Apple Addresses iOS 'Backdoor' Concerns by Outlining Legitimate Uses for Targeted Services [Updated]

[i4m]

Knowing Apple, they would have had this response prepared a long long time a ago. My guess is that those services have multiple purposes, one for PR the other to please law enforcement, etc.

 

[Zxxv]

maybe its not entirely apples fault? maybe some of the programers are working for the government/NSA and slipped this by the top brass? maybe the legitament reasons apple gave are what they believed was happening?

 

[OldSchoolMacGuy]

LULz. The concerns highlighted are far from the biggest ones. There are much simpler ways to gain access to the iPhone to pull data and have been since it's initial release.

 

[i4m]

...
Now can we please stop making these types of posts? ...

Why don't we begin with you

----------

If you don't trust Apple, then don't lend them the freaking phone. That's not like they can remotely access my phone.

Does that mean you trust the Gov because you pay taxes?

----------

Those aren't the problem. It's that Apple refuses to open its code to the Government and let it build its own iOS system.

Actually, I am glad that Apple keeps this capability to itself.

Why would the gov want to build its own iOS system if iOS was secure enough?

----------

I always love how everyone always freaks out about these kind of things... OMG Apple may be back-dooring my phone and they may know that I spend way too much time playing Monopoly slots, sent a few texts, made a few phone calls, allegedly may have looked at some pron, and that I read a lot of MacRumors!!!

you sound like someone who doesn't care about your rights: ignorance is bliss for you.

----------

LOL didn't read.

1. com.apple.mobile.pcapd

pcapd supports diagnostic packet capture from an iOS device to a trusted computer

2. com.apple.mobile.file_relay

file_relay supports limited copying of diagnostic data from a device.

3. com.apple.mobile.house_arrest

house_arrest is used by iTunes to transfer documents to and from an iOS device

He read! He just didn't blindly accept it.

----------

Not a single one of those uses is a legitimate reason for storing personal data unencrypted and allowing access to it when the user has enabled encryption.

So true!

----------

Not buying the transparency bit... Apple farts, fans take a deep breath and smack their lips.

 

[apolloa]

What, exactly, does a story on iOS security and the data Apple mines from you have to do with Politics, Religion, Social Issues... then Mac Rumors? Or did you want to control who could post on this topic?

 

[blackcrayon]

Call me an Apple fanboy or whatever, But I 100% (more realistically around 92.8%) trust Apple.

I know Steve Jobs cared 100% about this company. The man stopped working only when it was physically impossible for him to go to work. I heard he even was talking about the iPhone 5 a day before he died to Tim Cook.

I know I know I shouldn't compare Steve to Tim. But I also believe Tim cares just as much as Steve did about Apple. They are honest and truly care about its products.

Im lovin their transparency now!

Here's the thing. If you don't trust Apple about what these services are for, you might as well not trust them with anything, since you are carrying around a phone with a camera, microphone, GPS, near mandatory network and cloud services that you type personal things in all of the time. So if you think Apple is outright lying about 1 thing, you might as well not use any of their devices at all.

 

[cgc]

If you make that above post, then you know you're a Google fanboy.

Now can we please stop making these types of posts? This is probably the new "Safari is snappier" type of posts. Take any front page post vilifying Apple, change the headline to Google and then mention how Apple fanboys will be pissed, will take a negative tone and then will promptly **** their pants.

Seems like more and more people feel good about themselves only after calling someone a name...brought to you by our politicians as of late.

 

[PBG4 Dude]

What, exactly, does a story on iOS security and the data Apple mines from you have to do with Politics, Religion, Social Issues... then Mac Rumors? Or did you want to control who could post on this topic?

Maybe this is Macrumors' house arrest forum?
Only the dedicated loonies can post here.

 

[69Mustang]

Here's the thing. If you don't trust Apple about what these services are for, you might as well not trust them with anything, since you are carrying around a phone with a camera, microphone, GPS, near mandatory network and cloud services that you type personal things in all of the time. So if you think Apple is outright lying about 1 thing, you might as well not use any of their devices at all.

That makes no sense. Very few things in life are all or nothing. How silly does it sound to say you trust Apple 100% or you don't trust them at all. The explanation from Apple simply explained what they do with the diagnostics, not what can be done with the diagnostics.

 

[TWSS37]

What does it say about Andriod fans when they don't know the difference between your and you're.

Rule 1 to grammar checking others, make sure your insult is perfect.

BTW you're also asking a question, not making a statement - use a question mark.

Other than that though, this is a top notch post.

