Contrary to public claims, Apple can read your iMessages

http://arstechnica.com/security/2013/10/contrary-to-public-claims-apple-can-read-your-imessages/

by shawndumas • 13 years ago

144 95 13 years ago

anfedorov3• 13 years ago

[The researchers] went on to say there's no technical measure stopping Apple employees, working under a secret court order or otherwise, from performing the same kind of attack and making it completely transparent to the parties exchanging iMessages.

Since Apple controls the entire infrastructure, there's nothing preventing company employees from swapping out the proper keys with ones controlled by Apple or other parties.

We have evidence of a secret court order for Verizon to hand over the meta-data associated with phone calls. IANAL, but this seems quite different from ordering Apple to perform a MITM attack against a user.

Under what kind of court order would Apple have to remove or compromise end-to-end encryption from a target's device?

ChuckMcM3• 13 years ago

The same kind of court order that told Lavabit to hand over their SSL key, one where the person of interest was communicating over iMessage. It would probably be accompanied by an NSL which would then prevent Apple from talking about it.

anfedorov3• 13 years ago

AFAIK, the Lavabit case is not legally decided yet:

  http://www.volokh.com/2013/10/11/lavabit-challenges-contempt-order/

I imagine Apple would put up quite a strong legal fight if they were issued the same order, especially considering their public stance.

A NSL can force Apple to not disclose it, but they can't force them to publically lie about it. And lying about that would be ridiculously stupid.

StavrosK13• 13 years ago

A subpoena?

I'm not aware of the protocol, but it may be that Apple could only do this the first time someone sent a message, when keys were established. It might not, I'm just speculating, but it sounds reasonable.

If Apple wanted the protocol to be insecure, they'd have just sent messages in plaintext over TLS and be done with it. The fact that Apple actively designed a reasonably secure, encrypted protocol is evidence that they wanted to protect users against themselves too (to the point where it didn't impact usability).

otterley• 13 years ago

If a subpoena were used for this purpose I'd be quite surprised. The Federal Rules of Civil Procedure only allows subpoenas to issue for the following:

1. Compel a witness to testify;

2. Compel someone to produce a document or "tangible thing";

3. Require someone to allow the inspection of premises.

Fed. R. Civ. Proc. Rule 45(a)(1)(A)(iii).

I can't imagine the Government would attempt to use subpoena power to force a business to take any other action, and if they tried to do so, as an attorney I would definitely appeal it (and probably prevail).

That's not to say there aren't other means at the Government's disposal, but subpoena is definitely not one of them.

Steko3• 13 years ago

Hasn't there been some discussion that law enforcement sends phones to apple to decrypt messages and the whole thing takes forever because Apple needs to apply some amount of brute force to it?

Spooky235• 13 years ago

The police will make this sort of request for subjects of criminal investigations. It's a specific process, governed by the courts and warrants -- I believe it's called a pen register.

Whenever a new technology comes out without lawful intercept, it gets embraced by criminals. Remember Nextel/Boost phones with direct connect? You might recall that there were 3 resellers on a block in the hood selling these things in the early 2000's. DirectConnect wasn't tappable for a few years, and the addressing scheme was tied to a phone, not a user. Those users later moved to BlackBerry.

StavrosK13• 13 years ago

This says that, yes, Apple can read your iMessages, but it seems to me that the protocol is pretty much designed to be as secure as one can make it while still being usable. Would you really expect people who used iMessage to call their friends and have them read hex fingerprints over the phone?

As anti-Apple as I am, I think we have to give them this one, especially when the alternative (i.e. making iMessage completely unencrypted) would have been much, much easier.

GrinningFool4• 13 years ago

Well - to be fair, BBM over BES is as secure as it gets. The only people who can read those messages are sender and recipient, and the owner of the org keys. Neither cell provider nor blackberry can decrypt them.

privong3• 13 years ago

I think it's established that there are backdoors in BBM. E.g., http://www.zdnet.com/in/indias-blackberry-monitoring-system-...

