Aussie Security Forces Testing Apple's iOS 58
lukehopewell1 writes "Australia's Defence Signal Directorate (DSD) is testing the national security capability of Apple's iOS mobile operating system for use on federal networks that transmit national security data. If the operating system is certified as secure, Australian Defence Force personnel, government aides as well as ministers and senators at all levels could see iPads deployed as standard."
What could possibly go wrong? (Score:3)
Wasn't there a hack, published recently, that allowed a user to bypass all security & protections on an IOS device, simply through the standard connector?
I just don't understand how you can seriously evaluate the security of a mainstream COTS OS and expect it to survive more than 5 minutes versus a dedicated attack, not to mention an attack financed by a rogue state. Even industrial controls are becoming more and more endangered -- see stuxnet.
Other devices, such as the Blackberry, should be banned as well, as the French intelligence has been requesting for quite some time now. And don't even mention the words "Windows", "Mobile" and "Security" in the same sentence, please.
Re: (Score:2)
The problem with phones as a whole, not just the iphone, is that the device is generally capable of booting without the user having to enter any form of key material...
Therefore, even if the device is encrypted, the key must also be stored on the device, where someone with sufficient skill will be able to extract it.
Re: (Score:1)
Well, specific apps could have their own dedicated encryption which requires a passphrase, or Bluetooth RSA token, or whatever.
Re:What could possibly go wrong? (Score:4, Informative)
Wasn't there a hack, published recently, that allowed a user to bypass all security & protections on an IOS device, simply through the standard connector?
No, not all, just some. There are different levels of protection, some were broken and some not. iOS has some newer APIs for that which aren't widely used yet by apps, but they're there and used right they're secure.
Re: (Score:1)
The French intelligence has backtracked last year on their initial recommendation against Blackberry devices, following on a study conducted by the secret services. Blackberry are now deployed in most ministries in France.
Re: (Score:2)
Indeed, didn't the CIA or some such American agency develop a specification for this kind of thing. Shouldn't a sensitive comms device be built from the ground up with encryption at the very least rather then just wrapped around the outside.
Re: (Score:1)
I'm not sure if this is what you were referring to, but this is immediately what I thought of when I saw this article:
http://www.youtube.com/v/uVGiNAs-QbY [youtube.com]
And the paper: http://www.sit.fraunhofer.de/en/Images/sc_iPhone%20Passwords_tcm502-80443.pdf [fraunhofer.de]
I got these from a friend a few days ago, and then was astounded to see this article on Slashdot. The method requires jailbreaking (a whole other problem), but uses built-in system functions to dump various keychain creds!
Re:What could possibly go wrong? (Score:5, Informative)
Re: (Score:2)
Even industrial controls are becoming more and more endangered -- see stuxnet.
Stuxnet required a few things to be in place to work:
There's one of these things that's been implicated in most other exploits as well. See if you can guess which it is...
Re: (Score:1)
And don't even mention the words "Windows", "Mobile" and "Security" in the same sentence, please.
Hypocrite. :-)
Not secure (Score:1)
They can be jailbroken. What does that say about the security of the OS?
Oh no! (Score:2)
I can already see it happening:
Commander (To his troops): Gentlemen, you have a new assignment. I have sent you a link to a PDF containing the details...
Phew! Not so bad! (Score:2)
For a moment I thought you were going to say a Flash app...
Re: (Score:3)
Not kidding. Looks like a simplified real deal command-and-conquer RTS app [adobe.com].
Flash is pretty much the go to guy for easy-to-build rich GUIs, which even AAA game titles (Like Starcraft II, Streetfighter IV, etc) use Flash for their GUIs via Scaleform technology [scaleform.com].
Re: (Score:2)
hey, this is an apple thread, we don't want to hear about geeky stuff in here!!!
adjust your field amplifier or leave now please!!!
Re: (Score:2)
umm...
Google is Evil and Adobe is LaZy!!! [zazzle.com]
G'day mate! (Score:1)
yes, quite (Score:2)
private wireless networks that handle material of national security.
Lol, national security WiFi network.
to use iOS products in a secure manner
OK... what? When was iOS last developed as a military grade secure system?
Both the iPhone and iPad incorporate DSD-approved cryptographic algorithms and DSD-approved cryptographic protocols
Ooo. So does my undergraduate homework. But I sure as fuck hope it's not deployed anywhere, because it's not been designed or audited for anything at this level, and it is sure to have a million implementation problems. Nor am I available to audit every single code fix and functionality update.
Re: (Score:3)
to use iOS products in a secure manner
OK... what? When was iOS last developed as a military grade secure system?
Does it have to be? In the military (or in general one should say), security is a relative thing. Although the device may not be suited for some security level and/or requirements, it may be fine for others. There's no such thing as a "military grade security". But there are many military security grades, for some of which off the shelf devices are totally adequate.
