Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Better Locks Than Back Doors: Why Apple Is Right About Encryption
Newest First  |  Oldest First  |  Threaded View
CoreyN293
CoreyN293,
User Rank: Apprentice
3/7/2016 | 8:02:51 PM
Re: John McAfee
BTW.. an update to my response that I thought McAfee's claims about hacking the iPhone 5c was all bluster... Turns out I was on to something... Anew article just came out where he said he lied about it to get more attention on the issue... I can't share the direct link, but you can find it on The Daily Dot, titled: 

John McAfee lied about San Bernardino shooter's iPhone hack to 'get a s**tload of public attention'

 


 

 
CoreyN293
CoreyN293,
User Rank: Apprentice
3/4/2016 | 5:28:30 PM
Re: John McAfee
I think it's all bluster... As another security expert already said, if McAfee really had someone that could crack the iPhone 5c, he'd actually use a real 5c and do a video proof-of-concept (PoC) on that phone to prove it. In other words, pics, or in this case, video or it didn't happen...

 

That said, sure it's theoretically possible that there is an vulnerability somewhere in iOS that a researcher finds one day, but until McAfee shows a PoC, I assume its all talk...
CoreyN293
CoreyN293,
User Rank: Apprentice
3/4/2016 | 5:24:24 PM
Re: Ends Don't Justify the Means
I actually think intelligence gathering attempts are proper in this case.

I honestly don't care about the privacy of a dead terrorist and murder... So I don't think there is anything wrong with the FBI having all the terrorist's stuff and trying to break into this phone... However, I do think asking an external third party to specifically break a security control and have to take the undue burdern of designing a special operating systems for this one case is too much...

I do care about the privacy of Apple's millions of other customers. So while the FBI does keep insisting this special firmware will only be for this one phone, I think this would set a precident for many others, which may not be as clear cut as this one terrorist case... Plus, it doesn't even discuss how much burden a private company needs to go under to support the authorities... If they do decrypt this one phone, and then authorities come to Apple with hundreds of other phone, next thing you know Apple is spending all time and money on something that is really not their business.. So besides just that fact that the existence of this technique makes everyone's phones less safe, we need to also consider the burden on a private business that had nothing to do with the attack.
RyanSepe
RyanSepe,
User Rank: Ninja
3/2/2016 | 8:20:15 AM
Ends Don't Justify the Means
I agree with you that in this case that the ends do not justify the means because they jeopardize the privacy of so many others. But when is intelligence gathering the proper course of action. The phone in question could harbor data that may lead to potential saving of lives, etc.
RyanSepe
RyanSepe,
User Rank: Ninja
3/2/2016 | 8:13:30 AM
John McAfee
Is there truth in that John McAfee interview around the ability of cracking into an iPhone. Logically what he is saying makes sense but I think he is over simplifying the process of cracking into the phone.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Incorporating a Prevention Mindset into Threat Detection and Response
Threat detection and response systems, by definition, are reactive because they have to wait for damage to be done before finding the attack. With a prevention-mindset, security teams can proactively anticipate the attacker's next move, rather than reacting to specific threats or trying to detect the latest techniques in real-time. The report covers areas enterprises should focus on: What positive response looks like. Improving security hygiene. Combining preventive actions with red team efforts.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-40317
PUBLISHED: 2022-05-26
Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.
CVE-2022-29720
PUBLISHED: 2022-05-26
74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php.
CVE-2022-29721
PUBLISHED: 2022-05-26
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.
CVE-2021-42859
PUBLISHED: 2022-05-26
A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service.
CVE-2021-42860
PUBLISHED: 2022-05-26
A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml_string_getc:2611.