Apple Disputes Google's Claims of a Devastating iPhone Hack (vice.com) 22
In a rare move, Apple has released a statement to comment on the attacks on iPhone users revealed by Google last week. From a report: Last week, Google dropped a bombshell in the form of a long, detailed analysis of five chains of iOS vulnerabilities discovered by its security teams. Google didn't say who was behind the attacks, nor who was targeted, but described the attack as "indiscriminate," and potentially hitting "thousands" of people. Apple disagrees. Friday, Apple published a brief press release that disputes some relatively minor details that Google released about the attacks. Namely, that the attacks lasted for a shorter amount of time and that they were less widespread than Google reported.
"First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones 'en masse' as described. The attack affected fewer than a dozen websites that focus on content related to the Uighur community." Apple wrote. "Google's post, issued six months after iOS patches were released, creates the false impression of 'mass exploitation' to 'monitor the private activities of entire populations in real time,' stoking fear among all iPhone users that their devices had been compromised. This was never the case. Second, all evidence indicates that these website attacks were only operational for a brief period, roughly two months, not 'two years' as Google implies," the statement continued.
"First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones 'en masse' as described. The attack affected fewer than a dozen websites that focus on content related to the Uighur community." Apple wrote. "Google's post, issued six months after iOS patches were released, creates the false impression of 'mass exploitation' to 'monitor the private activities of entire populations in real time,' stoking fear among all iPhone users that their devices had been compromised. This was never the case. Second, all evidence indicates that these website attacks were only operational for a brief period, roughly two months, not 'two years' as Google implies," the statement continued.
Disputing the word 'devastating' or the hack (Score:1)
Re: (Score:3)
I have been in the industry for decades. Competition will often over inflate the seriousness of their competitors problems, while the other side will downplay it.
I expect both Google and Apple are lying.
Being that shortly after the communication I got a couple of iOS updates. (Close to iOS 13 release date) meaning the problem was indeed big enough for apple to put in some quick fixes.
However unlike other major security problems in the past, we are not flooded with reports of their iPhone getting compromis
Marketing (Score:1)
Don't be Evil, they said (Score:1)
Re: (Score:1)
Most likely.
Usually I find the truth lies somewhere in the middle though, and it seems likely that not only is Google blowing this out of proportion (and they've certainly abandoned the "Don't be evil" axiom long ago), but that Apple is, on the other hand, also downplaying some elements of it as well.
Re: (Score:1)
I'm an iPhone user, but obviously Apple has a vested interest in playing down the severity of any broad vulnerability. On the other hand, Project Zero is not above political considerations.
I suspect the truth lies somewhere between the two points.
Re: (Score:1)
When a corp monitors your activities on an iPhone Apple screwed up. When one does the same on Android, Google's doing theirs properly.
Re: (Score:3)
What is Apple disputing exactly? (Score:5, Insightful)
Re: (Score:1)
They can't prove shit and neither can anyone else and they know it. They're just trying to down-play the notion that anyone you actually care about got hacked so you'll quickly forget it happened. The public never learns their lesson, and the schadenfreude continues unabated. Sucks to be you if you were one of the individuals actually targeted by this hack, because even law enforcement won't believe you now.
Re: (Score:2)
Given who was targeted, I'd say law enforcement was in on it. They'd believe you, but it wouldn't matter because they're setting you up.
Re: (Score:1)
It's not clear how widespread this attack was and how many people were caught up in it, and on what OSes.
https://www.forbes.com/sites/t... [forbes.com]
What should be clear is that the Chinese government will bend its considerable resources to keep exceptional exploits to themselves for the purposes of targeting a minority group in their country. It would be foolish of us to assume that only Apple was affected.
Apple, obviously, wants people to know that in general their phones are safe. If this were a particularly wide-s
Re: (Score:1)
Re: (Score:3)
Timeframe for one (Score:3)
What is Apple disputing exactly?
Google claims the exploit was around for two years, Apple says 2 months... yes the Technical existence of the exploit is clear, the timeframe for possibly being exploited was not.
Seems pretty clear it was only the Chinese government that exploited it though so very few iPhone users were actually affected.
Re: (Score:3)
The vulnerability dates back to iOS 10, which was released 2 years ago. Apple hasn't provided any evidence the exploit hasn't been used over that full period.
Seems pretty clear it was only the Chinese government that exploited it though so very few iPhone users were actually affected.
Seems clear how exactly?
Re:What is Apple disputing exactly? (Score:5, Insightful)
Google certainly has snapshots of websites going back in time. I don't see why they'd lie on something that would be roundly defeated in court for defamation kind of money.
The rest of the analysis is extremely thorough.
I think Apple may be panicking because they're spending huge money on "privacy" billboards that they ought to be spending on security.
Their lax security has almost certainly helped the Chinese government round up some of the 2.5 million Uyghurs they have in concentration camps for their slow-burn genocide.
The pathetic thing is that the implant doesn't even attempt to hide itself (it runs from /tmp ) because iOS doesn't even allow you to see a process list.
"Privacy".
As a android user (Score:5, Funny)
Re: (Score:1)
As a android user, you can at least be safe and always upgrade to the latest version...
Yep Pixel 3 owner on Android 10 here.
Re: (Score:3)
What about Android users (Score:4, Informative)
Roughly half of Android users are vulnerable even as of today because there is no mechanism for them to get security fixes. Only 2% of people using Google phone made in last 3-4 years can get security fixes in a guaranteed way.
Its a diversion (Score:1)