Apple's Tim Cook attacks Google and Facebook over privacy flaws

Apple chief executive Tim Cook has fired a new salvo against Google and Facebook, emphasising in an open letter to customers that Apple doesn’t build profiles of its users from their email content or web browsing habits “to sell to advertisers”.

While not mentioning either of its two main rivals, Cook’s letter marks a clear effort by Apple to play on rising concerns around privacy and the use made of peoples’ personal data.

“Our business model is very straightforward: we sell great products,” Cook writes. “We don’t build a profile based on your email content or web browsing habits to sell to advertisers. We don’t ‘monetise’ the information you store on your iPhone or in iCloud. And we don’t read your email or your messages to get information to market to you.”

He says Apple’s iAd system, used by some developers to monetise ads, and to provide adverts in the free US-based iTunes Radio service, “sticks to the same privacy policy that applies to every other Apple product. It doesn’t get data from Health and HomeKit, Maps, Siri, iMessage, your call history, or any iCloud service like Contacts or Mail, and you can always just opt out altogether.”

Cook’s letter comes as Facebook has launched a low-key campaign to reassure users about privacy, following controversy about the access demanded to users’ phones by its Facebook Messenger app, which the social network’s users employ to send private messages.

The social network has also had to fend off criticism after it revealed that it had tweaked some users’ news feeds as part of an experiment to see if their emotions were affected.

Google meanwhile is still being investigated in Europe by privacy commissioners from a number of countries over the changes that it made in 2012 to its privacy policy, in which it unified information about how individuals used its different products, such as search, mail and the YouTube video service.

Security experts meanwhile welcomed a statement from Apple in which it said that it will no longer hold encryption keys for customers’ devices running its new iOS 8 software, meaning that it will be unable to decrypt them for governments or law enforcement - even if demanded to.

Chris Soghoian, principal technologist at the American Civil Liberties Union (ACLU), commented that “The public has said they want companies to put their privacy first, and Apple has listened.” He called on Google to match Apple’s lead in end-to-end security for user messages in its built-in messaging product iMessage and FaceTime video calling service.

“Google has 300+ people on their security team, some of the best in the industry. Google could make amazing, surveillance-resistant products,” he commented. “Google should be called out for failing to deliver secure IM [instant messaging]. It isn’t that hard.”

Responding to Heather Adkins, a Google security team member who replied that “I chat securely on Google’s [Android] platform every day”, Soghoian responded: “I carry two smartphones. My iPhone sends end-to-end encrypted IMs by default. My Android device doesn’t.”

The Android platform, Soghoian said, has no device encryption by default, “rarely” gets security updates, and has no end-to-end encrypted IM or video chat facility.

Apple’s declaration that it will be unable to help government agencies in any country decrypt devices applies only to those running iOS 8. There are an estimated 500m iOS devices in use worldwide, and iOS 8 is available as a free update for every device since the iPad 2, released in April 2011.

Some analysts have wondered whether the delay in sales approval for the iPhone 6 and iPhone 6 Plus in China is due to this element of the operating system, which comes as part of the phones. Apple was previously required to move some servers to China to conform to government regulations there about the storage of nationals’ data - though Apple says it encrypts data on its servers and does not hold a key for them.

The extra encryption protection measures on iOS 8 will also apply to iCloud backups - which are believed to have been the source of intimate pictures of celebrities that were spread online earlier this month from the 4chan and reddit discussion boards.

Normally, Apple devices and iCloud backups are encrypted by default using a four-digit passcode on setup, though the user can subsequently change that for a longer one. Apple says that attempts at a brute-force cracking of the passcode are resisted by an “iteration count” to slow down repeated attempts.

However even with those measures a four-digit passcode can be cracked in less than seven minutes, according to one security researcher’s calculations. A six-character passcode with letters and numbers would take more than five years to crack through brute force methods, Apple says.

Security advisers suggest changing from the four-digit passcode to a more complex one to guard against brute force attacks, and Apple says users should turn on “two-factor authentication”, which would provide notification when a backup was downloaded.