----------

Your sentence is missing a question mark. You spelled Android incorrectly. What does that say about you?

Posted something similar before reading this but this, exactly.

 

[unplugme71]

I think Apple knows what kind of scrutiny they are under (fair or unfair, you have to admit it's extreme) and so are unlikely to lie about something like this. Can you imagine the headlines if one of these security researchers actually proved that something they said wasn't true? Right now all we have are accusations, which are a dime a dozen. Tim Cook burps at lunch and there are conspiracy theories on the internet within the hour.

As long as these three holes can't be exploited without my phone and 'trusted' computer, I can care less. I have nothing on my phone except a bunch of pictures of someecard crap. Wow, you hit the jackpot buddy!

 

[scottwaugh]

I think Apple knows what kind of scrutiny they are under (fair or unfair, you have to admit it's extreme) and so are unlikely to lie about something like this. Can you imagine the headlines if one of these security researchers actually proved that something they said wasn't true?

I think you're right here.

I also think it would be very helpful for Apple to make this a turn off option in Settings for these services, so you can turn them off by default and turn them on when you might want.

It was also pointed out that Tim Bradshaw of the Financial Times received a reply from Apple on this issue and stated the following:

"We have designed iOS so that its diagnostic functions do not compromise user privacy and security, but still provides needed information to enterprise IT departments, developers and Apple for troubleshooting technical issues. A user must have unlocked their device and agreed to trust another computer before that computer is able to access this limited diagnostic data. The user must agree to share this information, and data is never transferred without their consent.

As we have said before, Apple has never worked with any government agency from any country to create a backdoor in any of our products of services."​

If Apple isn't being straight up here with their customers here, it'd get out & there'd be huge blowback and damage to the brand...I don't think Tim and Co. would risk that.

 

[bobenhaus]

Call me an Apple fanboy or whatever, But I 100% (more realistically around 92.8%) trust Apple.

I know Steve Jobs cared 100% about this company. The man stopped working only when it was physically impossible for him to go to work. I heard he even was talking about the iPhone 5 a day before he died to Tim Cook.

I know I know I shouldn't compare Steve to Tim. But I also believe Tim cares just as much as Steve did about Apple. They are honest and truly care about its products.

Im lovin their transparency now!

Yeah you would care just as much if you were making 300 million in stock options.

 

[scottwaugh]

As long as these three holes can't be exploited without my phone and 'trusted' computer, I can care less. I have nothing on my phone except a bunch of pictures of someecard crap. Wow, you hit the jackpot buddy!

This might be true for you, but for most users a phone has more information on it (that the NSA would like to record and store...for future needs of course) than their PC.

Most folks smartphones have who they talk to (& when), who they text to (& what and when), where they've been, their contact list with associated information and of course web sites that they go to with logins, and of course pictures (which we've learned the NSA is scraping) etc..

With regards to the govt recording things (which we've found out they're doing), a smartphone is a jackpot. According to what we've found out in the documents (which were several years old at the time), iOS and Android were easy access devices:

http://www.iclarified.com/37195/the...or-nearly-complete-access-to-the-apple-iphone

 

[wiz329]

I don't think that means what you think it means.

 

[CylonGlitch]

As long as these three holes can't be exploited without my phone and 'trusted' computer, I can care less. I have nothing on my phone except a bunch of pictures of someecard crap. Wow, you hit the jackpot buddy!

Agreed, and with reading the bold part of this statement :

Each of these diagnostic capabilities requires the user to have unlocked their device and agreed to trust another computer. Any data transmitted between the iOS device and trusted computer is encrypted with keys not shared with Apple. For users who have enabled iTunes Wi-Fi Sync on a trusted computer, these services may also be accessed wirelessly by that computer.

Indicates that there is no real back door, it would require the user to trust another piece of hardware to create keys with it. That would be a user problem, don't just go around trusting every computer nearby.

Assuming Apple told the truth in the above statement, I see no issues here at all. These services HAVE to be running (in general) if you want to be able to sync content from your computer.

 

[scottwaugh]

LULz. The concerns highlighted are far from the biggest ones. There are much simpler ways to gain access to the iPhone to pull data and have been since it's initial release.

It sounds like you work for a company that specializes in software providing access to iPhone data.

If you don't mind me asking - what kinds of stuff could you get from an iPhone with a wifi or cellular(?) connection and no user approval (& iOS 7)? Or the backup data on the Mac?

 

[mbh]

Any service with the name "house_arrest" raises some red flags.

It's probably a word play on "jailbreak" or something.

