Forgot your password?
typodupeerror
Australia Communications Government Iphone Security The Military Apple

Aussie Security Forces Testing Apple's iOS 58

Posted by samzenpus
from the an-ipad-in-every-pouch dept.
lukehopewell1 writes "Australia's Defence Signal Directorate (DSD) is testing the national security capability of Apple's iOS mobile operating system for use on federal networks that transmit national security data. If the operating system is certified as secure, Australian Defence Force personnel, government aides as well as ministers and senators at all levels could see iPads deployed as standard."
This discussion has been archived. No new comments can be posted.

Aussie Security Forces Testing Apple's iOS

Comments Filter:
  • by Noryungi (70322) on Thursday February 24, 2011 @06:17AM (#35298038) Homepage Journal

    Wasn't there a hack, published recently, that allowed a user to bypass all security & protections on an IOS device, simply through the standard connector?

    I just don't understand how you can seriously evaluate the security of a mainstream COTS OS and expect it to survive more than 5 minutes versus a dedicated attack, not to mention an attack financed by a rogue state. Even industrial controls are becoming more and more endangered -- see stuxnet.

    Other devices, such as the Blackberry, should be banned as well, as the French intelligence has been requesting for quite some time now. And don't even mention the words "Windows", "Mobile" and "Security" in the same sentence, please.

    • by Bert64 (520050)

      The problem with phones as a whole, not just the iphone, is that the device is generally capable of booting without the user having to enter any form of key material...
      Therefore, even if the device is encrypted, the key must also be stored on the device, where someone with sufficient skill will be able to extract it.

      • by Anonymous Coward

        Well, specific apps could have their own dedicated encryption which requires a passphrase, or Bluetooth RSA token, or whatever.

    • by joh (27088) on Thursday February 24, 2011 @06:52AM (#35298158)

      Wasn't there a hack, published recently, that allowed a user to bypass all security & protections on an IOS device, simply through the standard connector?

      No, not all, just some. There are different levels of protection, some were broken and some not. iOS has some newer APIs for that which aren't widely used yet by apps, but they're there and used right they're secure.

    • by Anonymous Coward

      The French intelligence has backtracked last year on their initial recommendation against Blackberry devices, following on a study conducted by the secret services. Blackberry are now deployed in most ministries in France.

    • by mjwx (966435)
      Between this, sex scandals in the navy and 10% of our forces being to pudgy to deploy, I'm losing faith in our Diggers.

      I just don't understand how you can seriously evaluate the security of a mainstream COTS OS

      Indeed, didn't the CIA or some such American agency develop a specification for this kind of thing. Shouldn't a sensitive comms device be built from the ground up with encryption at the very least rather then just wrapped around the outside.

    • I'm not sure if this is what you were referring to, but this is immediately what I thought of when I saw this article:

      http://www.youtube.com/v/uVGiNAs-QbY [youtube.com]

      And the paper: http://www.sit.fraunhofer.de/en/Images/sc_iPhone%20Passwords_tcm502-80443.pdf [fraunhofer.de]

      I got these from a friend a few days ago, and then was astounded to see this article on Slashdot. The method requires jailbreaking (a whole other problem), but uses built-in system functions to dump various keychain creds!

    • by hawkbat05 (1952326) on Thursday February 24, 2011 @09:35AM (#35298928)
      BlackBerry has been tested under FIPS 140-2, CC and CAPS and has been approved for NATO RESTRICTED, UK IL3 and Canada Protected B (among others). It's all available for review here [blackberry.com]. BlackBerry also supports S/MIME and/or PGP, device and media card encryption, DoD CAC/smartcards (for two factor authentication to the device), Bluetooth encryption, AES256 encryption between the device and it's BlackBerry Enterprise Server, several options for secure remote wipe of the data (even if there is no cellular connection) and all of this can be enforced from a centrally administered server and compliance verified from there as well. Show me how iPhone or Android can even come close to not only the certifications but the security features that can be easily audited for compliance. The only other phone that beat some of this is the Sectera Edge by General Dynamics (which can encrypt voice as well) but I wouldn't call their solution COTS. I know that reads like an advertisement but BlackBerry is really the only one doing all of that (afaik anyway).
    • Even industrial controls are becoming more and more endangered -- see stuxnet.

      Stuxnet required a few things to be in place to work:

      • The Windows operating system,
      • Step 7 SCADA system (that runs on Windows)
      • a Siemens PLC.

      There's one of these things that's been implicated in most other exploits as well. See if you can guess which it is...

    • by Dabido (802599)

      And don't even mention the words "Windows", "Mobile" and "Security" in the same sentence, please.

      Hypocrite. :-)

  • by Anonymous Coward

    They can be jailbroken. What does that say about the security of the OS?

  • I can already see it happening:

    Commander (To his troops): Gentlemen, you have a new assignment. I have sent you a link to a PDF containing the details...

  • What's that skip? Uncle Drongo's got a compound fracture of the tibia? There's a bladdy app for that mate!!!
  • private wireless networks that handle material of national security.

    Lol, national security WiFi network.

    to use iOS products in a secure manner

    OK... what? When was iOS last developed as a military grade secure system?

    Both the iPhone and iPad incorporate DSD-approved cryptographic algorithms and DSD-approved cryptographic protocols

    Ooo. So does my undergraduate homework. But I sure as fuck hope it's not deployed anywhere, because it's not been designed or audited for anything at this level, and it is sure to have a million implementation problems. Nor am I available to audit every single code fix and functionality update.