Cook says that “I want to be absolutely clear that we have never worked with any government agency from any country to create a backdoor in any of our products or services. We have also never allowed access to our servers. And we never will.” That does not however preclude the possibility that Apple hands over specific account data under the US’s secret FISA court orders.

Google has repeatedly and vehemently denied that any government has had access to its servers.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.

Shellshock just 'a blip' says Richard Stallman as Bash bug attacks increase

First it was Heartbleed, now it’s Shellshock. Two vulnerabilities affecting many of the planet’s web users have hit widely deployed free and open source software in a matter of months.

Heartbleed brought about distrust in OpenSSL, which was designed to make websites more secure but instead opened them up to attack.

Earlier this week, Shellshock landed, allowing hackers to easily exploit many web servers that used the free and open source Bash command line shell, managed by the GNU Project.

Malicious types are now trying to exploit the flaw en masse as attempts to close off the vulnerability have failed and critics have called for greater controls over open source software, though GNU Project founder Richard Stallman told the Guardian that Shellshock will soon be deemed by the world as only “a blip”.

Bash exploits have thus far tried to place at least two different kinds of malware on vulnerable web servers, both of which seem to be creating armies of bots for future Distributed Denial of Service attacks, which typically flood website networks with traffic to take them offline, security experts have warned.

As many as 715 users, most likely victims, connected to a server controlling one of the malware variants, noted Jaime Blasco, director of AlienVault Labs. Romanian cybercriminals appear to be in control of that server, he added.

There are indications Shellshock is considerably more prevalent than initially predicted too. “Right now people are pretty much falling over themselves trying to come up with the craziest attack vector possible,” said security expert Andreas Lindh, who successfully exploited his own Buffalo Linkstation Network Attached Storage (NAS) device using the Bash bug.

The vulnerability was supposed to only affect those machines that ran Bash as their default command line interface, but mounting evidence has hinted even those using related interpreters could be exploited.

Lindh’s NAS ran Bash alternative Dash by default and a tweet from security researcher Dragos Ruiu appeared to back up Lindh’s early research. If derivatives of Bash are also vulnerable to Shellshock, this would widen the number of potential targets massively.

“We should probably not make big a fuss about that just yet, but if it turns out that some old Dash shells are also vulnerable, then consumer appliances will definitely be at risk,” Lindh added.

Bashing the Bash creator

Fingers have now pointed to the GNU Project, which spawned Bash. Critics have noted only one person has been given the job of maintaining and updating Bash, though all developers are invited to contribute to the code.

More controls are now needed to ensure future Heartbleeds and Shellshocks don’t send the world into a frenzy, they’ve argued.

“The open source fans all say that it is the best approach as anyone can check the code. Sadly it doesn’t happen like that it practice as it gets forgotten about (this problem could be 25 years old) and a lot of the older code is written in opaque languages like C, not to mention not being well structured,” said Professor Alan Woodward, security expert from the Department of Computing at the University of Surrey.

“It’s like trying to untangle 25-year-old spaghetti so not surprising it is never checked that often. These flaws are being found most often when someone notices an effect, not because they are trawling through the code.

“It is a problem and needs to be addressed or there will be more of these legacy issues come back to bite us.”

But Richard Stallman, founder of the GNU Project and the Free Software Foundation, disagrees. He believes that whilst Shellshock is evidently a big deal, like any vulnerability it will simply be a “blip” in the long-term.

Free software (don’t call it open source, there’s a difference, according to Stallman’s GNU crew) is still going to keep people safer than proprietary code, which comes with purposeful vulnerabilities, known as backdoors, he added.

“In the long term, this will be a blip, it’s patched, people will install. It will be one of thousands bugs that people will exploit,” Stallman told the Guardian. “When users control the program, they can add features and fix bugs.

“Any program can have a bug. But a proprietary program is likely to have intentional bugs, malicious functionality.”

He said the GNU Project always had just “barely enough” resources, but only because the more backing it received, the more it tried to do.

• What is the Shellshock bug? Is it worse than Heartbleed?

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.