Hacker News Reader

Comment by cperciva | Hacker News Reader

I agree that TLS bugs aren't unusual. This is one of the reasons I don't trust TLS for anything serious. ;-)

But as I said a few days ago (https://news.ycombinator.com/item?id=7284957) I think this far more likely to be an NSA-exploited bug than an arbitrary-code-execution bug in Flash, because it's something which can be exploited widely and quietly without worrying about accidentally causing new versions of the program to core dump and reveal the presence of the bug.

I hate to say it, but I think you're being insufficiently paranoid.

View on HN

We already know that NSA exploits Flash bugs, and bugs like it, in the large, with impunity. They have an elaborate MITM apparatus to direct people to clientside exploiters. These things we all disclosed in the leaks. Why make new stuff up? I know security people at Apple. I do not believe for a heartbeat that they would cooperate with NSA on a backdoor.

I'm coming around to your take on TLS, for what it's worth, although the only thing I can think of that's worse than TLS are the crypto transports generalist developers come up with.

> I know security people at Apple.

Do you have any information, whether they're using any kind of of code -security- auditing tools?

Could it be that the programmer simply got a backdoor request, which s/he in protest implemented this way to ensure to be caught.

> I know security people at Apple. I do not believe for a heartbeat that they would cooperate with NSA on a backdoor.

In other words, you're not being objective. You already attribute good character to the people you know at Apple, and are therefore are looking for ways to defend them against an accusation that hasn't even been made. The fact that you unnecessarily called Schneiers current occupation as 'sad', imo, tends to support this rationalisation.

None of the issues with Flash or certificate verification bugs you bring up are relevant to the discussion Schneier is having about this being the perfect kind of backdoor, and that, if it were a backdoor, it would have been hugely successful over the last year or more.

Are we perhaps operating from different definitions of the word "backdoor"? If so, I think mine's correct: a backdoor is a security vulnerability deliberately introduced into a codebase.

I have no doubt at all that if NSA knew about this bug, they were exploiting it. That's what they do. It is not my argument that this bug is irrelevant to NSA.

If you assume that the only way that the NSA could get a bug into apple products is by making a call to Apple execs and asking them to do it. What do you think of the possibility of them approaching someone who already codes at Apple, possibly someone who they've had previous contact with, or have leverage against that would guarantee that they won't go public about an (unsuccessful) approach from the NSA, and employing them to find places to insert deniable vulnerabilities into Apple products?

It's unlikely that Apple would agree to sabotage their own products in a way that will eventually be detected and affect their own credibility. That's restricting the argument that people are making to a straw man, though. Have spies ever worked that way? What people are mostly speculating about is whether this was an intentionally introduced vulnerability, not the mechanism by which that would come about.

"The fact that you unnecessarily called Schneiers current occupation as 'sad', imo, tends to support this rationalisation."

Let me give you the perspective of someone who is outside the security business but knows a good deal about PR and the media and how it operates. And selling books (one that I was doing was mentioned on the front page of the WSJ - all from PR that I organized on my own).

Schneier has certainly transformed himself and it's all about his image and selling books with his new found fame. I know it when I see it. Because as he just said in a way "it's what I would do if I wanted to..."

So in other words he has an axe to grind in getting mentioned in the media. Period. That doesn't mean what he is saying isn't correct in some fashion of course. But it does give credence to the statement "Another sad indicator of the level Schneier is playing at today". That level is publicity for Schneier. So to repeat myself, exactly what I'd be doing if I was him.

> I know security people at Apple. I do not believe for a heartbeat that they would cooperate with NSA on a backdoor

So you're absolutely sure that there is no developer (in the position) at Apple that would take a discrete paper bag of $$$ to make just a tiny error by hitting ctrl-v twice?

It's cmd-v on a Mac, I'm afraid ;)

For one thing, it's hard to imagine an amount of money that would be simultaneously large enough to entice an Apple engineer to risk his job and reputation, but small enough to not trigger questions about where it came from. You'd have to concoct elaborate schemes that convince the IRS to look the other way, or target someone who could be blackmailed without fear that they'll run immediately to the authorities or their boss. Not anywhere near as easy or safe as handing over a bag of cash.

If I were the NSA, a strategy with much lower variance would be to hire a lot of smart folks to do the intense security reviews and testing that Apple (and many other companies, presumably) fail to do, and try to find bugs before they're patched. As tptacek has pointed out, there are plenty of these, and an organization with the resources of the NSA can probably find them frequently enough for most purposes without sticking its neck out.

>it's hard to imagine an amount of money that would be simultaneously large enough to entice an Apple engineer to risk his job and reputation

The odds are that this engineer will never be revealed publicly, and it will not effect his/her reputation in any way.

>but small enough to not trigger questions about where it came from.

You don't think that the NSA has the ability to hide money?

Surely this hypothetical bribed engineer will be identified during Apple's post-mortem. Hopefully he's a good liar, otherwise the NSA risks exposure that way. Even if he's a terrific liar, of course his reputation will be hurt: His 'mistake' caused Apple a major PR hit and engineering scramble that likely cost millions of dollars.

And for what? The NSA can hide money, but you or I would quickly find ourselves talking with the IRS if our spending or bank accounts rose dramatically without a commensurate rise in reported income. We could probably hide a few thousand dollars a month under the table, but that doesn't sound like it would turn the head of even a particularly amoral Apple engineer already making six figures.

I'm not saying this scenario is impossible. But to be plausible, it requires both the perpetrator and the NSA to take on a degree of risk that doesn't seem to match the reward for either.

If this is standard procedure for the NSA and happens often, given the risk involved, why hasn't anyone been caught at it and publicly exposed?

If the NSA made an exception and executed some unusually elaborate cloak and dagger to seduce or blackmail an Apple employee for this change, why do we think it was for this vulnerability and not the dozens of others that are discovered annually?

Since we're at a nosebleed altitude of hypothetical here, I think now might be the time to point out that this thread is demanding that people prove a negative.

> If I were the NSA, a strategy with much lower variance would be to hire a lot of smart folks to do the intense security reviews and testing that Apple (and many other companies, presumably) fail to do, and try to find bugs before they're patched.

Very very good point.

Until you made it, I might have thought "well of course NSA looks for bugs to exploit", but I didn't think through the implications.

Here we have Apple open sourcing their security code. They made the NSA's job 10x easier than w/o the source. So of course the NSA will lint and review and test and exploit Apple's source code. Intensively. It's low-hanging fruit, of the Apple variety. :)

I know security people at Apple. I do not believe for a heartbeat that they would cooperate with NSA on a backdoor.

I agree with you based on the security people I know at Apple. However, I would be surprised if Apple's security people have enough time to carefully audit every line of security-relevant code which other people at Apple touch.

Reply on news.ycombinator.com