Connect with us

Biz & IT

Apple’s increasingly tricky international trade-offs

Published

on

Far from Apple’s troubles in emerging markets and China, the company is attracting the ire of what should really be a core supporter demographic naturally aligned with the pro-privacy stance CEO Tim Cook has made into his public soapbox in recent years — but which is instead crying foul over perceived hypocrisy.

The problem for this subset of otherwise loyal European iPhone users is that Apple isn’t offering enough privacy.

These users want more choice over key elements such as the search engine that can be set as the default in Safari on iOS (Apple currently offers four choices: Google, Yahoo, Bing and DuckDuckGo, all U.S. search engines; and with ad tech giant Google set as the default).

It is also being called out over other default settings that undermine its claims to follow a privacy by design philosophy. Such as the iOS location services setting which, once enabled, non-transparently flip an associated sub-menu of settings — including location-based Apple ads. Yet bundled consent is never the same as informed consent…

As the saying goes you can’t please all of the people all of the time. But the new normal of a saturated smartphone market is imposing new pressures that will require a reconfiguration of approach.

Certainly the challenges of revenue growth and user retention are only going to step up from here on in. So keeping an otherwise loyal base of users happy and — crucially — feeling listened to and well served is going to be more and more important for the tech giant as the back and forth business of services becomes, well, essential to its fortunes going forward.

(At least barring some miracle new piece of Apple hardware — yet to be unboxed but which somehow rekindles smartphone-level demand afresh. That’s highly unlikely in any medium term timeframe given how versatile and capable the smartphone remains; ergo Apple’s greatest success is now Apple’s biggest challenge.)

With smartphone hardware replacement cycles slowing, the pressure on Cook to accelerate services revenue naturally steps up — which could in turn increase pressure on the core principles Cupertino likes to flash around.

Yet without principles there can be no brand premium for Apple to command. So that way ruin absolutely lies.

Control shift

It’s true that controlling the iOS experience by applying certain limits to deliver mainstream consumer friendly hardware served Apple well for years. But it’s also true iOS has grown in complexity over time having dropped some of its control freakery.

Elements that were previously locked down have been opened up — like the keyboard, for instance, allowing for third party keyboard apps to be installed by users that wish to rethink how they type.

This shift means the imposed limit on which search engines users can choose to set as an iOS default looks increasingly hard for Apple to justify from a user experience point of view.

Though of course from a business PoV Apple benefits by being able to charge Google a large sum of money to remain in the plum search default spot. (Reportedly a very large sum, though claims that the 2018 figure was $9BN have not been confirmed. Unsurprisingly neither party wants to talk about the terms of the transaction.)

The problem for Apple is that indirectly benefiting from Google eroding the user privacy it claims to champion — by letting the ad tech giant pay it to suck up iOS users’ search queries by default — is hardly consistent messaging.

Not when privacy is increasingly central to the premium the Apple brand commands.

Cook has also made a point of strongly and publicly attacking the ‘data industrial complex‘. Yet without mentioning the inconvenient side-note that Apple also engages in trading user data for profit in some instances, albeit indirectly.

In 2017 Apple switched from using Bing to Google for Siri web search results. So even as it has stepped up its rhetoric around user privacy it has deepened its business relationship with one of the Western Internet’s primary data suckers.

All of which makes for a very easy charge of hypocrisy.

Of course Apple offers iOS users a non-tracking search engine choice, DuckDuckGo, as an alternative choice — and has done so since 2014’s iOS 8.

Its support for a growing but still very niche product in what are mainstream consumer devices is an example of Apple being true to its word and actively championing privacy.

The presence of the DDG startup alongside three data-mining tech giants has allowed those ‘in the know’ iOS users to flip the bird at Google for years, meaning Apple has kept privacy conscious consumers buying its products (if not fully on side with all its business choices).

But that sort of compromise position looks increasingly difficult for Apple to defend.

Not if it wants privacy to be the clear blue water that differentiates its brand in an era of increasingly cut-throat and cut-price Android -powered smartphone competition that’s serving up much the same features at a lower up-front price thanks to all the embedded data-suckers.

There is also the not-so-small matter of the inflating $1,000+ price-tags on Apple’s top-of-the-range iPhones. $1,000+ for a smartphone that isn’t selling your data by default might still sound very pricy but at least you’d be getting something more than just shiny glass for all those extra dollars. But the iPhone isn’t actually that phone. Not by default.