There's a system call in UNIX, which iOS and OS X is based on, called "kill". It doesn't mean that Apple wants you dead.

 

[winston1236]

I believe Apple.

I don't.

 

[scottwaugh]

Reply from the Researcher - good points

Here's the reply to what Apple said from the researcher who pointed these issues out and he makes extremely good points:

http://arstechnica.com/security/201...ndocumented-services-that-can-leak-user-data/

Basically many of these things while they can be used for the stated purpose can also be turned on wirelessly, without the users permission or knowledge and used to access users personal data....if nothing else this stuff needs to be locked down, as of right now, its doesn't look like it is. The researcher also tried to reach out to Apple privately about these issues before, but was ignored.

The researcher said he'd like the following from Apple, which seems like commonsense suggestions:

1. pcap not work over wifi
2. file relay respect backup encryption or not exist
3. house arrest limited to Documents

 

[charlituna]

That means your iOS device is still hoarding all sorts of personal information without your knowledge and consent, even though you're not sharing it with Apple. The info can be retrieved illegally and/or with legit forensic tools.

You sound like this hacker dude. Making accusations with no proof. He claims X but doesn't back it up with any actual analysis and folks eat it up, getting ad impressions and giving him press.

Exactly what personal information is iOS hoarding without your knowledge or permission. You say it is so prove it.

So, Apple needs to step up there and have a simple option to disable all diagnostic information, period. I don't care about legitimate users for these services, they're not required and they're storing information I don't want iOS to store in the first place that's not encrypted with my passcode.

1. Go to the Genius Bar and yes that information is needed.
2. What information on your phone is not encrypted with your passcode. Excluding perhaps a jailbroken phone or a previously synced computer you can't backup/sync or even restore a passcoded phone. So it seems difficult to find any info, encrypted or not. Yes he says Apple can do it (and by Aople I mean the bigwig engineers not the pimples at the stores). But has he proven any of his claims.



----------

This doesn't sound legit. Even if these genuinely are not meant to be backdoors, these are still three security holes that they show no sign of fixing.

They aren't holes until someone can prove Apple is lying that there is no other use or access means.

----------

I tend to believe Apple when they say they didn't install these services for nefarious purposes. But it doesn't change the fact that they expose way more information that is needed for the stated purposes, and that they are not well protected.

Proof? Like this hacker etc you say these things and haven't proven what information, lack of protection etc

 

[Tech198]

Never trust anything 100%. I don't even trust my wife 100% of the time. Hell, I don't trust myself 100% of the time.

lol... apparently neither does the 16 people who voted you..

Those aren't the problem. It's that Apple refuses to open its code to the Government and let it build its own iOS system.

Actually, I am glad that Apple keeps this capability to itself.

Me too.

If you can't trust Apple, who can you trust... Maybe we shouldn't be trusting our ISP either...

True, this probably shouldn't be in our phones, but as Apple points out, its for legit reasons..... its just people always get the wrong impression of it, which makes it sound more evil than it actually is helping.

There has been no proof from this forensic person what exact stuff this picked up on.... he just says "Documents" and other data. ok, but what in particular ?

He can go into detail about he found a problem, yet he can't point out what he found?

I'm be cautious of this, not Apple. Besides, isn't it interesting that we have been using iOS all this time, and no-one, up till recently, has found this..

 

[charlituna]

Those are only Apple's legitimate uses for it, which really have nothing to do with the security flaws themselves.

Again you say it, but haven't proven it. Show, or even just find, proof that someone can violate a non jailbroken phone using any of these.

 

[Hastings101]

"house_arrest" do these names get picked just to freak people out?

 

[scottwaugh]

...
There has been no proof from this forensic person what exact stuff this picked up on.... he just says "Documents" and other data. ok, but what in particular ?

He can go into detail about he found a problem, yet he can't point out what he found?...

The researcher actually did a presentation on what he found with details. His response to Apple's reply is over here with a good amount of what he didn't like about the 3 services Apple responded on:

http://arstechnica.com/security/201...ndocumented-services-that-can-leak-user-data/

Frankly this stuff might just be leftover in the current security state because Apple just didn't have to worry about things like that when it was written years ago, but things are different now - and if there are a few simple things Apple could do to lock down our jackpot's of information from casual government (or other's) eyes, I think most customers would like that.

I think another user mentioned that there are at least 4 commercial products for pulling all your data off your phone without your permission (sold to law enforcement and govts) - so there's obviously some back doors open that Apple could close (whether these are the main vectors are another question).