Apple Agrees To Chinese Security Audits of Its Products 114
itwbennett writes According to a story in the Beijing News, Apple CEO Tim Cook has agreed to let China's State Internet Information Office to run security audits on products the company sells in China in an effort to counter concerns that other governments are using its devices for surveillance. "Apple CEO Tim Cook agreed to the security inspections during a December meeting in the U.S. with information office director Lu Wei, according to a story in the Beijing News. China has become one of Apple’s biggest markets, but the country needs assurances that Apple devices like the iPhone and iPad protect the security and privacy of their users as well as maintain Chinese national security, Lu told Cook, according to an anonymous source cited by the Beijing News."
Absolutely fair.. (Score:3, Insightful)
More countries should be doing security audits on more products.
Re:Absolutely fair.. (Score:5, Insightful)
"Security Audits" - In other words, making sure these governments have a way to access secure information stored on confiscated iPhones from activists, dissidents, journalists, and other troublemakers.
Re: (Score:2, Funny)
No, it says "protect the security and privacy of their users". Are you accusing them of lying?
Re: (Score:2)
That's not all it says...
Re: Absolutely fair.. (Score:2)
Re: (Score:2)
"Security Audits" - In other words, making sure these governments have a way to access secure information stored on confiscated iPhones from activists, dissidents, journalists, and other troublemakers.
How would a security audit achieve this? Just curious. I'm sure you know a lot more about this than I do.
Re:Absolutely fair.. (Score:4, Informative)
I believe the GP was suggesting that the phrase "security audit" was being used in a euphemistic manner.
Re: (Score:2)
I believe the GP was suggesting that the phrase "security audit" was being used in a euphemistic manner.
And in what alternate universe would Apple agree to a euphemistic security audit?
Re: (Score:2)
I can't really answer that, since I don't have any information on their internals, thus, I'd be speculating. I was merely pointing out what the GP appeared to be saying.
Do I agree with the GP? No idea. It's rather difficult to pass judgement on things without any actual details. I'd prefer to skip speculation and just wait for the results.
Re: (Score:2)
In a world where several BILLION up-and-coming wage earners are ripe to purchase their products, which, incidentally, wouldn't exist if not for the cheap labor still extant in that very same country.
Re: (Score:3)
In a world where several BILLION up-and-coming wage earners are ripe to purchase their products, which, incidentally, wouldn't exist if not for the cheap labor still extant in that very same country.
Maybe their regional ads will say 'Designed in California. Made in China'
Re: (Score:2)
In a world where several BILLION up-and-coming wage earners are ripe to purchase their products, which, incidentally, wouldn't exist if not for the cheap labor still extant in that very same country.
Maybe their regional ads will say 'Designed in California. Made in China'
Probably should actually say 'Designed in California. Made in Taiwan, Japan, and Korea. Assembled in China.'
Re:Absolutely fair.. (Score:5, Insightful)
What better way to learn what undiscovered security holes there are in a product than to be able to see the source code?
Oh, you thought that the reason China wants to audit the code is so that they can "protect" their citizens. Yes, because not at all well known for targeting dissent, no, not at all...
Re: (Score:3)
It depends what they are actually saying when they say they want to security audit the devices. I take that to mean complete access to the source code for all software supplied with the device and complete access to detailed hardware designs. So yep, a security audit will allow the Government of China to hunt down bugs and make use of them "to access secure information stored on confiscated iPhones from activists, dissidents, journalists, and other troublemakers". Likely it goes deeper than this and they w
Re: (Score:3)
This was my first thought -- it's a search not for security of the devices, but a search for exploits of these devices and/or some form of industrial espionage.
But I wonder -- can Apple set the terms of the audit? Ie, you get to examine whatever it is you examine in our office using our provided systems which aren't connected to the Internet. You may not bring any electronic devices into the audit facility. You may not reproduce any code you review in our facility by any means, including notes, pseudocode
Re:Absolutely fair.. (Score:4, Insightful)
Re:Absolutely fair.. (Score:5, Interesting)
Fear one may just be outright industrial espionage.
I'm guessing that security in Apple products goes above and beyond whatever (likely modified) FOSS libraries they use, but would also include stuff like their whole-disk encryption system, the touch ID sensor and its encodings, etc. So there's a fair amount of proprietary tech in these devices.
Fear two might be obtaining what amount to currently unknown zero-day exploits that could conceivably open all iDevices to security risks exploitable by Chinese intelligence.
AFAIK, recent models and OS levels have a generally accepted level of security that makes them difficult to break or exploit and I think this has come to be seen as a competitive advantage. Even if the security is beatable by the NSA in a lab situation, the marketing value is to businesses worried about lost devices or devices used in vertical markets with security compliance regulations.