Apple may be taking a view that the most privacy sensitive iPhone users are effectively a captive market with little option but to buy iOS hardware, given the Google-flavored Android competition. Which is true but also wouldn’t bode well for the chances of Apple upselling more services to these people to drive replacement revenue in a saturated smartphone market.

Offending those consumers who otherwise could be your very best, most committed and bought in users seems short-sighted and short-termist to say the least.

Although removing Google as the default search provider in markets where it dominates would obviously go massively against the mainstream grain that Apple’s business exists to serve.

This logic says Google is in the default position because, for most Internet users, Google search remains their default.

Indeed, Cook rolled out this exact line late last year when asked to defend the arrangement in an interview with Axios on HBO — saying: “I think their search engine is the best.”

He also flagged various pro-privacy features Apple has baked into its software in recent years, such as private browsing mode and smart tracker prevention, which he said work against the data suckers.

Albeit, that’s a bit like saying you’ve scattered a few garlic cloves around the house after inviting the thirsty vampire inside. And Cook readily admitted the arrangement isn’t “perfect”.

Clearly it’s a trade off. But Apple benefitting financially is what makes this particular trade-off whiff.

It implies Apple does indeed have an eye on quarterly balance sheets, and the increasingly important services line item specifically, in continuing this imperfect but lucrative arrangement — rather than taking a longer term view as the company purports to, per Cook’s letter to shareholders this week; in which he wrote: “We manage Apple for the long term, and Apple has always used periods of adversity to re-examine our approach, to take advantage of our culture of flexibility, adaptability and creativity, and to emerge better as a result.”

If Google’s search product is the best and Apple wants to take the moral high ground over privacy by decrying the surveillance industrial complex it could maintain the default arrangement in service to its mainstream base but donate Google’s billions to consumer and digital rights groups that fight to uphold and strengthen the privacy laws that people-profiling ad tech giants are butting hard against.

Apple’s shareholders might not like that medicine, though.

More palatable for investors would be for Apple to offer a broader choice of alternative search engines, thereby widening the playing field and opening up to more pro-privacy Google alternatives.

It could also design this choice in a way that flags up the trade-off to its millions of users. Such as, during device set-up, proactively asking users whether they want to keep their Internet searches private by default or use Google?

When put like that rather more people than you imagine might choose not to opt for Google to be their search default.

Non-tracking search engine DDG has been growing steadily for years, for example, hitting 30M daily searches last fall — with year-on-year growth of ~50%.

Given the terms of the Apple-Google arrangement sit under an NDA (as indeed all these arrangements do; DDG told us it couldn’t share any details about its own arrangement with Apple, for e.g.) it’s not clear whether one of Google’s conditions requires there be a limit on how many other search engines iOS users can pick from.

But it’s at least a possibility that Google is paying Apple to limit how many rivals sit in the list of competitors iOS users can pick out an alternative default. (It has, after all, recently been spanked in Europe for anti-competitive contractual limits imposed on Android OEMs to limit their ability to use alternatives to Google products, including search. So you could say Google has history where search is concerned.)

Equally, should Google actually relaunch a search product in China — as it’s controversially been toying with doing — it’s likely the company would push Apple to give it the default slot there too.

Though Apple would have more reason to push back, given Google would likely remain a minnow in that market. (Apple currently defaults to local search giant Baidu for iOS users in China.)

So even the current picture around search on iOS is a little more fuzzy than Cook likes to make out.

Local flavor

China is an interesting case, because if you look at Apple’s growth challenges in that market you could come to a very different conclusion vis-a-vis the power of privacy as a brand premium.

In China it’s convenience, via the do-it-all ‘Swiss army knife’ WeChat platform, that’s apparently the driving consumer force — and now also a headwind for Apple’s business there.

At the same time, the idea of users in the market having any kind of privacy online — when Internet surveillance has been imposed and ‘normalized’ by the state — is essentially impossible to imagine.

Yet Apple continues doing business in China, netting it further charges of hypocrisy.

Its revised guidance this week merely spotlights how important China and emerging markets are to its business fortunes. A principled pull-out hardly looks to be on the cards.

All of which underscores growing emerging market pressures on Apple that might push harder against its stated principles. What price privacy indeed?

It’s clear that carving out growth in a saturated smartphone market is going to be an increasingly tricky business for all players, with the risk of fresh trade-offs and pitfalls looming especially for Apple.

Negotiating this terrain certainly demands a fresh approach, as Cook implies is on his mind, per the shareholder letter.

Arguably the new normal may also call for an increasingly localized approach as a way to differentiate in a saturated and samey smartphone market.

