxman3• 7 years ago

I think you all must have a different relationship with your government in Canada than US citizens do.

None of these agencies are "on my own team". They are all adversaries. I feel far more threatened by US government hacking precisely because I live inside US jurisdiction. If we were to have a difference of opinions, and they were to snoop around in my data and decide they didn't like what they found, well, I'm sitting right here; they could easily ruin my life.

What are the Koreans or the Russians or anyone else going to do to me? They're an ocean away and I pose no conceivable threat to them. Harassing me would be expensive and pointless; they're not going to bother.

megous2• 7 years ago

Poison you?

avn2109• 7 years ago

+1 for the idea that I (an American citizen) would much rather have Putin or the Chinese compromising my security than most American intelligence.

nickelcitymario10• 7 years ago

I suspect we have a similar % of Canadians who distrust the government as Americans do. I'd count myself among them.

However:

1) I maintain that the only reason to fund an intelligence agency is to expect them to perform intelligence activities, and today that requires being the best in the world at black hat infosec.

2) I mistrust my government less than I mistrust yours or Russsia's, because at least my government depends on me for votes and taxes and general compliance with laws.

dcolkitt• 7 years ago

Considering that Apple is a US company, and that millions of US citizens use Apple products, US intelligence agencies should be securing these devices. Not compromising them.

The US has such an overwhelming military advantage over North Korea or Russia that it doesn't have to gain a leg up in infosec. All it has to do is level the playing field by making sure that everyone's running as securely as possible.

I'll rely on the one dozen Naval Carrier Strike Groups to keep me safe. Really doubt that reading Kim Jong Un's email is going to make a difference.

Kalium4• 7 years ago

Considering that Apple is a US company, and that millions of US citizens use Apple products, US intelligence agencies should be securing these devices. Not compromising them.

You're absolutely right! It's unquestionably the job of the US intelligence apparatus to help secure American interests.

With that said, Apple is a multi-national company, with millions of units used by people of all nationalities. And a vast amount of American military superiority is based on superior technical intelligence.

A carrier group can solve, at great expense in blood and treasure, a problem that intelligence can often solve more quickly and at an earlier point in time. With that in mind, it seems reckless to not take seriously the value of intelligence.

Again, you're completely correct in every way. Apple is an American company! It's just perhaps possible that there could be a bit of subtlety to this.

50656E6973• 7 years ago

doesn't have to gain a leg up in infosec
I'll rely on the one dozen Naval Carrier Strike Groups to keep me safe. Really doubt that reading Kim Jong Un's email is going to make a difference.

That's a weak strawman argument.

The fact that spying on foreign enemies now requires the capability to spy domestically is definitely a red flag. But saying we don't need infosec when that Naval Carrier Strike Group can be owned, rendered useless by a cyber attack is naive.

Moreover, rogue hacker groups from all across the world posess the power to covertly & remotely target critical infrastructure of virtually any nation. What good is a Naval Carrier Strike Group going to do against that?

tylersmith• 7 years ago

Most people don't pay taxes so the CIA can spy on them. They pay taxes so they don't end up in prison. If they're going to take our money I'd actually prefer they just used it to buy themselves luxuries over spying on us.

munk-a• 7 years ago

I am generally positive on the side of TLA efforts to compromise existing software, more so if they share the vulnerabilities with those companies (basically, security testing is hard, having a government agency that tries to break software could be seen as a very useful public service)... when they hoard those exploits to use themselves I'm a bit less sympathetic and grow less and less the longer they hold off on disclosing them.

The thing I'm 100% not okay with is when TLAs use social pressure, legal pressure or traditional espionage to insure there are exploits they can exploit - this has never ended well and is always a concession in security that increases our vulnerability to bad actors. I have a modicum of trust for TLAs in the traditional espionage realms, but they have entirely burned my opinion of them when it comes to tech at this point... The NSA compromising ECC `Dual_EC_DRBG` is just a level of stupidity that demonstrates a clear lack of responsibility to civilians.

danielscrubs• 7 years ago

Which is exactly why there are so few countries that you can trust. Here is a good article about it: https://protonvpn.com/blog/best-vpn-country-comparison/

CalChris3• 7 years ago

How is pen testing of iPhones stealing Apple's secrets? Does Apple know these holes are there and they're keeping them secret?

I'll grant you that if the CIA broke into Apple and stole keys, that would stealing along with breaking and entering or the cybercrime equivalent. But that's not what the article says.

mlindner• 7 years ago

Yeah this article is a bit ridiculous. Pen testing is what security researchers do. It's a proverbial mountain out of a molehill.