Which is why I wondered how much Apple can control the terms of a security audit. Do the the Chinese just get handed a memory stick with ios-82-iphone6-source.tgz they can take back to their office or do they sit in a plain white room with locked down desktops that do a one-way remote console to a machine with source code? Or worse, a plain white room with a bunch of binders of printed source code?
Re: (Score:2)
Losing the additional security that closed source gives over open source.
Note that the phrase "There's no such thing as security through obscurity" is a nonsense. Security through obscurity alone is poor security. But it does indeed add a level of security when combined with other security practices.
https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:1)
But I wonder -- can Apple set the terms of the audit?
No, but they can create different versions for different nations with different back doors approved by each region's security apparatus...
Re: (Score:2)
That, and I wonder how intrusive are the security audits. I wouldn't put it past the Chinese government to think of the security audits as a legal way to steal technology ideas.
Re: (Score:1)
The NSA installed the backdoor, can't blame others for wanting to find it. That way they can protect themselves, exploit it for their own use and pick up some hints on the sort of techniques that the NSA likes to use.
Re:Absolutely fair.. (Score:5, Interesting)
Hrmm, this might work out well for us non-govt people.
Consider:
NSA: "Apple, you must let us 'review' your code. We'll keep our findings to ourselves, you can't tell anyone" ...
Apple: "OK"
NSA digs through code, finds exploits, locks them up for future weaponization
China: "Apple, we'd like to "review" your code. We're going to tell the world about it"
Apple: "OK"
NSA: "Crap, now those evyl Chinese will find our exploits. Darn, I guess we'd better tell Apple to fix them after all or the Chinese will be spying on us!
At the end of the day, the best we can hope for is that the various spooks keep each other honest.
Min
Nothing good can come of this. (Score:2)
Re: (Score:1)
It means that they get to see the source code under NDA. They negotiated the same thing for Windows. Having source makes it a little easier to find exploits to add to an NSA-like arsenal backing a FOXACID-like system. Though it's possible to find exploits without source, it's natural for them to want every advantage they can get.
Hopefully this is less of a big deal for Apple than it was for Windows since much of the Apple source code is already public: Darwin and WebKit. There's still a lot of closed-so
Re: (Score:2)
"Security Audits" - In other words, making sure these governments have a way to access secure information stored on confiscated iPhones from activists, dissidents, journalists, and other troublemakers.
Not necessarily. There are legitimate kinds of audits, too. In fact the U.S. should be doing more of them.
We have already found foreign chips (guess where they were made) that were "backdoored", even in some military products. And others that were cheap forged copies of better chips.
Whenever we have electronics that are important to not just military security but even just citizen privacy and dependence (like phones), we should be doing thorough security audits.
Re: (Score:3)
It is common practice for most countries, the only thing new here is a western country letting china do it too.
Re: (Score:2)
Here in America, we don't even audit our damn voting machines.
Re: (Score:3)
Here in America, we don't even audit our damn voting machines.
Because of, you know, whatever you vote, your slavery is totally determined by your EFFing "United States Electoral College".
Unless you're in one of the few states that either has proportional representation or is a swing state. I have seriously considered moving to a swing state for that reason.
Of Course (Score:4, Insightful)
Re: Of Course (Score:2)
They have outsourced parts of their business to companies in China, but that does not make them a Chinese company.
Re: (Score:1)
. US and Europe being politically unstable also helps china in this competition.
ROFL
OK there that was funny.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
It's Slashdot
Facts that someone doesn't like are the ultimate flamebait.
Pointing out logical flaws in an argument is trolling.
Likely we ran into an anti America/Europe/West person or just pro Chinese/ child of their elite type
Re: (Score:1)
The corruption?
Wait a second (Score:3)
I thought Apple products were assembled in China? (By chinese spies masquerading as low-wage workers, etc. etc. etc.)
Also, Lenovo.
Re: (Score:2)
I don't think the assemble the code by hand any more.
Re: (Score:2)
I thought Apple products were assembled in China?
Manufactured and assembled. They used to assemble parts for the US market in Sacramento, but they decided that they should keep the proceeds from the Mac tax instead of paying American workers to build products which are associated with America.
this proves nothing whatsoever. (Score:4, Insightful)
If Apple cooperates then how do they know the devices and software are exactly the same thing that Apple sells in China. The thing to do would be to acquire random samples in China and elsewhere jailbreak and then analyze. Never mind that Apple may not include obvious back doors but instead subtle behaviors that can be exploited and also explained away if discovered by outsiders.
When push comes to shove it is all bullshit to use enemy technology. If I was in their shoes I would go for my own hardware and software developed without any input from the outside.