The old Apple ‘one-sized fits all’ philosophy is already very outdated for some users and risks being caught flat-footed on a growing number of fronts — be that if your measure is software ‘innovation’ or a principled position on privacy.

An arbitrary limit on the choice of search engine your users can pick seems a telling example. Why not offer iOS users a free choice?

Or are Google’s billions really standing in the way of that?

It’s certainly an odd situation that iPhone owners in France, say, can pick from a wide range of keyboard apps — from mainstream names to superficial bling-focused glitter and/or neon LED keyboard skins or indeed emoji and GIF-obsessed keyboards — but if they want to use locally developed pro-privacy search engine Qwant on their phone’s native browser they have to tediously surf to the company’s webpage every time they want to look something up.

Google search might be the best for a median average ‘global’ (excluding China) iOS user but in an age of increasingly self-focused and self-centred technology, with ever more demanding consumers, there’s really no argument against letting people who want to choose for themselves.

In Europe there’s also the updated data protection framework, GDPR, to consider. Which may yet rework some mainstream ad tech business models.

On this front Qwant questions how even non-tracking rival DDG can protect users’ searches from government surveillance given its use of AWS cloud hosting and the U.S. Cloud Act. (Though, responding to a discussion thread about the issue on Github two years ago, DDG’s founder noted it has servers around the world, writing: “If you are in Europe you will be connected to our European servers.” He also reiterated that DDG does not collect any personal data from users — thereby limiting what could be extracted from AWS via the Act.)

Asked what reception it’s had when asking about getting its search engine on the Safari iOS list, Qwant told us the line that’s been (indirectly) fed back to it is “we are too European according to Apple”. (Apple declined to comment on the search choices it offers iOS users.)

“I have to work a lot to be more American,” Qwant co-founder and CEO Eric Leandri told us, summing up the smoke signals coming out of Cupertino.

“I understand that Apple wants to give the same kind of experience to their customers… but I would say that if I was Apple now, based on the politics that I want to follow — about protecting the privacy of customers — I think it would be great to start thinking about Europe as a market where people have a different point of view on their data,” he continued.

“Apple has done a lot of work to, for example, not let applications give data to each by a very strict [anti-tracking policy]; Apple has done a lot of work to guarantee that cookies and tracking is super difficult on iOS; and now the last problem of Apple is Google search.”

“So I hope that Apple will look at our proposal in a different way — not just one-fits-all. Because we don’t think that one-fits-all today,” he added.

Qwant too, then, is hoping for a better Apple to emerge as a result of a little market adversity.

Source link



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Biz & IT

3 iOS 0-days, a cellular network compromise, and HTTP used to infect an iPhone

Published

on

Getty Images

Apple has patched a potent chain of iOS zero-days that were used to infect the iPhone of an Egyptian presidential candidate with sophisticated spyware developed by a commercial exploit seller, Google and researchers from Citizen Lab said Friday.

The previously unknown vulnerabilities, which Apple patched on Thursday, were exploited in clickless attacks, meaning they didn’t require a target to take any steps other than to visit a website that used the HTTP protocol rather than the safer HTTPS alternative. A packet inspection device sitting on a cellular network in Egypt kept an eye out for connections from the phone of the targeted candidate and, when spotted, redirected it to a site that delivered the exploit chain, according to Citizen Lab, a research group at the University of Toronto’s Munk School.

A cast of villains, 3 0-days, and a compromised cell network

Citizen Lab said the attack was made possible by participation from the Egyptian government, spyware known as Predator sold by a company known as Cytrox, and hardware sold by Egypt-based Sandvine. The campaign targeted Ahmed Eltantawy, a former member of the Egyptian Parliament who announced he was running for president in March. Citizen Lab said the recent attacks were at least the third time Eltantawy’s iPhone has been attacked. One of them, in 2021, was successful and also installed Predator.

“The use of mercenary spyware to target a senior member of a country’s democratic opposition after they had announced their intention to run for president is a clear interference in free and fair elections and violates the rights to freedom of expression, assembly, and privacy,” Citizen Lab researchers Bill Marczak, John Scott-Railton, Daniel Roethlisberger, Bahr Abdul Razzak, Siena Anstis, and Ron Deibert wrote in a 4,200-word report. “It also directly contradicts how mercenary spyware firms publicly justify their sales.”