The Intercept longs for its Snowden glory days.

ixtli• 7 years ago

Not to nitpick but this is from 2015, which was right around the time when journalists were able to dig into how companies like microsoft and apple worked with the CIA/NSA to violate privacy, happily or otherwise.

joezydeco• 7 years ago

What about moles? Could the CIA hire someone, or many people, to attempt to get hired by Apple and spend years working their way into the higher echelons of the company?

CalChris3• 7 years ago

They could do that but that wasn't what the article was about.

DINKDINK2• 7 years ago

How is pen testing of iPhones stealing Apple's secrets?

Did you read the article? The CIA -- in addition to pentesting -- is trying to exfiltrate GID keys of Apple devices. That is quite literally, trying to steal Apple's secrets -- not checking which systems have vulnerabilities.

CalChris3• 7 years ago

Thank you, I did read the article. No, that's pen testing.

tgragnato• 7 years ago

The security researchers also claimed they had created a modified version of Apple’s proprietary software development tool, Xcode, which could sneak surveillance backdoors into any apps or programs created using the tool. Xcode, which is distributed by Apple to hundreds of thousands of developers, is used to create apps that are sold through Apple’s App Store.
The modified version of Xcode, the researchers claimed, could enable spies to steal passwords and grab messages on infected devices. Researchers also claimed the modified Xcode could “force all iOS applications to send embedded data to a listening post.” It remains unclear how intelligence agencies would get developers to use the poisoned version of Xcode.

Sounds suspiciously like XCodeGhost: https://en.wikipedia.org/wiki/XcodeGhost.

This is probably worth a reference to Ken Thompson's "Reflections on Trusting Trust".

jokoon• 7 years ago

One thing is sure, is that the Snowden leaks really made me realize that countries won't bother with morals to improve national security and advance its capabilities, but in the end, it's just another debate that Machiavel has answers for.

I think that communication technologies, and high speed internet becoming so widespread, created a big new battlefield which is particular because it's not so violent and ugly.

There aren't clear military laws about the internet like there is for other battlefield like the geneva convention, and that's makes all of this so interesting.

exabrial• 7 years ago

Dear CIA:

I have information regarding top secret Apple swipe to unlock technology patent.....

auslander• 7 years ago

Apparently they had no problems with Android devices.

nickpsecurity• 7 years ago

"“Apple led the way with secure coprocessors in phones, with fingerprint sensors, with encrypted messages. If you can attack Apple, then you can probably attack anyone.”"

They really didn't. There were cryptophones, such as Cryptophone, doing secure messaging and stuff before Apple. Julian Assange used one IIRC. High-assurance security did stuff like Sectera Edge with some side-channel shielding, too. Then, there were companies like OK Labs building minimal, trusted, computing bases into phones with stuff like Android sandboxed in user-mode. Sensitive stuff ran outside. Then, Apple got into the game. They could still copy some of these techniques for improved security on top of what they're doing already.

https://www.cryptophone.de/

https://web.archive.org/web/20080408152145/http://www.gdc4s....

https://web.archive.org/web/20110219075132/http://www.ok-lab...

jasonvorhe• 7 years ago

Apple still led the way: Because Apple did it, Android vendors followed suit.

Cryptophone and the other products were a niche market and no one really knows if they are good enough to withstand a nation state attack or if they are just good enough to provide better opsec for companies than regular phones did.

_robbywashere• 7 years ago

It’s funny because it appears, looking at the history of data leaks, security breaches etc - our biggest threat appears to be our insecurity Perhaps they should work the other way, assisting people and entities of this country to be MORE secure, not LESS.

otakucode• 7 years ago

Brennan said the CIA reorganization will be modeled after the agency’s Counterterrorism Center, which runs the U.S. targeted killing and drone program.

I always like to remind people when this comes up - The CIA is a civilian agency. They are not military. They have no legal right to engage in anything remotely resembling military action. Their only legal behavior is to collect international intelligence, though they seem to be capable only of doing everything outside their mandate and not within it. Why they weren't disbanded after the USSR imploded into bankruptcy 2 weeks after they had delivered a report claiming that the USSR was 'not a paper tiger' and 'growing stronger every day' and that they would continue to present the largest threat to the US on the global stage for the foreseeable future I have no idea. Most amateurs could have told you the USSR was on its last legs after years of scientists and members of their military reporting not being paid for years at a time. But the CIA was absolutely certain that they were doing great. And they should know, they had devoted stupendous resources to their intelligence work there. But, nope, they didn't see it coming at all.

The CIA Campaign to Steal Apple's Secrets (2015)

Related Stories