The Beijing institute developed the technique to crack an iPhone’s encrypted device log to identify the numbers and emails of senders who share AirDrop content, the city’s judicial bureau said in an online post. Police have identified multiple suspects via that method, the agency said, without disclosing if anyone was arrested. “It improves the efficiency and accuracy of case-solving and prevents the spread of inappropriate remarks as well as potential bad influences,” the bureau said.

Further read: https://sfj.beijing.gov.cn/sfj/sfdt/ywdt82/flfw93/436331732/index.html

all 48 comments

sorted by: hot top controversial new old
[–] 116 points 2 years ago* (2 children)

Or China is just saying they cracked Air Drop to try to scare protestors from using this feature. If they cracked it, why would they make it public that they cracked it when they could catch dissidents using it without their knowledge? Not to mention making it public puts pressure on Apple to patch it, which would destroy their access. Doesn’t make much sense to make this public if it is true.

  • source
  • hideshow 4 child comments
  • [–] 97 points 2 years ago (1 child)

    Whenever a government or government agency announces a successful exploit, I presume they've already exhausted it and moved on to another one that won't be patched or publicly divulged for many years.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 2 years ago (2 children)

    I don't buy it. This smells like a way of causing fear in those who want to share information.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 22 points 2 years ago* (3 children)

    It would be easy for apple to debunk this if it wasn't true. I'd stay away from it and use proven secure means.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 7 points 2 years ago (3 children)

    There’s no way to prove that something is secure. (It reduces to the halting problem.)

  • source
  • parent
  • hideshow 6 child comments
  • [–] 5 points 2 years ago* (last edited 2 years ago) (1 child)

    How can Apple debunk it?

    If I told you I know of a way by which I can "hack" the lock of your house to enter it, how can you prove whether I'm lying or not? Specially if I'm not willing to show you how I do it, and I haven't given you any proof of having actually done it that you can try to dispute.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 2 years ago (2 children)

    sending email and phone number with each airdrop doesn't sound right. Apple isn't a good company but they aren't dumb. Why would you send that info?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 5 points 2 years ago* (last edited 2 years ago)

    They aren't saying that the email/number is part of the message. What the are saying is that they are able to decrypt the logs in order to identify the senders .

    It could be they cross-reference matching some internal ids / tokens / physical addresses of the devices together with all the data the Chinese government already has (or can obtain) ...or it could be a bluff.. who knows... there's not enough information, and what we know is probably distorted.

  • source
  • parent
  • [–] 36 points 2 years ago (2 children)

    Apple has been taking massive Ls after Ls wrt the security of their iPhones in recent times. It's almost as if magically branding your products "private and secure" doesn't work.

  • source
  • hideshow 4 child comments
  • [–] 17 points 2 years ago (2 children)

    Finding an exploit created by state-level actor is not a massive L. They have shown in the past that they are able to hack air gaped systems, weaken commonly used security standards and implant vulnerabilities into commercial software. I don't think you will find a company that is immune to this. Other than that, did they really have so many security issues recently?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 5 points 2 years ago* (1 child)

    Read the article. The exploit was found by the state actors not created by them. Apple is ultimately responsible for the mishap due to the insecure design of the aforementioned feature.

    Even though China partially had a hand in the creation of this flaw according to the history of the feature.

    And yes, Apple has been a constant feature on the news for such privacy leaks of late. You just haven't been paying attention.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 2 years ago

    If state actor would create it it would be a backdoor. Exploits are by definition bugs/security issues that can be.... well, exploited and state-level actors are really good at finding them. Still, if it takes resources of state actor to find an exploit I don't think it's a massive L. Yes, it's totally possible they had some other serious security issues recently and I haven't been paying attention. That's why I'm asking.

  • source
  • parent
  • [–] 21 points 2 years ago (1 child)

    Usually when one of Apple’s security measures is breached, the company would issue an update to patch it. We’d hope this will happen here, but the Chinese government is likely to apply pressure on the iPhone maker to leave the exploit unpatched – at least, on Chinese devices.

    WELL, Apple? ? . . . We're waiting

  • source
  • hideshow 2 child comments
  • [–] 17 points 2 years ago (2 children)

    While I have little respect for Apple's overall privacy practices, this sounds a lot like the CCP making something up to scare protesters and dissidents from using AirDrop. There's no sensible reason they would be advertising such an exploit openly, especially when it could potentially be used to secretly spy on dissidents, protesters, or even used in foreign espionage. Something doesn't sit right with this.

  • source
  • hideshow 4 child comments
  • [–] 8 points 2 years ago

    Well if Apple doesn't fix it, like they haven't fixed the iMessage flaws) they've known about for years, then it's still useful.

    And most people won't even know of this issue, and they'd still use Airdrop anyway, saying "I'm not interesting enough to spy on".

    iMessage lacks forward secrecy, so if I get your RSA key which never changes, I can read all your old messages and any new ones too. And that's just one issue with iMessage. And people don't know about it, and still use it, thinking it's secure. (it's pretty good in my opinion, just wish Apple would fix the issues linked article).

  • source
  • parent
  • [–] 14 points 2 years ago* (1 child)

    Probably not a reliable source but you should still use Foss with strong encryption (RSA2048+ ideally)

  • source
  • hideshow 2 child comments
  • [–] 11 points 2 years ago

    Oh China, you rascal.

  • source
  • [–] 7 points 2 years ago

    This is a great podcast about the vulnerabilities China has for their own only...

    Click Here: 101. Bug bounties with Chinese characteristics

    Episode webpage: http://www.recordedfuture.com/podcast

    Media file: https://chrt.fm/track/DG79BE/traffic.megaphone.fm/RFEI8990516258.mp3?updated=1704745626

  • source
  • [–] 3 points 2 years ago*

    only reason that I can see why they're saying they've done this has to be some kind of scare tactic

    would be a bit stupid to reveal this hand otherwise

  • source
  • [+] 0 points 2 years ago (2 children)
  • [+] -2 points 2 years ago (1 child)
  • [+] 7 points 2 years ago* (last edited 2 years ago) (3 children)
  • [–] 1 point 2 years ago (1 child)

    I agree. I'm just referring to China since this article is. They claim they figured it out but really they already have the keys to the backdoor. It was a requirement that Apple provided it to China before Apple devices could be sold in China.

  • source
  • parent
  • hideshow 2 child comments
  • [–] -2 points 2 years ago