The vulnerabilities, which are patched in iOS versions 16.7 and iOS 17.0.1, are tracked as:

  • CVE-2023-41993: Initial remote code execution in Safari
  • CVE-2023-41991: PAC bypass
  • CVE-2023-41992: Local privilege escalation in the XNU Kernel

According to research published Friday by members of Google’s Threat Analysis Group, the attackers who exploited the iOS vulnerabilities also had a separate exploit for installing the same Predator spyware on Android devices. Google patched the flaws on September 5 after receiving a report by a research group calling itself DarkNavy.

“TAG observed these exploits delivered in two different ways: the MITM injection and via one-time links sent directly to the target,” Maddie Stone, a researcher with the Google Threat Analysis Group wrote. “We were only able to obtain the initial renderer remote code execution vulnerability for Chrome, which was exploiting CVE-2023-4762.”

The attack was complex. Besides leveraging three separate iOS vulnerabilities, it also relied on hardware made by a manufacturer known as Sandvine. Sold under the brand umbrella PacketLogic, the hardware sat on the cellular network the targeted iPhone accessed and monitored traffic passing over it for his phone. Despite the precision, Citizen Lab said that the attack is blocked when users turn on a feature known as Lockdown, which Apple added to iOS last year. More about that later.

There’s little information about the iOS exploit chain other than it automatically triggered when a target visited a site hosting the malicious code. Once there, the exploits installed Predator with no further user action required.

To surreptitiously direct the iPhone to the attack site, it only needed to visit any HTTP site. Over the past five years or so, HTTPS has become the dominant means of connecting to websites because the encryption it uses prevents adversary-in-the-middle attackers from monitoring or manipulating data sent between the site and the visitor. HTTP sites still exist, and sometimes HTTPS connections can be downgraded to unencrypted HTTP ones.

Once Eltantawy visited an HTTP site, the PacketLogic device injected data into the traffic that surreptitiously connected the Apple device to a site that triggered the exploit chain.

Network diagram showing the Spyware Injection Middlebox located on a link between Telecom Egypt and Vodafone Egypt.
Enlarge / Network diagram showing the Spyware Injection Middlebox located on a link between Telecom Egypt and Vodafone Egypt.

Predator, the payload installed in the attack, is sold to a wide array of governments, including those of Armenia, Egypt, Greece, Indonesia, Madagascar, Oman, Saudi Arabia, and Serbia. Citizen Lab has said that Predator was used to target Ayman Nour, a member of the Egyptian political opposition living in exile in Turkey, and an Egyptian exiled journalist who hosts a popular news program and wishes to remain anonymous. Last year researchers from Cisco’s Talo security team exposed the inner workings of the malware after obtaining a binary of it.

Continue Reading

Biz & IT

Incomplete disclosures by Apple and Google create “huge blindspot” for 0-day hunters

Published

on

Getty Images

Incomplete information included in recent disclosures by Apple and Google reporting critical zero-day vulnerabilities under active exploitation in their products has created a “huge blindspot” that’s causing a large number of offerings from other developers to go unpatched, researchers said Thursday.

Two weeks ago, Apple reported that threat actors were actively exploiting a critical vulnerability in iOS so they could install espionage spyware known as Pegasus. The attacks used a zero-click method, meaning they required no interaction on the part of targets. Simply receiving a call or text on an iPhone was enough to become infected by the Pegasus, which is among the world’s most advanced pieces of known malware.

“Huge blindspot”

Apple said the vulnerability, tracked as CVE-2023-41064, stemmed from a buffer overflow bug in ImageIO, a proprietary framework that allows applications to read and write most image file formats, which include one known as WebP. Apple credited the discovery of the zero-day to Citizen Lab, a research group at the University of Toronto’s Munk School that follows attacks by nation-states targeting dissidents and other at-risk groups.

Four days later, Google reported a critical vulnerability in its Chrome browser. The company said the vulnerability was what’s known as a heap buffer overflow that was present in WebP. Google went on to warn that an exploit for the vulnerability existed in the wild. Google said that the vulnerability, designated as CVE-2023-4863, was reported by the Apple Security Engineering and Architecture team and Citizen Lab.

Speculation, including from me, quickly arose that a large number of similarities strongly suggested that the underlying bug for both vulnerabilities was the same. On Thursday, researchers from security firm Rezillion published evidence that they said made it “highly likely” both indeed stemmed from the same bug, specifically in libwebp, the code library that apps, operating systems, and other code libraries incorporate to process WebP images.

Rather than Apple, Google, and Citizen Lab coordinating and accurately reporting the common origin of the vulnerability, they chose to use a separate CVE designation, the researchers said. The researchers concluded that “millions of different applications” would remain vulnerable until they, too, incorporated the libwebp fix. That, in turn, they said, was preventing automated systems developers use to track known vulnerabilities in their offerings from detecting a critical vulnerability that’s under active exploitation.