    • by geogob (569250)

      to use iOS products in a secure manner

      OK... what? When was iOS last developed as a military grade secure system?

      Does it have to be? In the military (or in general one should say), security is a relative thing. Although the device may not be suited for some security level and/or requirements, it may be fine for others. There's no such thing as a "military grade security". But there are many military security grades, for some of which off the shelf devices are totally adequate.

      • Any policy which relies on Apple's software, e.g. its implementation of "cryptographic protocols", must be wrong. The best one can hope for is hardware-based restrictions, i.e. (i) no physical connection to an insecure network; (ii) heavy firewalling and packet inspection to make sure the client system is not misbehaving; (iii) no wireless whatever, because a full analysis of the source is required to make sure nothing in the iPad can be exploited to cause it to retransmit sensitive data.

        (assuming every lin

      • by rtb61 (674572)

        Sure there is, it's called hard wired and air gap with no portable media drives or connectors. Absolutely never ever anything on wireless in the hands of politicians. The whole thing must be some way early April fools joke. No who the hell is the politicians responsible for looking for stupid ways to throw away lots of money, on grossly overpriced under performing technology.

  • Anecdote (Score:2, Interesting)

    by Anonymous Coward
    When I graduated from my IT Security and Cryptography degree I saw most of the morons of the class ending up working for ASIO and the DSD, so I wouldn't trust the DSD to certify that my CAT-5 patch cables have connectivity let alone an proprietary operating system. All they do is use inflexible checklists and frameworks to make their decisions on, they can't think outside of the box, and that's where the problems are going to lie.
    • Re:Anecdote (Score:5, Insightful)

      by Bert64 (520050) <bert AT slashdot DOT firenzee DOT com> on Thursday February 24, 2011 @06:35AM (#35298114) Homepage

      Security standards as a whole are like that, based on checklists, and the checklists have flaws in them which vendors will often exploit...

      For instance, one of the requirements may be "must encrypt all user data using a recognised encryption algorithm", however they will miss something like where the key should be stored, so you end up with the key being stored on the device where its easily retrieved thus rendering the encryption pretty worthless.

      On the other hand, the threat is often overhyped... The majority of people who would steal something like an ipad are petty criminals who care about how much cash they can get by selling the device, they couldn't care less what data it contains.

      • by dlt074 (548126)

        The majority of people who would steal something like an ipad are petty criminals who care about how much cash they can get by selling the device, they couldn't care less what data it contains.

        however, the majority of people who steal government iPads for the purpose of spying are interested in the data it contains.

    • When I graduated from my IT Security and Cryptography degree I saw most of the morons of the class ending up working for ASIO and the DSD, so I wouldn't trust the DSD to certify that my CAT-5 patch cables have connectivity let alone an proprietary operating system. All they do is use inflexible checklists and frameworks to make their decisions on, they can't think outside of the box, and that's where the problems are going to lie.

      Was one of them a kind of chubby, dark haired, autistic looking guy, works at Russell, carries an umbrella (always), and catches the bus to Civic?

      Coz if he can't keep track of his briefcase I sure wouldn't trust him with anything smaller. He seems to have a little problem with literacy too....

  • by bazmail (764941)
    Obviously the convicts in HMS Prison Australia have heard of this "jail breaking" thing and want in.
  • by ewe2 (47163)

    these are the same geniuses who thought laptops could travel in APCs.

  • by Anonymous Coward

    explanation is simple, high level officials daughter shows him shiney new ipad and says "look daddy it is soooo cool, the us generals will laugh at you if you bring a notepad and paper to a meeting"... deal to implement ipads nationwide done.

  • by xixax (44677) on Thursday February 24, 2011 @07:20AM (#35298242)

    Information technology used *anywhere* in the Aussie government should be approved by Defense Signals Directorate, the assessment doesn't mean it's going to be used by military personnel ("security forces") for sensitive tasks.

    I'm not surprised they are evaluating the iPhone/iPad. It's trendy, is probably cheaper than Blackberry (AFAIK only currently evaluated smart phone product) and it has all the hallmarks of classic "Spiderman Pyjamas" for style aware executives. Probably more a case of people having private iPhones and being underwhelmed by the available approved options.

    No doubt they'll get pressure to assess Andriod next.

  • Since iOS is closed source, are they simply black-box testing it? Because I'm sure that'll work wonders.

    It says they're working with apple, but I'm pretty sure if there are outstanding bugs either apple doesn't know about them, or won't show them off and lose out on this project.

  • It's not like Australia's defence forces really matter.

    China decide they want Australia's coal, gas, uranium and other mineral wealth, they're just going to roll in and take it.

    Or exchange it for cheap crap the way the Americans did.
     

    • by grantek (979387)

      Or exchange it for cheap crap the way the Americans did.

      Like iPads!

    • China already do take our gas, coal and other mineral wealth. We're making out like bandits selling it to them (how's that recession working out for you, rest of the World?) and their economy is still going strong, based on them buying it from us at a price they can bear. That's way easier for them than trying to mount an invasion of a country half a world away, by sea because there's no land between us and them, and without damaging the infrastructure necessary to pull said minerals out of the ground and s
  • Correct me if I'm wrong, but doesn't Apple randomly take snapshots of all the data on their iThings for bug tracking/troubleshooting purposes? If so then that right there should disqualify them.

  • by Hognoxious (631665)

    It's a hoax. Using anything Apple related would be against rulesone, three and five. [youtube.com]

Take care of the luxuries and the necessities will take care of themselves. -- Lazarus Long

Working...