Comment by Asparagirl | Hacker News Reader

Comment by Asparagirl | Hacker News Reader

If I'm understanding this right, this article is claiming that the CIA served up [edit: could serve up, not proven they did, see comments below about plausibility] poisoned versions of XCode, which would then be used to make App Store apps that eventually phoned home to Langley with either app-specific data or whole-phone data.

This raises so many questions, among them:

1) What was [edit: would be] the criteria for serving up a poisoned version instead of a real version of XCode to a dev? Was it [would it be] limited to downloadable versions or were DVD software copies affected too? One possibility came to mind: Does XCode come in different flavors based on county of sale/download, language, or a combo of the two? If so, would that be that criteria for their attempt to not target US citizens, by crudely targeting non-US and/or non-English app developer accounts? Because that would be the fakiest attempt yet at trying to claim plausible deniability, since so many apps with mainly American userbases are developed by overseas devs.

2) If a dev had a poisoned version of XCode, how could they not see a mysterious server being pinged during their development of the app? How could Apple not see something amiss during their QA of the app before they pushed it to the store?

3) If I were an evil genius Big Brother no holds barred government, I'd want data from messaging apps, social networks, and geolocation apps most of all, less so from things like single-player games. Thoughts on which apps are likely to be in the top 5 of their wishlist?

4) Does this mean that PhoneGap / Cordova / non-native HTML5 apps really are better? :-)

Say, why did Facebook change to a native app again?

Okay, can't sleep, so:

5) The whole point of this proof-of-concept seems to be to have unsuspecting, innocent devs who build regular boring apps, like Tinder For Dogs or whatever, unknowingly build the app using poisoned XCode. That way, when Mr. Bad Guy eventually installs Tinder For Dogs on his iPhone, the CIA gets a secret backdoor to his entire phone.

But this seems so overly complicated! If the CIA already has a payload that phones home, why didn't they just build their own apps? Why rely on poisoning a dev environment in the vague hope that Mr. Bad Guy will someday download this particular app? What if Mr. Bad Guy doesn't even have a dog?

Also, I wrote above that an intelligence agency would not likely be interested in getting data from something like a single-player game. There's probably nothing useful to learn about there, other than Mr. Bad Guy's high score.

But maybe that dumb game was the Trojan, not the target. Mr. Bad Guy may be too smart to use SnapChat, but perhaps he installed FarmVille or Angry Birds to while away the hours...?

They'll probably attempt to install the bugged XCode at TextSecure, WhatsApp, etc. That way, people are happily using an app from a well known vendor (not CIA Games Company, Inc.) while still being surveilled.

Theoretically speaking, if you were building an PhoneGap/Cordova app binary using a compromised seed of Xcode it would be no different than building a non-PhoneGap/Cordova based iOS app.

So I'm not sure why you are referencing Facebook switching from a WebView-based app to a more native approach.

In addition, if the Xcode installation was compromised nothing should be considered safe on that device going forward.

I was joking about the longstanding native app versus non-native app debate, but thank you for the info. But perhaps if the crucial part of XCode that "phoned home" was not the WebView component but some other component, might that make a difference?

Of course this is all very hypothetical unless someone finds an example in the wild.

They said they created a poisoned version of XCode, not that they were able to serve it up successfully to anyone.

True, but Snowden's data haul is at least a year and a half old by now, and some of the files cited in this article date back longer than that.

But I edited my comment to include your point: no hard proof that this technique was used...yet.

But they sure can serve it successfully. They control the cables through which everyone's internet traffic passes, and when you download a program (such as Xcode) they can substitute it with their poisoned program [1].

I'll quote:

> All it takes is a single request from a victim passing a wiretap for exploitation to occur. Once the QUANTUM wiretap identifies the victim, it simply packet injects a 302 redirect to a FOXACID server. Now the victim’s browser starts talking to the FOXACID server, which quickly takes over the victim’s computer.

... or doesn't take over the victim's computer, but provides a download of a poisoned Xcode.

These motherfuckers have compromised the whole internet.

[1]: http://www.wired.com/2013/11/this-is-how-the-internet-backbo...

Test aspa

Reply on news.ycombinator.com