“Since the vulnerability is scoped under the overarching product containing the vulnerable dependency, the vulnerability will only be flagged by vulnerability scanners for these specific products,” Rezillion researchers Ofri Ouzan and Yotam Perkal wrote. “This creates a HUGE blindspot for organizations blindly relying on the output of their vulnerability scanner.”

Google has further come under criticism for limiting the scope of CVE-2023-4863 to Chrome rather than in libwebp. Further, the official description describes the vulnerability as a heap buffer overflow in WebP in Google Chrome.

In an email, a Google representative wrote: “Many platforms implement WebP differently. We do not have any details about how the bug impacts other products. Our focus was getting a fix out to the Chromium community and affected Chromium users as soon as possible. It is best practice for software products to track upstream libraries they depend on in order to pick up security fixes and improvements.”

The representative noted that the WebP image format is mentioned in its disclosure and the official CVE page. The representative didn’t explain why the official CVE and Google’s disclosure did not mention the widely used libwebp library or the likelihood that other software was also likely to be vulnerable.

The Google representative didn’t answer a question asking if CVE-2023-4863 and CVE-2023-41064 stemmed from the same vulnerability. Citizen Lab and Apple didn’t respond to emailed questions before this story went live.

Continue Reading

Biz & IT

Signal preps its encryption engine for the quantum doomsday inevitability

Published

on

Getty Images

The Signal Foundation, maker of the Signal Protocol that encrypts messages sent by more than a billion people, has rolled out an update designed to prepare for a very real prospect that’s never far from the thoughts of just about every security engineer on the planet: the catastrophic fall of cryptographic protocols that secure some of the most sensitive secrets today.

The Signal Protocol is a key ingredient in the Signal, Google RCS, and WhatsApp messengers, which collectively have more than 1 billion users. It’s the engine that provides end-to-end encryption, meaning messages encrypted with the apps can be decrypted only by the recipients and no one else, including the platforms enabling the service. Until now, the Signal Protocol encrypted messages and voice calls with X3DH, a specification based on a form of cryptography known as Elliptic Curve Diffie-Hellman.

A brief detour: WTF is ECDH?

Often abbreviated as ECDH, Elliptic Curve Diffie-Hellman is a protocol unto its own. It combines two main building blocks. The first part involves the use of elliptic curves to form asymmetric key pairs, each of which is unique to each user. One key in the pair is public and available to anyone to use for encrypting messages sent to the person who owns it. The corresponding private key is closely guarded by the user. It allows the user to decrypt the messages. Cryptography relying on a public-private key pair is often known as asymmetric encryption.

The security of asymmetric encryption is based on mathematical one-way functions. Also known as trapdoor functions, these problems are easy to compute in one direction and substantially harder to compute in reverse. In elliptic curve cryptography, this one-way function is based on the Discrete Logarithm problem in mathematics. The key parameters are based on specific points in an elliptic curve, which is defined as the field of integers modulo prime P.

When someone knows the starting point (A) in the above image showing an elliptic curve and the number of hops required to get to the endpoint (E), it’s easy to know where (E) is. But when all someone knows is the starting and end points, it’s next to impossible to deduce how many hops are required.

As explained in an Ars article from 2013:

Let’s imagine this curve as the setting for a bizarre game of billiards. Take any two points on the curve and draw a line through them; the line will intersect the curve at exactly one more place. In this game of billiards, you take a ball at point A and shoot it toward point B. When it hits the curve, the ball bounces either straight up (if it’s below the x-axis) or straight down (if it’s above the x-axis) to the other side of the curve.

We can call this billiards move on two points “dot.” Any two points on a curve can be dotted together to get a new point.

A dot B = C

We can also string moves together to “dot” a point with itself over and over.

A dot A = B

A dot B = C

A dot C = D

It turns out that if you have two points, an initial point “dotted” with itself n times to arrive at a final point, finding out n when you only know the final point and the first point is hard. To continue our bizarro billiards metaphor, imagine that one person plays our game alone in a room for a random period of time. It is easy for him to hit the ball over and over following the rules described above. If someone walks into the room later and sees where the ball has ended up, even if they know all the rules of the game and where the ball started, they cannot determine the number of times the ball was struck to get there without running through the whole game again until the ball gets to the same point. Easy to do, hard to undo. This is the basis for a very good trapdoor function.

Continue Reading

Trending