Apple's iOS App Store suffers first major attack | Hacker News Reader

Apple's iOS App Store suffers first major attack

reuters.com

38 pointsjeo123411 comments

Related discussion: https://news.ycombinator.com/item?id=10243151

Hmmm what kind of developer is using a modified version of Xcode from some shady source?

It's possible that we all are. In fact, it should be assumed that everyone who uses Xcode is using it from "some shady source". Shady, as in the CIA/NSA.

https://www.schneier.com/blog/archives/2015/03/how_the_cia_m...

> The security researchers also claimed they had created a modified version of Apple's proprietary software development tool, Xcode, which could sneak surveillance backdoors into any apps or programs created using the tool. Xcode, which is distributed by Apple to hundreds of thousands of developers, is used to create apps that are sold through Apple's App Store.

---

Edit:

Until Xcode is fully open source it should be considered compromised. Unfortunately, even if it ever became fully open source, it will still be difficult to trust a compiler that you use to build Xcode [1]. However, at the very least, all possible build utilities and distribution components should be open source.

[1] Reflections On Trusting Trust, by Ken Thompson: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...

You can probably verify the output of the compiler. This takes some effort, and 99.99 and a few more nines of developers don't do it, unless they're stepping through assembly trying to find a bad bug or performance issue.

On the other hand, if Apple is doing transformations on the code you give them (e.g., you hand them LLVM bytecodes or whatever), then the process is harder because Apple's doing the code gen and optimization. Still, you should be able to notice utterly foreign basic blocks and system calls ("hey, when did our app start calling mkdir?").

While I wouldn't discount this as a vehicle for state level actors to distribute malware ("stateware"?), and while we know that in practice this "many eyes" stuff doesn't really work out, this type of tampering would be detectable after the fact, with detection easily automated once discovered in the wild.

This makes no sense to me. If the CIA/NSA had the ability to force Apple to modify their offical XCode distribution then surely they could force Apple to do anything. This could include not encrypting iCloud data.

Check out the full piece by The Intercept, it explains a lot of this: https://theintercept.com/2015/03/10/ispy-cia-campaign-steal-...

Note that it's not that CIA forced Apple to do something; the allegations are that CIA could be doing this without Apple even knowing.

Edit: But yes, I would agree with the idea that it might be possible for CIA or NSA to have "rooted" Apple entirely, and have total control over iCloud, iOS, Mac OS, etc. It does not seem entirely unlikely in fact.

Just fyi, it's not that they wanted to use an unofficial source: https://news.ycombinator.com/item?id=10243271

But they did decide to nonetheless.

Seems the real problem is a tech-hostile government making life difficult for legitimate developers.

Liberty is important. Really important.

There was a report here a few days ago, with a version of Xcode repackaged to insert malware into each app.

http://www.macrumors.com/2015/09/20/xcodeghost-chinese-malwa...

Wow, apparently wechat developers are.

Wechat... Yikes.

Tinfoil scenario: China govt slows downloads of official apple releases while simultaneously working to promote and popularize state-infected p2p/unofficial releases. Devs will do what it takes to get a copy

Reply on news.ycombinator.com