StavrosK13• 13 years ago

How does it exchange the keys? If you don't verify fingerprints, there's always the possibility of a MITM.

X-Istence• 13 years ago

How does the key exchange happen between the two parties? With a party in the middle that has an already existing relationship with both parties, no? That is where you sit and exchange fake data with both endpoints.

CrankyPants• 13 years ago

Leaders from Saudi Arabia, India, and probably the UAE, Lebanon, Algeria and others all disagree with you on this one.

alecsmart1• 13 years ago

As far as I know, the Indian govenrment gave an ultimatum to BlackBerry to place servers in India and provide a mechanism to read messages or to leave the country. BlackBerry caved in and was forced to do so. So even BBM isn't as secure. Anytime you trust a third party with your data, there is always that element of risk involved.

Spooky235• 13 years ago

Note that BES communications are only secure within a community of interest. (Assuming whomever is running your BES isn't logging and transmitting your texts) Once you talk to someone outside of your BES, RIM controls the key.

Negitivefrags• 13 years ago

As anti-Apple as I am, I think we have to give them this one, especially when the alternative (i.e. making iMessage completely unencrypted) would have been much, much easier.

I would be prepared to give them this one, were it not for the fact that they claimed the opposite. Make all the security vs usability trade offs you want, just don't lie about them!

StavrosK13• 13 years ago

They may very well not be able to read your messages after the initial key exchange.

Steko3• 13 years ago

Since Apple controls the entire infrastructure, there's nothing preventing company employees from swapping out the proper keys with ones controlled by Apple or other parties.

Well internal controls could prevent that but since we don't know we'll assume they don't exist, print the headline:

Tim Cook is reading your iMessages right now!

mcherm3• 13 years ago

Well, being prevented by internal controls is outside the scope of the question. Apple had claimed that they were incapable of intercepting the messages, not that they had policies against it. And Apple is known to be subject to secret US government demands that come with a gag order.

Steko3• 13 years ago

"being prevented by internal controls is outside the scope of the question"

/shrug, when Gabriel W. says no one at Duck Duck Go can read your search history he's making a claim based entirely on internal controls that DDG has established that make this impossible. Similarly, Apple didn't claim it would be impossible for them to ever <rewrite everything> and one day be able to read your iMessages.

stephen_g• 13 years ago

They said that they couldn't read iMessages as it is. One would think it was pretty obvious that they could change the system to be able to read them.

mattdmrs• 13 years ago

What we know is that it seems possible, when looking at the system externally, for them to perform MITM attacks. What we don't know is if their system internally makes it possible for anyone inside apple to intercept and read those messages, with or without an order from the NSA. They could very well have told us the truth!

pa5tabear• 13 years ago

Does that mean they can view private pictures sent via iMessage?

I've wondered the same thing about Dropbox. If I were to open my dropbox at work, could my employer view private things in the dropbox? Even if I don't open the file, an icon will still load in the browser view.

pmjordan• 13 years ago

If I were to open my dropbox at work, could my employer view private things in the dropbox?

If your employer has physical access or the admin password to your work computer (very likely) then anything you store or do on it is potentially compromised. (including passwords, keys, etc.) Same for work-issued phones etc. The security of the protocol is irrelevant in this case as you're trusting a compromised client.

roywiggins• 13 years ago

Your employer could MITM all your SSL connections just by installing their own cert installed on the machine, so yeah.

fpgeek2• 13 years ago

Indeed. This is why Apple sending your AppleID and password in the clear inside the SSL connection to Apple is troubling. That makes it relatively easy for the right IT people to steal those credentials. Hopefully this will be fixed soon.

kemayo• 13 years ago

This reads more like "Apple can't read your messages as-is, but controls all the iMessage key-exchange infrastructure, and thus could sabotage it if it chose to".

coldcode• 13 years ago

Is there any commercially viable messaging protocol that is 100% defensible against any and all attacks?

