Regardless, I can say for a fact that there are exploits for all cell phone platforms. iOS exploits are by far the hardest to find. An iOS remote execution 0day will easily fetch $250k. I've seen one go for $600k. For an Android remote exec 0day, you're looking at closer to $50k.
Even if the NSA doesn't have these on hand, they can certainly purchase them.
Wake the fuck up! This isn't about Apple. It's about an out of control military that's spying on all of us and threatening our way of life and our livelihoods.
http://support.apple.com/kb/ht5949
:-P
Because more often than not, the answer is "Because it draws clicks". Since that isn't the case here, the next step is typically "Is this unique or specific to Apple, and does the issue at hand pertain to other devices or OSes?" In OPs opinion, it isn't. His evidence is the high cost of zero day exploits relative to other platforms.
He's not "defending Apple by saying their competitors are worse", he's providing context to an article that provides none itself. If negative articles about Apple weren't such rabid click bait, this wouldn't be needed as it would be part of the reporting process. Unfortunately, that isn't the case.
"Wake the fuck up!" is an extremely patronizing sentiment. I can be both aware of the overall NSA situation while simultaneously defending Apple from knee-jerk reactionaries. They aren't mutually exclusive activities.
2. This is a linkbaity article that needs to be corrected. This correction may be an important factor in determining which devices are more secure.
3. Yes, the NSA spying fiasco is the bigger topic here. No, it's not a competition.
It has been Apple's strategy all along to get you to buy literally everything from them. Their USP was to have it all integrated.
Problem is: Once you understand that at least 1 peace of your integrated platform is foul, your whole equipment "looses value" for you, because it's now less integrated.
It's a similar strategy to how banks have been protecting themselves: Be/remain "too big to fail", meaning: Become so big that, when your bottom line is under attack (by whatever market forces), the whole society suffers. Thus, society will protect you, no matter how you behave.
Without revealing the actual site/method/whatever; can you please explain how the 0day exploit market works?
I can make basic assumptions that it is deep-web-forums/TOR/Whatever... but can you enlighten me as to how one might go about selling/buying such an exploit?
There are lone ranger types and small groups that churn out a few exploits. These guys (the small groups) go through trusted middlemen (usually via encrypted email), who buy the exploits at a discount. Now the middleman has a collection of 0days that he can sell to established customers, which might be government or criminal organizations. Sometimes the organizations want exclusive rights to an 0day (to prevent it getting leaked and patched), sometimes they don't.
On the other, less sketchy, side of things, there are companies that do more or less the same thing. They do the same kind of vulnerability research, but a lot of the time it's on behalf of the company whose product they're trying to hack, or possibly a government organization. They don't usually go through middlemen; they just work directly with the government or company. They can't and don't do anything obviously illegal, which limits the amount of stuff they can make, but obviously sticking to legal activities has its benefits. Sometimes legality is a little fuzzy, but these groups try to tread lightly.
You'll get introduced to someone who has a small security firm and from their LinkedIn page you can see they have a pretty vague but interesting past. Ask for a shit ton of money.
Did the guy spend 8 years at a british aerospace company before going into consulting? GCHQ. 5 years at the "Department of Defense"? NSA. High school drop out? Chinese or Russians.
Idea: 0day markets are legalised [1]. Regulators require companies keep the average price of their 0days above a threshold or attach a warning to their product and marketing materials. This aligns the security interests of consumers with companies while incentivising companies and researchers to build secure products.
[1] A license to the 0day (but not the 0day itself) would be freely traded for a duration after which the company would have the option to (a) buy it at some price or (b) release it to the public, retaining full liability for any consequences (last holder of the license gets a percentage cut of any fines or legal awards).
I'm quite interested to see what, if anything, Tim Cook will do or say to reassure the faithful.
"Apple is erasing discussions on this topic at their support forum, right now the whole forum is shut down for a complete cleanup."
http://forums.appleinsider.com/t/161398/nsa-worked-on-iphone...
Unfortunately, no matter how much you sure up your phone's OS, there is still a massive, gaping hole in the form of the baseband processor. Until we have phones where the baseband is a tightly regulated slave processor, accessible only through a low-privelege mechanism (like a USB port), we can't really hope to have truly secure phones anyway.
The people cranking out high volumes of exploits for the customer are sitting on huge multi-year contracts worth tens if not hundreds of millions of dollars. They don't want to go play in some utopian regulated marketplace, they just want to make money and protect America.
According to this the NSA itself claims that it has access to all iOS devices:
https://www.youtube.com/watch?v=b0w36GAyZIA&t=44m32s (Jacob Applebaum @ 30c3, "To Protect And Infect, Part 2")
Harder to find than for Windows Phone?
Given the 100% success they get with the iPhone, my guess is that they hijacked one of Apple's remote control mechanisms, e.g. we do know that Apple has the ability to uninstall apps from any iPhone, perhaps there's a way to install too.