Hacker News Reader

Comment by kornhole | Hacker News Reader

Who had motive to target Russian government officials, knowledge of the attack vectors, history of doing so, and technical and logistical ability to perform it leads Kaspersky and myself to the only rational conclusion: that Apple cooperated with the NSA on this exploit. I assume they only use and potentially burn these valuable methods in rare and perhaps desperate instances. I expect the Russian and Chinese governments' ban on use of Iphones will not be lifted and expand to other governments. Similarly to how the sanctions have backfired, this tactic will also backfire by reducing trust in Apple which is the core of their value proposition.

View on HN

This looks like a typical modern security hole. There’s a giant stack of layers of unnecessary complexity, and all of them are garbage. The composition is also garbage.

All the NSA needs to launch attacks like this is to get a bunch of mediocre engineers to layer complexity atop complexity. They don’t need Apple to know about the attack.

Honestly, they probably didn’t actually have to do anything to get Apple (or any other large company) to self-pwn itself by hiring and promoting engineers and project managers for adding features, but not for improving product stability or software correctness, or deleting forgotten legacy cruft.

Anyway, the most effective approach to sabotage is to be indistinguishable from incompetence, so it’s hard to say if the people responsible for the vulnerability chain were working with the NSA or not.

You make a good point that a team of mediocre engineers could be responsible for the vulnerabilities. Those doing code review and change control would also need to be mediocre. It could be a combination of compromised and mediocre coordinated by a manager who is in service of the apparatus. Knowledge of the operation would better not go all the way up the ranks to keep it quiet.

leads Kaspersky and myself to the only rational conclusion: that Apple cooperated with the NSA on this exploit.

Kapersky reaches no such conclusion. That's from an FSB release.

It is true that Kaspersky by policy does not make attribution without concrete proof. It is the responsibility of intelligence agencies to make the call based on preponderance of evidence. The video linked above leads suspicion to a very few options. The attacker left a list of Apple ID's in the code in one place to check against. Kaspersky provided them to Apple, and Apple did not respond with any details about the users of those Apple ID's. One of the main vulnerabilities has been available for over ten years.

What is more true is that the article posted explicitly says the exact opposite of what you suggested upthread - a fact you should acknowledge.

> leads Kaspersky [..] to the [..] rational conclusion: that Apple cooperated with the NSA on this exploit

doesn't the article states precisely otherwise? that while the FSB accuses Apple of cooperation, Kaspersky does not have any reason to believe so, especially since it does not look like any known state actor.

Kaspersky only said they could not prove it. They did not make conclusion but laid out the evidence.

Kaspersky can't prove anything so they opted to present the facts. They didn't state any opinion about who they believe is behind the incident.

How did sanctions backfire?

Germany's economy shrunk last year while Russia's grew. Dedollarization has accelerated which will impact the US not immediately but in near future.

the dollar as the reserve currency already has a serious impact on the US (ie. the big upside is that it allows the US to borrow for very cheap, but the nasty downside is keeping the purchasing power of the USD artificially high, which is not great for the non-finance sectors of the US, not great for people who work in those sectors, and double-plus-not-great for US exports [which are not the dollar itself]), basically it's the "natural resource curse" again

that said, dedollarization is unlikely even in the mid-term https://www.noahpinion.blog/p/threats-to-the-dollar-are-just...

A weak dollar is good if you own a company that relies on exports. For the rest of us who are paid in dollars and need to buy imports, a weaker dollar hurts.

That is one opinion. We can already see China and Japan selling off their US bonds and the BRICS countries are working on solutions to get off the dollar with high priority.

> A weak dollar is good if you own a company that relies on exports.

It depends on your exports. If your exports have cheaper alternatives, then a weak dollar is good.

If your exports are high utility and have no cheaper alternative, then a strong dollar is better.

Have you read the article? :)

Maybe this one will be more interesting https://www.noahpinion.blog/p/brics-is-fake

They were long reads, but thank you. They generally cover history and speculation on BRICS, but we will need to see how it works out. I have seen their meetings and open statements about intent to diversify away from the dollar for trade as a high priority. The articles don't really explain what happens if/when they do figure out international payment systems that avoid dollars. Think of this: You have a trillion dollars you printed floating around the planet. It didn't cost you much to print them, but you did get goods and services for them. If that trillion is halved to $500B, what happens?