StavrosK13• 13 years ago

No, nothing is defensible against all attacks. OTR, Silent Phone/Text, (I'm forgetting some here), GPG/PGP, they're all good enough if you verify the fingerprints.

leeoniya• 13 years ago

i dont see how something like this could conceivably work for 2 parties that do not yet know each other. the problem of establishing identity/trust between strangers can't be solved in any 100% manner over any medium that can be tampered with.

if both of you rely on some intermediate authority for authentication (as HTTPS works), it's by definition not 100% because the intermediary can, in theory, be compromised.

if the two parties know each other and can authenticate via some basic questions, that may work. or you can just exchange symmetric AES keys in person or public certs through another channel.

eknkc• 13 years ago

How about physical trust creation protocol? Something like bumping phones to create key pairs and exchanging them via bluetooth. That might work fine in theory.

mcherm3• 13 years ago

This seems a bit disingenuous to me. If I understand it correctly, they are saying that the messages are encrypted using an RSA key unique to the sender, and that this is not secure because Apple could, if they wanted to or were ordered to, replace the certificates with ones that were not secret:

Since Apple controls the entire infrastructure, there's nothing preventing company employees from swapping out the proper keys with ones controlled by Apple or other parties.

What is misleading here is that (if I understand it correctly) the cryptography is solid, it is the implementation being owned by Apple that raises the doubt. But this is NOT a statement about the cryptography used on the iMessages, it is a statement about the fact that Apple effectively has "root access" to their phones.

Imagine that you had a PERFECT and UNBREAKABLE code system. Perhaps it interfaces with angles who alter the laws of the universe to prevent anyone but the intended recipient from reading the messages. Such a system would still have the same vulnerability. All Apple needs to do is to alter the phone so that when you click on the icon to launch this perfectly secure messaging app it instead launches one that has the same UI but which actually sends a duplicate to the NSA (or whoever it is you don't want listening in).

ANY system where code can be deployed at will and the owner of the device is not in full control of the device will have this same level of vulnerability. Saying that a system is insecure because you could change the system doesn't tell you anything interesting about the system.

numbsafari• 13 years ago

And so the challenge is similar to the TOR challenge, in a sense. If you want real security it requires a certain amount of inconvenience (such having to use an OS and a device for which you can verify it is doing what you think it is, or using a protocol that slows down your already slow internet connection) and because inconvenience is not popular this means using a tool that only people who are "afraid of being caught doing something" would want to use.

In a sense, you are an instant target for suspicion, you have created a "reasonable and probably cause for suspicion" by using such a device or software system.

I remember driving through my neighborhood in suburban Philadelphia and seeing a young man walking down the side of the road and being shocked by this act. Nobody walks in that neighborhood or along that road. Nobody bikes there. Frankly, it's ill advised because of the winding nature of the road and the absence of sidewalks or even a shoulder. I could feel myself become immediately suspicious of his presence and his actions.

All he was doing was going out for a walk. Frankly, I was the weird one.

At some point, as technology becomes embedded in our culture we expect people to use it and we look at those who do not as odd balls and are suspicious of them (think the Amish).

So if you are avoiding using the "latest and greatest" and opting to use a "secure system", people are going to look at you like you are crazy and be suspicious of your activities. This will probably drive you to keep it secret, which will only make it look more incriminating.

My point is: how do make these things mainstream in such a way that ordinary people who aren't interested in the security aspects can and will use them, but those who want or need the added security can use them without garnering suspicion for doing so?

hershel2• 13 years ago

That's a really interesting problem.

1. Say i care about privacy. I decide that all the help i give people over the internet, would be composed of a plain text teaser ,and an encrypted content. That's easy to imagine doing so in private messages , and even in small groups. Maybe even using some technical trick this could work on publicly posted information(or at least slow the rate/chance of wiretapping). And in those cases i only reply to messages sent securely.