They are probably more interested into breaking into existing I-devices so don't use these things what you want neither the US-G or the CN-G to know. That simple. Nobody is your friend here.
Re:this proves nothing whatsoever. (Score:5, Funny)
If I was in their shoes
You probably are in their shoes.
Exploitable flaws (Score:1)
It will enable the Chinese intelligence services to identify more currently unexploited flaws in the security of Apple's products. I doubt they will let Apple know of all the flaws that they find.
I suspect also that Apple could not refuse to cooperate, and I would be surprised if the intelligence services in the USA are not doing precisely the same.
I wonder if the Europeans are regretting the disembowelling of Nokia as a phone manufacturer?
Re: (Score:1)
Exploitable flaws (Score:2, Interesting)
Nokia failed in design and marketing. Why would "Europe" regret that? It's not like "Europe" could have helped a bit. That's just how market works. Besides, the same people are still making phones, only they run MS software now. Nice phones, I have one, good exchange sync, works as a phone, WhatsApp works, nice camera. UI looks better imho compared to iOS and android. Software ecosystem may lack a bit, but everything I need in a phone is available. I have android phone also, but it's sitting on a desk at ho
Re: (Score:1)
Given the historically proven record of China and its espionage, it should be the other way around. It is a part of their history and their culture.
Nortel? After the Chinese were done with them, Huawei and ZTE rose up as PRC military-backed entities.
US government contractors? The Chinese have been continually caught with their hand in the cookie jar.
Any company that deals with China? Expect clones if your designs aren't tightly controlled.
On the other hand, the accusations against the US rely on baseless al
Re: (Score:2)
Re: (Score:2)
Also, home of industrial espionage would be the USA.
I can't help but think of wooden shoes clogging machinery.
Arguably, the home of industrial espionage would be either the UK or Germany. You need industry before you can have industrial espionage, so it seems like the proper powers for the era.
Re: (Score:2)
I seem to recall tales of trade cities that were quite paranoid about outsiders learning their craft, some of which predated industrialized Great Britain or Germany by a rather large number of years.
Perhaps the most well-known example is Murano, whose artistic glassblowing techniques were held in high esteem by the region. An older example would be Damascus metalworking, and I have vague recollections of similar industrial pride dating back to Egypt.
I'm afraid my memory is not a particularly reliable source
Re: (Score:1)
> the accusations against the US rely on baseless allegations from a cowardly individual.
And the F35 is a good bird :)
Chinese AC Convention? (Score:2)
Chinese Zodiac
Chinese Opera
Chinese Laundry
Chinese Restaurants
Chinese Checkers
Chinese Doll
Chinese Puzzle Box
Chinese Room
Chinese Medicine
Chinese Handcuffs
Chinese Security Audits
Better Chinese Clones (Score:2)
Products? (Score:2)
Why give China access to data (Score:1)
Re: (Score:2)
that they won't disclose to us? I don't know if any of you have ever tried to get this info from Apple, but they really don't make it easy. Or possible.
Just wait until the Chinese leak it online
You are believing Lu and the GFW? (Score:1)
How naive you are. Apple just wants to make money from Chinese market. They don't care about privacy.
What Lu means is really, that you have to give your private key to us, or use the SMn ciphers(Chinese government home made ciphers, whether there are flaws or not, we don't know).
-- one Chinese
Another black mark (Score:2)
An "option" (Score:2)
Gee, I wonder what the other option was...
Auditing security" sounds a lot better than... (Score:1)
So is the converse true? (Score:2)
Can the US demand to security audit any Chinese product? Can we demand to see the source/firmware of, say, Huwai routers?
I don't think it's really a security audit (Score:2)
Re: (Score:2)
The Chinese is most likely doing this as a response to the US banning ZTE and Huawei telecom products in the US. The US government is accusing ZTE and Huawei of building backdoors and other security concerns into their hardware, so China wants to hit back with something equally annoying. China is basically saying that's cool, we can screw with your companies too. Especially since China is a huge market to cell phone makers that most US companies have yet to really tap into. And with a huge growing middle class, the amount of profit for products like iPhone and Android based phones is huge. China is basically holding the iPhone hostage to get better treatment of its companies outside of China.
The problem with that is the Chinese market craves iPhones and the US market couldn't care less about ZTE and Huawei products. All that'll do is piss off the Chinese with disposable incomes, "the growing middle class" and Chinese leaders will get voted out of office.
Oh wait. It's a dictatorship.
For what - to verify the Chinese malware? (Score:2)
Huh???? Chipping, anyone? (Score:2)
The socialist response to Obama's SOTU:
https://www.youtube.com/watch?... [youtube.com]
And the Real Obama:
https://firstlook.org/theinter... [firstlook.org]