Apple’s Best Defence Against The FBI Is The One It Can’t Admit

With Apple vowing to resist all the way to the Supreme Court the FBI’s demands for an iPhone backdoor in the San Bernardino case, many people assume the company is motivated purely by principles and concern for their customers.

No doubt these are key reasons for Apple’s stand, and many have expressed  great admiration for CEO Tim Cook’s leadership on this matter.

At the same time, it’s important to recognize another motivation at play. It’s one that Apple and the other tech giants supporting Cook against the FBI all share but, for understandable reasons, cannot discuss in public. Unfortunately, their silence on this topic only contributes to public confusion around what’s at stake now.

To put it briefly and bluntly: The iPhone is already vulnerable to hackers around the world. So are Android-based devices and other smart-device platforms. In fact, the US government is late to a party long dominated by black hat hackers working for themselves or even more nefarious parties. The FBI’s order has only brought this sensitive issue to a head.

Here’s why:
The iPhone already has backdoors Apple hasn’t yet closed. I’m aware of at least one instance where black hat hackers have been able to extract data from an iPhone with a recent OS by directly accessing it through critical flaws that enable a backdoor into, and data extraction from, a designated device.

I cannot publicly share specific details beyond this, other than to say, that this breach, was uncovered by a member of the hacker community. I’m also unable to confirm whether the hacking method would work on the latest iOS operating system.

However, as suggested by the recent New York case, in which Apple was able to access data on a device running an older OS, dedicated hackers are bound to find workarounds to backdoor the latest version, too.

And this is just one potential backdoor among many. Indeed, there’s a veritable underground market for 0 day iPhone vulnerabilities found by hackers and put on sale to the highest bidder — or secretly kept in reserve, to use as a potential cyber weapon against Apple down the road.
With these, hackers can, for instance, quietly connect and extract data from a user’s device without their knowledge, control it remotely or even spy on their daily activities.

Apple has said that creating a backdoor for the FBI would put iPhone owners on a slippery slope of security intrusions. It is more accurate to say that the iPhone has been careening down that slope for quite some time.

Which brings up to a related point:
The U.S. government lost the backdoor race long ago. It is ironic that many in the tech community decry the FBI’s court-ordered request for an Apple-produced backdoor, because it’s the only government body to make this request to the company through official channels.

Meanwhile, many foreign governments have long been secretly working with black hat hackers to create unauthorized backdoors into the iPhone, usually without Apple’s knowledge or control, seeking the ability to access documents of officials from rival governments. (Senator Bernie Sanders may not care about Secretary Clinton’s damn emails, but I can assure him that many people in the black hat underground surely do.)

This raises another irony: With so many trying so hard to access the iPhone already, an FBI-ordered backdoor will only assist their efforts. Once created, black hats will surely increase their attacks on the FBI and Apple, hoping to ferret out clues to this entrance route. It is almost certain they will eventually succeed.

Given all of this, it’s much easier to understand why Apple is fighting with such tenacity to prevent the iPhone’s security from becoming even weaker.

A system is only as secure as its most vulnerable link, and becomes geometrically less secure with each additional vulnerability. Devices and software associated with Google, Facebook and Microsoft are just as vulnerable as the iPhone (if not more so), which I believe partly motivates the amicus briefs they have filed on behalf of Apple.

A majority of Americans understandably assume the U.S. government’s demand for a backdoor is a reasonable request to make us safer from terrorist attacks. If they understood how profoundly insecure and under threat all their devices already are, I believe their thinking on the topic would instantly change.

It is a final irony that the FBI has inadvertently exposed the U.S. tech industry’s Achilles’ heel — and threatens to make our devices even more vulnerable to those who wish to do us harm.
TechCrunch: http://tcrn.ch/1LWySgo

« UK Bosses - Heads In The Sand Over Cybercrime
China Cracks Down On Top Hong Kong Newspaper »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Feitian Technologies

Feitian Technologies

Feitian Technologies provides authentication and transaction security products for financial institutions, telecoms, government and leading business enterprises.

Hack Miami

Hack Miami

HackMiami is the premier resource in South Florida for highly skilled hackers that specialize in vulnerability analysis, penetration testing, digital forensics, and all manner of IT security.

CLUSIL

CLUSIL

CLUSIL is an association for the information security industry in Luxembourg.

Norwegian Center for Information Security (NorSIS)

Norwegian Center for Information Security (NorSIS)

NorSIS) is an independent organization that works to increase knowledge and understanding of information security for businesses and individuals.

AdaptiveMobile Security

AdaptiveMobile Security

AdaptiveMobile Security, a world leader in mobile network security, protecting more than 2.2 billion subscribers worldwide.

Cylus

Cylus

Cylus, a global leader in rail cybersecurity, helps rail and metro companies avoid safety incidents and service disruptions caused by cyber-attacks.

WiJungle

WiJungle

WiJungle is an Indian Cyber Security Company that develops and markets a unified network security gateway solution.

SevenShift

SevenShift

SevenShift is a security consulting firm with a wealth of experience in the worlds of Cybersecurity and Internet of Things (IoT).

WWPass

WWPass

WWPass is a global cybersecurity company that provides password-less authentication and client-side encryption technology.

Basque Digital Innovation Hub (BDIH)

Basque Digital Innovation Hub (BDIH)

The aim of the BDIH initiative is to provide industrial enterprises, especially SMEs, with the technological capabilities needed to meet the challenges of industry 4.0.

Rostelecom Solar

Rostelecom Solar

Rostelecom-Solar is a Cyber Security Company, providing software and managed detection and response (MDR) services to protect critical information from advanced cyber threats.

Resolvo Systems

Resolvo Systems

Resolvo is provides comprehensive security assessment and testing services in Asia.

Sec-Ops

Sec-Ops

Sec-Ops is a forward thinking cyber security company, formed by a group of security enthusiasts with years of experience and backgrounds in the technology and the government industries.

Netgo

Netgo

Netgo group meet the requirements of a complex, digitized world with IT consulting, IT solutions & services, managed & cloud services and software products & development.

CV-Library

CV-Library

Start your job search with 216,931 live UK vacancies on award-winning CV-Library. Register your CV and find local jobs near you today!

Semgrep

Semgrep

Semgrep is a fast, open-source, static analysis tool for profoundly improving software security and reliability.