If enough people do this , soon enough , there will be plenty of encryption.

2. Make it a habit to embed an encrypted background channel in many apps that always transmits, that need comes be , can be used to transmit info. "Hey it's just a cool app man". If enough such apps spread, suddenly everyone encrypts.

' 3. Same applies regarding to anonymity.

mapgrep2• 13 years ago

(if I understand it correctly) the cryptography is solid

The issue is that iMessage outright ignores a long understood challenge in the APPLICATION of cryptography, namely knowing when to trust that someone is REALLY giving you their public key rather than being man-in-the-middled.

While this is a thorny challenge there are well understood, if imperfect, ways of addressing it that have been around for decades. At minimum it works like ssh, where you get a warning when an unfamiliar new key is presented and decide whether to trust it or not. More sophisticated is the certificate infrastructure around TLS/SSL where some effort is made to bring semi-trusted third parties into play.

These are all flawed solutions, the problem remains essentially unsolved. But any truly secure system based around public keys has some mechanism that addresses this challenge.

The issue with iMessage is that 1. Apple did not attempt to address the key exchange problem, which would maybe be fair enough on an "easy" consumer product with weak security claims but then 2. Apple made strong security claims very publicly and 3. even said a counterfactual, that it had no capability to intercept messages.

THAT is what is disingenuous: Apple implements public key cryptography, which since its inception and at its very heart raises difficult challenges around key exchange; Apple chooses to ignore these challenges; Apple then claims strong public key security. Either attempt to address the challenges like everyone else, or don't make the security claim, you can't do both.

Spooky235• 13 years ago

I disagree.

The flawed systems are SMS and predecessor systems like alphanumeric pagers, where your messages are archived indefinitely in a database by the carrier. Remember the Wikileaks release of all of the pager traffic in lower Manhattan on 9/11?

In my mind, the NSA/PRISM stuff is a meta-problem that is just something that is hanging out in the background. I work in enterprise IT, I'm not a dissident, drug dealer or whistleblower, so I'm more worried about incompetent carriers and other hostile parties than the NSA.

So iMessage gives me encrypted message content that may be readable retrospectively by the NSA, and is almost certainly "tappable" by normal law enforcement.

The reality is, that's about as good as you are going to get outside of a defined community of interest. My employer has highly secure voice and text solutions available for key personnel, for instance. Perfectly secure communications won't be available to the masses, because the operators of those systems face liability.

croikle• 13 years ago

Even disregarding Apple's control over the software, the system depends on Apple as a trusted key distributor. This is the vulnerability which the article is concerned with, as far as I can tell.

sillysaurus2• 13 years ago

Two corrections to your comment...

1. The NSA vacuums up network traffic. Meaning they use man-in-the-middle attacks. Sometimes they do force businesses to deploy a malicious program, as you describe, to gather a user's password. This is called a Pen Register, or Trap Trace Device: https://ssd.eff.org/wire/govt/pen-registers However, this is the exception, not the norm.

Defending against man-in-the-middle attacks is a bare minimum requirement for any system that purports to be "secure". Defending against Pen Registers is an unsolved problem, but it's unrelated to the attack presented here.

If I understand it correctly, they are saying that the messages are encrypted using an RSA key unique to the sender, and that this is not secure because Apple could, if they wanted to or were ordered to, replace the certificates with ones that were not secret. [...] What is misleading here is that (if I understand it correctly) the cryptography is solid, it is the implementation being owned by Apple that raises the doubt. But this is NOT a statement about the cryptography used on the iMessages, it is a statement about the fact that Apple effectively has "root access" to their phones.

2. From http://blog.quarkslab.com/static/resources/2013-10-17_imessa... page 36:

- All iMessages are encrypted and signed using asymmetric cryptography

- Thus, there has to be a key directory

- iMessage client retrieves recipient’s public keys by querying Apple’s ESS server

It's that last point which is the most important. When someone sends you an iMessage, their device queries an Apple-controlled server for the recipient's public key. The server returns a "Public Keys Buffer". The buffer contains an RSA public key (1280-bit) to encrypt messages for the remote device.