Okay, so it's an especially hard topic, because the soundbites seem simple and dangerous (dedollarization, end of the dollar hegemony, BRICS will move off the dollar, the first signs of the beginning of the inevitable and long predicted extremely overdue fall of the West, etc.), but the prosaic technicality-dense details are simply long and turn out to be extremely anticlimatic.

Payment systems are already here that avoid the dollar. (From the extremely simple blockchainish digital-synthetic currencies like Ripple XRP to the classic SWIFT-like China's CIPS[1].) And these are already in use. After Russia got thrown out of SWIFT they are now basically using CIPS. (Of course they also have their own version, SPFS. "Coincidentally" its development started in 2014.)

However, on the CIPS wikipedia page you can notice that the important things needed for the actual settlement is a boring list of stuff about each member institution (account numbers, settlement procedure description, credit rating). And each member institution has its own rules about what transfers to accept. And of course in hard times trust is in low-supply, transfers start to get manually reviewed, tolerances start to decrease, everyone starts to hoard good money, thus only bad money remains.

All in all, the important thing is that there's no magic system that can handle payments without the usual institutional-societal framework. (Well, of course there are blockchainish things. For example Visa is doing something on Solana. And Solana is pretty fast and cheap. And a horror show to develop smart contracts on, but that's not really relevant now, and not important for Visa or Russia/China/banks, because they don't care much about the ethos of decentralization, they just want to have something quasi-trustless, fast, and cheap.)

> If that trillion is halved to $500B, what happens?

It depends, but, well ... nothing really. Most of money is already at rest. It represents exactly that stuff you got for it. It represents all the wealth created. It was printed to keep inflation around 1-2%. If it disappears in some computer system people will start to scratch their heads, but the ratios will remain mostly the same, so purchasing power and wages/salaries will not change.

That said if some bank decides to flood the market with cheap US Treasury bonds nothing happens. That's already in USD, the bank loses on the transaction a lot. And a lot of these reserves are in bonds.

Okay, what happens if that bank asks for the cheap bonds not USD, but let's say rubels? Okay, they will end up with a shitton of rubels. The exchange rate shifted, but nothing actually happened, sure the ratio of flow of goods and services will adjust as the overpriced rubels will be exchanged for a bit more goods and services than without this huge transaction. But what does this lead to? More exports from the typical exporters. It's not particularly good for anything that's hard to scale up, it will just result in price inflation. And then eventually the exchange rate will go back to reflect the actual flow of goods and services.

[1] https://en.wikipedia.org/wiki/Cross-Border_Interbank_Payment...

Thank you for the thought out explanation to a complex topic important for us to understand.

You recognize impact to exchange rates when one currency is in more demand than another. If this causes an increase in exports sold in the devalued currency, rates could eventually stabilize, but that depends on many things. Those exports could be gold in our treasury, US land, and factories. Those assets that are fixed in place are only valuable to a foreigner if they can be assured they will not be confiscated.

I know this is simplistic, but let's walk through this flow. I print up a $100 bill and give it to China for a washing machine. China will take it because they need it to buy a barrel of oil from Saudi Arabia. That $100 floats around in the world perhaps never returning as long as others accept and use it. If Saudis start accepting Yuan in payment for oil, China does not need that $100 bill as much. They start reducing their dollar reserves and US bonds. They use those dollars to buy the gold, US land, and factories. The US then has a lot of dollars but not as many assets. The dollars become less valuable because we have so many of them but not as much demand for them. If they are afraid of US sanctions, China will be less inclined to buy assets that could be seized and so the currency is less useful to them.

Admittedly there are many other factors. We will need to see how it plays out.

So let's do it realistically. You take out a loan for 100 USD, it gets printed by some bank, let's say Chase. You buy a washing machine from China, they put it in their central bank. (And they don't but bonds, let's assume.)

What if they want to buy oil, which happens to be sold by the Saudis, who want 100 USD for it. They can do it, or they can print more yuan, and use that to buy more USD on some exchange. (And they did it a lot, to keep the yuan artificially low. That's basically half of how they ended up with this huge reserve.)

And since their inflation was around 2 percent since 2010, and currently even negative unfortunately, they can print a lot.

And this is how economic development and exchange rates connect. One man's trade deficit is another's reserve basically. As long as there's some slack in economies (mostly some unemployment metric is used as a proxy for this) it makes sense to spend. (Otherwise it'll just push up prices more, ie. lead to inflation. Hence the very technical sounding name of NAIRU, Non-Accelerating Inflation Rate of Unemployment, I think hands down the worst name for any concept over many fields.)