Re: (Score:2)
Any policy which relies on Apple's software, e.g. its implementation of "cryptographic protocols", must be wrong. The best one can hope for is hardware-based restrictions, i.e. (i) no physical connection to an insecure network; (ii) heavy firewalling and packet inspection to make sure the client system is not misbehaving; (iii) no wireless whatever, because a full analysis of the source is required to make sure nothing in the iPad can be exploited to cause it to retransmit sensitive data.
(assuming every lin
Re: (Score:2)
Sure there is, it's called hard wired and air gap with no portable media drives or connectors. Absolutely never ever anything on wireless in the hands of politicians. The whole thing must be some way early April fools joke. No who the hell is the politicians responsible for looking for stupid ways to throw away lots of money, on grossly overpriced under performing technology.
Re: (Score:2)
Worrying about strong crypto on a wifi device is like worrying about the locking mechanism on a safe with a window.
Anecdote (Score:2, Interesting)
Re:Anecdote (Score:5, Insightful)
Security standards as a whole are like that, based on checklists, and the checklists have flaws in them which vendors will often exploit...
For instance, one of the requirements may be "must encrypt all user data using a recognised encryption algorithm", however they will miss something like where the key should be stored, so you end up with the key being stored on the device where its easily retrieved thus rendering the encryption pretty worthless.
On the other hand, the threat is often overhyped... The majority of people who would steal something like an ipad are petty criminals who care about how much cash they can get by selling the device, they couldn't care less what data it contains.
Re: (Score:1)
The majority of people who would steal something like an ipad are petty criminals who care about how much cash they can get by selling the device, they couldn't care less what data it contains.
however, the majority of people who steal government iPads for the purpose of spying are interested in the data it contains.
Re: (Score:1)
When I graduated from my IT Security and Cryptography degree I saw most of the morons of the class ending up working for ASIO and the DSD, so I wouldn't trust the DSD to certify that my CAT-5 patch cables have connectivity let alone an proprietary operating system. All they do is use inflexible checklists and frameworks to make their decisions on, they can't think outside of the box, and that's where the problems are going to lie.
Was one of them a kind of chubby, dark haired, autistic looking guy, works at Russell, carries an umbrella (always), and catches the bus to Civic?
Coz if he can't keep track of his briefcase I sure wouldn't trust him with anything smaller. He seems to have a little problem with literacy too....
Re: (Score:1)
And every Agency would have to pay on an annual basis for an Enterprise License to be "allowed" to side-load their own applications to the devices.
Why were iPads even considered? That sort of restricted access should rule them out at the first step.
Well it's obvious really:- Victoria increased the number of doctors there by giving tree iPads, now it's time to boost ASIO recruiting. I know it makes me want to endure the "intrusive vetting" in order to work with cheezel scented fat fucks for a low wage, and hey, once a month you get to play paintball out the back of the airport. Sign me up.
The criminals (Score:1, Funny)
oh dear (Score:2)
these are the same geniuses who thought laptops could travel in APCs.
general gets idea from daughter (Score:1)
explanation is simple, high level officials daughter shows him shiney new ipad and says "look daddy it is soooo cool, the us generals will laugh at you if you bring a notepad and paper to a meeting"... deal to implement ipads nationwide done.
Spiderman Pyjamas (Score:3)
Information technology used *anywhere* in the Aussie government should be approved by Defense Signals Directorate, the assessment doesn't mean it's going to be used by military personnel ("security forces") for sensitive tasks.
I'm not surprised they are evaluating the iPhone/iPad. It's trendy, is probably cheaper than Blackberry (AFAIK only currently evaluated smart phone product) and it has all the hallmarks of classic "Spiderman Pyjamas" for style aware executives. Probably more a case of people having private iPhones and being underwhelmed by the available approved options.
No doubt they'll get pressure to assess Andriod next.
How are they testing it? (Score:2)
Since iOS is closed source, are they simply black-box testing it? Because I'm sure that'll work wonders.
It says they're working with apple, but I'm pretty sure if there are outstanding bugs either apple doesn't know about them, or won't show them off and lose out on this project.
Lets face it (Score:2)
It's not like Australia's defence forces really matter.
China decide they want Australia's coal, gas, uranium and other mineral wealth, they're just going to roll in and take it.
Or exchange it for cheap crap the way the Americans did.
Re: (Score:1)
Or exchange it for cheap crap the way the Americans did.
Like iPads!
Re: (Score:1)
Re: (Score:2)
Boy, you jumped right into that one.
Apple snapshots? (Score:2)
Correct me if I'm wrong, but doesn't Apple randomly take snapshots of all the data on their iThings for bug tracking/troubleshooting purposes? If so then that right there should disqualify them.
Ob (Score:2)
It's a hoax. Using anything Apple related would be against rulesone, three and five. [youtube.com]
How can iOS be considered secure if... (Score:1)
...there are tools to compromise its keychain in a few minutes? [techworld.com.au]