Apple controls that server. They can send you whatever public key they want.

In other words, while I wouldn't say it's "trivial," it's at least "realistic" for the government to be able to order Apple to serve up an MITM'd public key. Combined with a copy of the network traffic, they can then decrypt all iMessages. And the government isn't the only adversary to worry about, either.

The point of cryptography is that you should be able to trust who you choose to trust. Apple is saying we can trust their claim of not being able to decrypt iMessages. But that claim rests on Apple to serving up the proper public keys through Apple-controlled servers. This is called the key exchange problem, and it's why their iMessage claim can be accurately described as "completely bogus." They don't even attempt to address key exchange security.

The takeaway is: iMessage shouldn't be trusted.

voltagex_• 13 years ago

Apple controls that server. They can send you whatever public key they want.

Isn't that also true (minus Apple) for the PGP keyservers?

ddeck• 13 years ago

I don't find it disingenuous. Per the article's title, it is refuting Apple's claim that it "cannot" access iMessages, and on that basis, I think it's entirely valid. Apple put out a statement earlier this year:

For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. [1]

I didn't read the article as asserting that the encryption is broken or poorly designed, simply that if compelled, Apple could indeed eavesdrop on iMessages, which contradicts the above statement. The author explains this explicitly:

In fairness to Apple, most other commercial messaging systems are also vulnerable to man-in-the-middle or similar attacks mounted by insiders. The difference is that few if any of those other providers have issued public statements claiming the messages sent over their services can be read only by the sender and receiver.

[1] https://www.apple.com/apples-commitment-to-customer-privacy/

WaterSponge• 13 years ago

Did anyone ever figure out how the iMessage for Android developer got his implementation to work?...

tuananh• 13 years ago

saurik said this on Twitter[1]

A 3rd-party iMessage app was just released on Android; I believe all data sent from/to Apple is resent to/from China for processing: beware.

[1]https://twitter.com/saurik/status/382387551144652800

tedunangst• 13 years ago

Imagine a giant cluster of VMs running desktop iMessage. Imagine the android client is actually a VNC client connecting to one of the VMs and screen scraping it. Sprinkle with magic dust and UI polish.

stellar678• 13 years ago

So if I get this right, the vulnerability is that Apple could sit in between you and your friend, impersonating each to the other while relaying and reading your messages.

This seems about as vulnerable as the certificate authority/public key infrastructure system used for SSL, code signing, etc... We're always delegating to another party the responsibility of authenticating the person on the other side of our messages/web browser/signed software that we run. In the case of iMessage, Apple is responsible for authenticating your friend. In the SSL or signed code case, the certificate authorities are responsible. Seems that both Apple and CA companies might be subject to the same legal pressures to eavesdrop on people.

fsckin2• 13 years ago

Not quite. A CA signs your public key. You never give anyone the private key, because... well, it's private.

agwa2• 13 years ago

You're not giving anyone your private key here, either.

stellar678 is basically correct - Apple, like a CA, is vouching for the authenticity of users' public keys. The only difference is superficial: a SSL CA signs a certificate and the validation is done without needing to contact the CA, whereas with iChat the public key is validated by virtue of coming from Apple. Just as a CA can sign a malicious certificate, Apple can send you a malicious public key.

nick32m• 13 years ago

I don't mind apple is able to it... as long as not the chinese government ..

tonyplee• 13 years ago

Most likely, the chinese government can/does tell Apple to decrypt certain msg or don't do biz in China, similar to what India government told RIM.

_Simon• 13 years ago

Article's author is Dan Goodin. I'd take everything he says with a quarry full of salt. This guy is symptomatic of all that is wrong with Ars these days.

Contrary to public claims, Apple can read your iMessages

Related Stories