Hacker News Reader

> "Obviously with iOS devices having ports closed and being behind NAT, the NSA can't exploit them remotely."

This is a pretty limited view of remote exploits. It could easily be a browser-based exploit for example, with the payload as part of an image served by an ad, thus not requiring any open ports.

I cannot imagine the NSA waited for iCloud to get access to iPhones.

Back on iOS 2 (or 1 or 3 maybe), there was a browser-based jailbreak that exploited a flaw in the iOS PDF viewer, so there's definitely precedent for such a thing.

http://www.jailbreakme.com/#

Enterprise profiles offer complete control over an iPhone in iOS7, including bypassing password, installing apps and so on. In theory one needs to install a profile by hand, but I don't see why it wouldn't be possible to do it remotely with the right vulnerabilities. Some devices can come from the factory with an ID that auto-enrolls them with an EDM profile, including after OS reinstalls. I don't remember if Apple can push profiles, but I think it can.

More info on Zdziarski's blog.

Anyway, all devices with centralized managment like Android, iPhone, Blackberry can't be secured IMHO against such a capable adversary. When an actor can push stuff to the device it's hopeless.

Yes, definitely. This is what I was trying to get at - the idea that they still need exploits as other comments are talking about is incredibly unlikely. With things like iCloud, centralized device management, remotely installable admin certificates, google play services, etc. it is very unlikely that the NSA is even considering using any kind of exploit anymore.

When the NSA wants to use your phone, you don't have to worry about them exploiting something. A special packet will come down using one of the many available 'official backdoors' on your device to redirect your device to an NSA server.

This is FUD. Do you have any evidence that iOS allows any Apple server to get some kind of full control without asking permission and without using an exploit? I suppose that if you are restoring from an iCloud backup and Apple has been convinced to allow the NSA to modify that backup, some kind of MDM stuff could be enabled, but this is limited and detectable. Otherwise, it may be possible, but you have not provided any evidence.

" iCloud allows Apple to install and run code directly on your device remotely."

I dont understand this? so far as I am aware, apple has always been able to install and run code directly on your device remotely.

what am I missing?

That they let spies run arbitrary code on your phone too.

We don't know that, we also don't know whether Google or Microsoft or any of the other phone or phone OS vendors 'let' the NSA do any of this. Even if the NSA had inside help, it may have been via individual Apple (Google, MS, etc) employees without Apple's knowledge, or ex-Apple engineers contracted by the NSA. In fact the later would be a much more useful approach for the NSA since it would minimize the number of people who knew it was going on and could therefore leak about it or interfere with the capability.

Features - iCloud is just an extension of the stuff that was on iOS already. Previously you had preinstalled apps as part of the rom that could run in the background etc, and you had apps that you could download that ran sandboxed and had to have an icon, etc. iCloud allows direct access to the filesystem remotely. iCloud also now has routing support to assign you to different Apple servers, etc. All of these features would make it trivial for the NSA to put their own special server in at the iCloud data centers and redirect specific people onto it without them knowing.

So while it would have been theoretically possible for the NSA to do it before iCloud, iCloud makes it actually practical to do it without subverting the whole iOS team.

I am sorry, I dont think that makes much sense.

Apple has had remote access to the file system forever - an early use of it was to remove apps that had certain kinds of legal issues from the phones of those who had purchased it.

iCloud is simply remote file storage, and not all applications use it anyway - if the NSA wants access to my phone, achieving access to my iCloud account is a pretty poor second best.

Providing an XML feed that lists banned apps does not equate to remote file system access.

>> "A remote installation capability will be pursued for a future release"

> Here is the interesting bit. You don't put this in a document unless you have a good plan on how to do it.

Well, you also put that sort of statement in a document because a manager you're presenting to asked you about it and you need to acknowledge it, but you don't have any plans to actually do it. Any questions about it can be answered with relatively vague platitudes and "conceptual architectures", and then the feature is left to quietly fade away in subsequent iterations of the backlog.