So in short: Apple has back doors that they claim aren't really back doors since only Apple apps can use them. If the NSA hasn't been using them already, it is only a matter of time.
Like impersonate them cryptographically with a forged/stolen ssl cert?[1]
> one also needs to have physical access to the phone
The user only has to pair the device with their PC for the PC to become a "trusted device", from which this exploit can be run.
[1] > Serious Security: Google finds fake but trusted SSL certificates for its domains, made in France http://nakedsecurity.sophos.com/2013/12/09/serious-security-...
No, SSL certs are using to sign packages and software too. And Apple would not have a root cert, their cert would be signed by a root CA, which could be used to sign other certs if it's tricked into thinking its' Apple requesting them (like in the recent Google cert example).
So one could impersonate a company if they have a cert that says they are that company.
They are likely using a plain-old SSL Cert signed by a plain-old public CA, which is how your computer would know if the executable appears to come from Apple or not.
Second, Apple includes their own root certificates in their own operating systems just like everybody else. I've personally implemented a code signing mechanism for a platform that had no root certificates except for those I personally generated (and still control).
The public CA system is just irrelevant here. It has nothing to do with anything.
If a paired PC is compromised (a trivial task for a sophisticated hacker or the NSA, if the millions of windows pc bot nets are evidence), and wifi sync is enabled, and the device is unlocked and in use, then the compromised PC could theoretically harvest personal information from the device without any warning or notification to the user.
IMO it seems like the only requirements to compromise someone's iDevice is A) they use their iDevice with a compromised PC, and wifi sync seems to make it all much easier.
The part of this story I think deserves more attention is security against a sophisticated adversary who does not have the passcode or access to a paired computer. In this case, data protection should be effective (the data is encrypted with a key that requires going through the hardware AES engine to derive from the passcode, i.e. slow), but for some reason most data is apparently not protected. This doesn't seem hard to improve to me, and I'd like Apple to do so.
If we're going to have "lawful intercept" legal requirement, I'd rather have the mechanisms require this type of intrusive action that require a warrant in most cases.
I was really hooked by this talk until he characterized supervision/enterprise enrollment as a "backdoor", and the more I read about it, the more bullshitty it really is.
Guess what. If you hacked into my Mac, then yes, you can see my pictures in iPhoto. As my iPhone keeps syncing to the Mac, yes, you'll be able to see the pictures from my phone. But you'll also be able to view my emails (from Mail on the Mac), all my documents, and install a key logger on my Mac and steal my bank credentials.