Pierluigi Paganini March 10, 2015

A new interesting report published by The Intercept details the effort spent by the US intelligence to compromise the security of Apple devices.

The Intercept published another disconcerting post on the US Intelligence campaign aimed to steal the secrets of the IT giant Apple. According to top-secret documents disclosed by The Intercept a team of researchers working with the Central Intelligence Agency (CIA) has conducted a multi-year espionage campaign to break overwhelm the security mechanisms implemented by Apple for its mobile devices, iPhones and iPads. The effort is aligned with the secret U.S. government program to analyze “secure communications products, both foreign and domestic” in order to “develop exploitation capabilities against the authentication and encryption schemes,” according to the 2013 Congressional Budget Justification “Black Budget.”

The Intercept revealed the “Analysis of Target Systems Project” that was conducted to produce “prototype capabilities” for the intelligence community, enabled “the defeat of strong commercial data security systems” and developed ways “to exploit emerging information systems and technologies”. The project received $35 million in funding in 2012, among the project’s missions:

• Analyze “secure communications products, both foreign and domestic produced” to “develop exploitation capabilities against the authentication and encryption schemes.”
• “[D]evelop exploitation capabilities against network communications protocols and commercial network security products.”
• “Anticipate future encryption technologies” and “prepare strategies to exploit those technologies.”
• “Develop, enhance, and implement software attacks against encrypted signals.”
• “Develop exploitation capabilities against specific key management and authentication schemes.”
• “[D]evelop exploitation capabilities against emerging multimedia applications.”
• Provide tools for “exploiting” devices used to “store, manage, protect, or communicate data.”

The documents reveal that the experts presented the results of their effort at a secret annual gathering, called the “Jamboree,” where attendees discussed methods for exploiting security vulnerabilities in household and commercial electronics.

“THE DOCUMENTS do not address how successful the targeting of Apple’s encryption mechanisms have been, nor do they provide any detail about the specific use of such exploits by U.S. intelligence. But they do shed light on an ongoing campaign aimed at defeating the tech giant’s efforts to secure its products, and in turn, its customers’ private data.” states The Intercept.

The Jamboree was held at a Lockheed Martin facility in northern Virginia, the choice of the site is not surprising if we consider the strict relationship of the company with the US Government, more than 80 percent of its total revenue comes from the government of Washington.

Of course the CIA declined to comment the information disclosed by the news agency.

Jamboree conference is an annual appointment for the US Intelligence where the researchers presented the hacking techniques they developed to compromise security of a wide range of devices, including Apple systems.

“By targeting essential security keys used to encrypt data stored on Apple’s devices, the researchers have sought to thwart the company’s attempts to provide mobile security to hundreds of millions of Apple customers across the globe. Studying both “physical” and “non-invasive” techniques, U.S. government-sponsored research has been aimed at discovering ways to decrypt and ultimately penetrate Apple’s encrypted firmware. This could enable spies to plant malicious code on Apple devices and seek out potential vulnerabilities in other parts of the iPhone and iPad currently masked by encryption.” continues The Intercept.

Among the several methods presented by the researchers there is a modified version of Apple software development tool, Xcode, which could be used to insert “surveillance backdoor” into any apps developed with it.

“The modified version of Xcode, the researchers claimed, could enable spies to steal passwords and grab messages on infected devices. Researchers also claimed the modified Xcode could “force all iOS applications to send embedded data to a listening post.” It remains unclear how intelligence agencies would get developers to use the poisoned version of Xcode.”

Again, the experts succeeded in the modification of the OS X updater to deliver “keylogger” software. The experts working for the CIA have targeted also other platforms and application, for example the Microsoft’s BitLocker encryption system.

The US law enforcement recently confirmed their concerns related to the encryption introduced by Google and Apple on their devices, in September 2014 FBI Director James Comey declared that he was “very concerned” about the decision of the IT giants to implement data encryption by default on their Smartphones.

US and British intelligence agencies worked closely to break encryption and other defense mechanisms implemented by Apple to protect its devices. In 2010, hackers from the sgencied developed surveillance software targeting iPhones, Android devices and Nokia’s Symbian phones, documents leaked by Snowden revealed the existence of an implantable malware on iPhones as part of WARRIOR PRIDE, a GCHQ framework for secretly accessing private communications on mobile devices.

“A WARRIOR PRIDE plugin called NOSEY SMURF allowed spies to remotely and secretly activate a phone’s microphone. Another plugin, DREAMY SMURF, allowed intelligence agents to manage the power system on a phone and thus avoid detection. PARANOID SMURF was designed to conceal the malware in other ways. TRACKER SMURF allowed ultra-precise geolocating of an individual phone. “[If] its [sic] on the phone, we can get it,” the spies boasted in a secret GCHQ document describing the targeting of the iPhone.” continues The Intercept.

Early 2014, the Der Spiegel magazine published a post describing how the US National Security Agency is able to control every data managed by iPhone through a spyware codenamed DROPOUTJEEP developed by ANT (Advanced or Access Network Technology).

I’m not surprised by the effort spent by Intelligence agencies in order to break security of major IT vendors, however, we must consider that this kind of activities could advantage foreign governments and cyber espionage operation. By inserting a backdoor is a commercial product means to expose its final users to a series of attacks, also operated by foreign hackers … are we ready to defeat them?

Enjoy the report!

Pierluigi Paganini

(Security Affairs –  Apple, iphone, NSA)