Hacker News Reader

Comment by gjsman-1000 | Hacker News Reader

To confused HN commenters: Correlium works by offering VMs of iOS and all models of Apple device, and allowing Terminal access (i.e. pre-jailbroken) access the operating system underneath.

For example, as a security researcher, I could order a copy of iOS 11.1 running on an iPhone 6 32GB. It would be spun up and accessible in about 3 or 4 minutes, and I could run direct commands on the Darwin kernel underneath.

Why is this illegal? Correlium DOES NOT have a physical iPhone 6 that it is screen recording. They actually have made copies of various iOS releases, and are running them on virtualization software, while making big bucks from the researchers for this technology.

Will Apple win? Well, if you look at the Apple vs Psystar case of 2007 (in which Apple won pretty much every case and appeal and every injunction they filed for), the odds of victory from Correlium is about as likely as Bill DeBlasio winning the 2020 Election.

View on HN

There is a fair use case here. My understanding is that you're allowed to do this sort of thing for purpose of security research.

It most definitely is not unethical. Illegal perhaps, but unethical? Please.

If they are trying to make money off selling to people doing something other than security research (say, playing games and using apps), than yeah, that'd be unethical.

Under what doctrine / case law?

Fair use for purpose of research.

I can’t steal something then sell it to someone else “for research purposes only” and be okay.

Fair use/research is not what Corelium is doing. They are selling the product to other people. What those other people do is beside the point.

Edit: Oops. Meant to reply to blazespin.

To make copies of iOS (against ToS), run it on non-Apple-branded devices (against ToS), and make profit off it?

Like, I could see fair use for an individual security researcher, but a business making profit circumventing Apple's ToS and security in multiple ways, and encouraging others to do the same? I find it unlikely to pass.

I hope it does. Why are researchers doomed to make their own tools from scratch?

Instead of just Apple though, think of a bigger picture here:

Let's say someone ran a service to help you hack AirBNB. Legal?

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

Let's say someone ran a service which helped you find bugs in anti-cheat software and run those bugs on your PC. Legal?

Etc. It's tough.

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

Microsoft outright encourages this. From https://developer.microsoft.com/en-us/microsoft-edge/tools/v...:

Before installing, please note:

These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later.

Edit: Furthermore:

The Microsoft Software License Terms for the Microsoft Edge and IE VMs are included in the release notes[1] and supersede any conflicting Windows license terms included in the VMs. By downloading and using this software, you agree to these license terms.

[1]: https://az792536.vo.msecnd.net/vms/release_notes_license_ter...

From the license:

NO ACTIVATION. To prevent its unlicensed use, the software contains activation enforcement technology. Because the software is licensed for testing use only, you are not licensed to activate the software for any purpose even if it prompts you to do so.

Not only are you encouraged to use the software without paying for a license for testing purposes, you're outright forbidden from doing so.

Microsoft are allowed to do so in this case because they are the owners of the software - they can license the software they own under any terms they want. In this case though, I'm sure there will be terms that prevent you from offering the VMs as a service to others for a fee.

Microsoft are definitely not 'someone' in the sense OP intended.

I interpreted the analogy very differently.

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

Here, I see "someone" as a security researcher, not someone who is reselling the VMs. The OP may have meant someone spinning them up to resell them to security researchers, but, given the ambiguity, I do think it's important to point out that you can spin up free Windows VMs for research purposes--you are explicitly licensed to do so.

If the analogy is taken literally, then the answer is: yes, it's legal as long as you're not reselling them.

> Microsoft outright encourages this

But MS does not encourage you to sell access to those unlicensed copies. Corellium's business model isn't security research, it's taking illegal copies and "renting" them out to people for money. And people go to them because it's convenient, not because there is no other legal way.

Of course there are key differences; however, the analogy provided by the OP doesn't really fit here.

Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal?

You can, in fact, legally spin up arbitrary Windows VMs for security research without a paid license.

If any comparison is to be made here, it should be between Apple's licensing and Microsoft's licensing:

* Microsoft will allow you to use Windows without paying for research purposes; Apple will not.

* Microsoft will allow you to run Windows on hardware purchased from a third party, or even hardware you've made yourself; Apple will not.

* Microsoft goes out of their way to facilitate research with the help of virtualization technology; Apple goes out of their way to impede it.

As a customer of both companies, Apple's approach here really rubs me the wrong way and definitely contributes to my unwillingness to completely embrace the Apple ecosystem.

To clarify, these are images that you have to download and host yourself. This isn’t a service offered by Microsoft; they’re providing the free license and tools, but you still have to have your own hardware to run the VM.

@zenexer Those expire after 90 days. You are doing it within Microsoft's boundaries. Now imagine circumventing Microsoft's boundaries and the 90 day limitation for convenience.

It explicitly encourages you to circumvent it so you can run it for more than 90 days.

Edit: To be clear, this part:

These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later.

If you set a snapshot and roll back to it later, you get another 90 days. Rinse and repeat.

Using snapshots to roll back and lose 89 days of work/system changes is quite an inconvenience though. Circumventing the need for snapshots/rollbacks is still not ok

Well, the need to take a snapshot--or rather, the activation issue--is described at one point in the license as a "bug". It's a little confusing, but from talking to the maintainer of the VMs on GitHub, it sounds as though they just don't want to dedicate time to "fixing" the activation system. The workaround is to take snapshots. There are actually instructions on the repo for extending the trial without reverting to a snapshot, if I recall correctly, but it's been a while since I've looked into it.

