If it takes one guy six months to execute such a vulnerability, surely a staffed internal Apple security team could have found this in half the time. It does raise the question, though, of how much staffing Apple does have to addressing security and whether or not that level is appropriate.
'One guy in a bedroom for 6 months' is a level of resourcing a nation state can easily obtain. It's also one Apple should be capable of obtaining as well.
Nation states don't have access to Google Project Zero's institutional knowledge and experience, except maybe the US. I think that knowledge and experience is a higher barrier than people give credit.
Really the best way to prevent state level actors from developing exploits is to hire and repatriate or assassinate their talent. Seems to work for nuclear secrets.
> Really the best way to prevent state level actors from developing exploits is to hire and repatriate or assassinate their talent. Seems to work for nuclear secrets.
It tends to get used for nuclear secrets, but it doesn't seem to be as much effective at that goal as it is at providing a momentary salve on the feelings of impotence that go along with not having an effective method for that goal.
The only thing that really seems to work in that regard is altering the (international or domestic or both) political context to remove the motive for seeking the nuclear weapons technology in the first place, whether by externally-imposed regime change (Iraq) or a combination of resolving international tensions and domestic government transitions (Argentina/Brazil).
> Nation states don't have access to Google Project Zero's institutional knowledge and experience, except maybe the US
I think you might be underestimating the technical sophistication of the intelligence agencies of many foreign powers (including the UK, China, Russia, Israel to name a few).
There really are not that many people out there of this mans caliber. The obsession, the passion, the intelligence, the skill, the knowledge, the patience, the time are stars that rarely align. Beer is not just “some guy” sitting in his house for 6 months. He is one of the leading hackers in the world. If someone like him decides they are going to steal your nudies, you might as well just pose for the camera
This exploits airdrop. I haven’t owned any Apple devices myself for years, but my kids with iPhones seem to regard airdrop as mainly a medium for pranks, as apparently all their friends love to use it to stuff pictures on each other's phones. Consequently, many people just keep it disabled.
Would take less than 10 minutes if you were in proximity of a iphone to figure out a way to social engineer the owner into handing you the phone unlocked and giving them back a duplicate phone locked that was not their phone. Or just stealing it while it was unlocked (placing another phone as a replacement) or stealing it and brute forcing the 4 digit code with hoping it wasn't set to 'wipe phone'.
11 comments
[ 2.8 ms ] story [ 38.5 ms ] thread'One guy in a bedroom for 6 months' is a level of resourcing a nation state can easily obtain. It's also one Apple should be capable of obtaining as well.
Really the best way to prevent state level actors from developing exploits is to hire and repatriate or assassinate their talent. Seems to work for nuclear secrets.
It tends to get used for nuclear secrets, but it doesn't seem to be as much effective at that goal as it is at providing a momentary salve on the feelings of impotence that go along with not having an effective method for that goal.
The only thing that really seems to work in that regard is altering the (international or domestic or both) political context to remove the motive for seeking the nuclear weapons technology in the first place, whether by externally-imposed regime change (Iraq) or a combination of resolving international tensions and domestic government transitions (Argentina/Brazil).
I think you might be underestimating the technical sophistication of the intelligence agencies of many foreign powers (including the UK, China, Russia, Israel to name a few).