If China starts using its reserves to buy US assets, that leads to a lot of USD getting back into the US economy, it's like a stimulus. It would push up prices of course, the Fed would increase interest rates, maybe it would even start fiddling with some other knobs (it could increase the fractional reserve ratio, it could increase interest paid on reserves, or interest paid on excess reserves).

> If they are afraid of US sanctions, China will be less inclined to buy assets that could be seized and so the currency is less useful to them.

Yes, and one read of the belt and road initiative is basically this, instead of giving it to citizens to spend, they tried to use it for geopolitical/colonialist/mercantilist projects.

All in all, my understanding is that using their huge reserve to cause some crisis would be a zero-trick pony (because after 2008 and the recent bank crisis, and the Russian sanctions implementations the West seems capable of handling speedbumps), and a slow decoupling would be good anyway. (As it would help the non-finance sectors of the US.)

You are talking about an unsustainable war economy that is overheating. Soaring inflation, brain drain and a falling ruble are only just the short term phenomena.

--> https://www.reuters.com/breakingviews/russian-war-economy-is...

If you would truly believe what you say, you should convert all your savings from dollar to rubles. No serious economist would think that doing so would be a masterstroke though.

To be fair, other European countries are doing better. It's a Problem specific to Germany and their mishandling of the energy shock.

That’s only “rational” for kaspersky bc in their world they can’t function without having actual intelligence operatives on staff. I seriously doubt nsa needed help here

My adjacent conspiracy theory is that the NSA and other state agencies do both original research and pay hackers for exploits that Apple hasn’t yet discovered.

but why pay hackers to try to find a backdoor when you can just walk in the front door and use the carrot and stick to get what you want?

Here's my serious answer that still works if you hate Apple.

Your question assumes two things: (1) That Apple intentionally leaves vulnerabilities in the stack, and (2) that Tim Apple is occasionally willing to share this candy with governments.

Having worked at Apple, I don't believe (1) can be true. Not only is it extremely unlikely that it could be kept a secret, but Apple's thing is "obsessive control", a mindset borne of organizational PTSD which originated with its near-death experience in the mid-to-late 90s. The Apple I know would not risk intentionally leaving back doors unlocked for enemies to find and leverage.

As for (2), the existence of a "Binder of Vulns" by nation-states would expose Apple to existential risk. It's possible that it could be kept secret within Apple's walls if it were never used, but once shared with a government it could not be contained. The splash damage of such a discovery could easily kill Apple.

We already know Apple has participated to the PRISM program, it's not speculation anymore.

I am assuming or knowing that the national security apparatus can both coerce and incentivize companies and individuals to give it what it wants. Their power is great and relatively unchecked to do both. Coercion tactics include releasing compromising information on a company, person or family member and more directly injuring person or company. Incentives include favorable regulation, taxation, and deals with other companies they control.

Knowledge of a binder of vulnerabilities is perhaps one of the greatest secrets that must be protected. Wikileaks releasing the Vault 7 leak was the death knell of Julian Assange. It proved such a binder exists in great detail.

I don't hate Apple, but assuming they can't be reached, seems naïve.

This happened at a company I worked at so it’s not out of the question. I figured it out by reverse engineering and quit on the spot. They tried to tell me I’d never work again if spying on users was a dealbreaker. They showed me a natsec slide deck that identified other collaborating companies as a way of making their point. Among them was Apple.

You are telling me that natsec people give every rando the full list of participants in the conspiracy? That just doesn't make sense for any (semi)competent security agency to disclose.

I would say all the info was already known, for example Apple’s participation in PRISM.

They have the budget to do both easily.

Like how the NRO used to design and launch satellites that cost more than aircraft carriers but are now working closely with private companies like Maxar to find more economical solutions.

https://www.maxar.com/press-releases/nro-awards-maxar-a-10-y...

Thing is the fundamental laws of physics give us a good idea as to the capabilities of the NRO given a certain launch platform. Like how when scientists in the late 70s were figuring out the best telescope they could launch they ended up with almost the exact specs of the Keyhole spy satellites, a spare of which became Hubble.

The Darknet Diaries episode "Zero Day Brokers" goes into this. Apparently Argentina hosts a lot of outsourced exploit development. Here's the transcript: https://darknetdiaries.com/transcript/98/

Reply on news.ycombinator.com