You are completely missing the point with your example and it's in no way similar to what's happening here. Free to use and free to sell are completely different concepts.

Just because someone gave you the right to use for free something that belongs to them doesn't mean you are allowed to sell that right or that "something", or even pass it on for free.

I'm countering the analogy, not the case of Corellium. You're right: the analogy used here misses the point; it's not the same as what Corellium was doing.

The analogy is harmful because it implies that it's unreasonable to expect that like Microsoft and Apple would allow their software to be used for free for research purposes; it doesn't mention resale of the software. I don't see that as an unreasonable expectation; Microsoft does it without issue.

Edit: Just to be clear, Microsoft is not offering these VMs as a service. You are required to download the image and run it yourself. It’s basically just a license to use Windows for free as long as it’s for a specific kind of research.

It's a rolling 90 days...

They're not doomed to make their own tools from scratch. If researchers set up open source tools on how to spin up their own VM on their own system that's an entirely different situation.

Isn't this exactly the same restrictions that IBM imposes on licensees of the z/OS operating system?

You can run z/OS just fine on Hercules (mainframe emulator) but IBM does not allow it, and for this reason no one does it.

Given the potential profit in providing emulated z/OS hardware, the fact that no one provides this is quite telling.

Well no one can make illegal copies of Windows, its the same with iOS.

Lots of folks do it, no one is tries to make money off of it (or at least stops trying after the initial letters from IBM legal arrives).

Hercules is an interesting case because it's widely rumored to be used inside IBM to run modern System Z releases.

In this case however the company in question isn't just making and selling an emulator you can run iOS on, its selling hosted iOS as a service, which is a clear license violation - just making the emulator and instructions for use available for sale would be quite legal.

The Psystar case (or at least, my read of Apple's opinion of that situation), implies that Apple (circa early 2000s) considers making such an emulator available would not legal.

The issue with the Psystar people was they were selling configured systems loaded with software, not a kit the end user would assemble themselves.

On the other hand, the reason Corellium is making a profit here is exactly because Apple's ToS exclude legitimate uses.

Is that not their right as the copyright holder? “Legitimate” != fair use

Sorry, meant to write illegal, not unethical.

Fair use doesn't apply when you're acting for profit and making complete copies. That's like arguing that setting up a book production shop and selling fraudulent copies of the book (for borrowing only) is "fair use".

This is _quite_ unethical.

“For educational purposes only” would be most similar. Still clearly not ethical.

Fair use is relevant here but one of the main tests used by the courts is whether or not the use is commercial - this kind of for-profit redistribution is unlikely to pass muster.

> It most definitely is not unethical. Illegal perhaps, but unethical? Please.

I would argue it IS unethical. When speaking of ethics, the intention matters.

If they were just offering these tools to security researchers at cost or for free, then I could agree, but they aren't. They're intentionally doing something that wasn't allowed to make money.

Unfortunately the service does cost money to run, and it is hard to pay operating costs without some sort of income, so it's hard to fault the service for charging money for a valuable service, especially on HN.

This lawsuit (if it goes to court - many cases do not) would decide whether it is, or is not, "allowed". Still, contracts can contain all sorts of clauses, not all of them will be permitted/enforceable by law. Famously, non-compete agreements aren't enforceable in California but that doesn't stop them from appearing in California employment contracts.

Corellium isn’t making copies of iOS; it uses restore images from Apple’s servers.

That just means they're not running afoul of copyright laws. By setting up the VMs, they're running afoul of the EULA, and Apple has the right to seek legal remedy for their actions.

If Correlium just provides the VM and the researchers download iOS releases directly from apple servers, is it still illegal?

It'd be perfectly legal at that point, as the infringement would be with the end user at that point.

What if they bought a phone for every VM they offer? So let's say they offer 5000 VMs, they buy 5000 equivalent phones. Do you think they will still have a chance?

Probably not. That would be much better legal footing, but still has problems.

The iOS copy isn't running on the actual iPhone, which is a massive violation of the iOS ToS which says that iOS can only run on an Apple-branded device.

There is also legal precedent upholding this in Apple vs Psystar (2007), in which a company claimed "fair use" when selling their own "hackintoshes" and a UEFI product which made building "hackintoshes" easier.

How did Psystar do? They lost. Terribly. And they had a surprisingly robust legal team, making it all the way to the point to appealing to the Supreme Court (the SCOTUS denied the request).

What WOULD WORK is buy 5000 iPhones and doing passthrough. In this setup, you have 5000 iPhones, all running iOS, and the screen is recorded with touch-inputs replicated on the real iPhone. Even if they were jailbroken, the odds of Apple winning would be way, way lower than this case.

Or, well, enter a legal contract with Apple.

I don't know if the Aereo decision would come into play here -- they were declared in default, even though each user would "rent" their own unique antenna.

There's also a bunch of details to that case that may make that decision irrelevant here.

They could reappear in a country that gives no credence.

Doing God's work. Every Apple purchase makes me feel like I'm creating a computer vilian.

But I grew up during the FOSS craze.

Reply on news.ycombinator.com