In a presentation in Kuala Lumpur, Malaysia, Quarckslab, a research company that specializes in addressing security problems, takes on Apple’s assertion that it’s iMessage technology can be trusted not to give up its secrets.
The NSA PRISM mass surveillance program was famously leaked by Edward Snowden.
After the information on the NSA far reaching activities and collaboration with Silicon Valley companies exploded in the press, Apple was quoted as publicly saying:
Two weeks ago, when technology companies were accused of indiscriminately sharing customer data with government agencies, Apple issued a clear response:We first heard of the government’s “Prism” program when news organizations asked us about it on June 6. We do not provide any government agency with direct access to our servers, and any government agency requesting customer content must get a court order.
Specifically, Apple had this to say about its consumer messaging services:
Apple has always placed a priority on protecting our customers’ personal data, and we don’t collect or maintain a mountain of personal details about our customers in the first place. There are certain categories of information which we do not provide to law enforcement or any other group because we choose not to retain it.
For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data.
Edward Snowden is claimed to have been an user of iMessage to keep his missives out of NSA hands. Even the DEA has been quoted as saying iMessage encryption is too tough. The very documents that Snowden leaked also show that Apple was part of the PRISM program in 2012.
The gist of the assertion by the researchers is that Apple provides no transparency on its public key cryptography of messages and so, no one can be entirely sure that their iMessages are not being sent to a third party. Putting aside the notion that your iMessage is going to end up at the NSA, it also makes iMessage services susceptible to Man In the Middle (MITM) attacks.
In essence, if someone where to gain control of your device, something that can be done without you knowing about it, they can then sit between you and Apple’s messaging servers, and intercept, change, or otherwise, manipulate your iMessages.
Were Apple to be more transparent, to allow application developers to work with Apple’s authentication and cryptography servers, they could ensure that messages sent from their devices were actually secure from MITM attacks or snooping. By keeping control over authentication and saying, Trust Us, Apple is leaving its iMessage service vulnerable.
The full presentation can be found on Quarkslab’s blog here.
This is a live demo of the iMessage hack from the researchers too:
One of the other things that comes out of the Quarkelab researchers’ findings is that your Apple ID is highly exposed. Apple ID is the gatekeeper to almost all of your Apple services and products, in much the same was as Google is using your Gmail account as the gatekeeper to Android services. Increasingly, we are all passing through the opaque servers of giant companies and hoping that they can keep us safe.
The hackers are saying the more you try to control things, the less control we will have when violations occur.
