Apple loses copyright battle against security startup Corellium
washingtonpost.com
washingtonpost.com
> [Corellium] gave its customers the ability to run “virtual” iPhones on desktop computers. Corellium’s software makes it unnecessary to use physical iPhones that contain specialized software to poke and prod iOS, Apple’s mobile operating system.
Neat.
> [Judge] ruled that Corellium’s creation of virtual iPhones was not a copyright violation [...] because it was designed to help improve the security for all iPhone users.
Right on.
https://support.corellium.com/features/network-monitor#how-i...
"To defeat certificate pinning, Corellium patches sslsplit, the system's boringssl library, and the integrated WebView's boringssl library ..."
That can be bonkers useful...!
Mitm your own traffic is a right. It's my traffic, not yours.
Certificate pinning makes declaring an incident where you’ve had your private key stolen effectively impossible.
Which means you’re going to end up sacrificing user security when it inevitably ends up in that situation.
Is this an issue? If the certificate you pinned corresponds to a key on a HSM, what are the chances it's going to get stolen?
But omgosh the Conways law implications of securing your nuclear waste, oops, i mean your hsm, are incredibly complex & long lived challenges. The odds of any given company accidentally messing up some month or another are quite high. If you have certificate pinning, you literally cannot escape your own mistakes. The ability to respond to mistakes should probably be taken as a necessary for most security footings of most organizations, and the whole point of certificate pinning is that response is impossible, that a cert is pinned in.
(captured 7 Aug 2021 23:58) FTA:
The judge in the case ruled that Corellium’s creation of virtual iPhones was not a copyright violation, in part because it was designed to help improve the security for all iPhone users. Corellium wasn’t creating a competing product for consumers. Rather, it was a research tool for a comparatively small number of customers.
Judge Rodney Smith called Apple’s argument on those claims “Puzzling, if not disingenuous.” Smith found that Corellium used a vetting process before selling its products to customers.
> The district court granted summary judgment for Corellium on Apple’s three copyright claims [...] (2) direct infringement of Apple’s icons and wallpapers
> For example, CORSEC (Apple says) competes with Apple’s (1) iOS Simulator, which “allows developers to work on a virtual iOS device”; (2) Security Research Device Program, which gives “customized iPhone[s] loaded with iOS to legitimate security researchers”; and (3) Xcode Cloud, a forthcoming program that will enable researchers “to remotely access iOS.”
> Apple claims that our case is like Fox News Network, LLC v. TVEyes, Inc. In Fox News, TVEyes, a media company, “redistribute[d] Fox’s news programming in ten-minute clips, which . . . likely provide[d] TVEyes’s users with all of the Fox programming that they [would] seek"
> Apple argues that CORSEC “customers care only about the function and ideas of the portions of iOS they are analyzing—not its many creative elements.”