6 ms·

Apple subpoenas Santander and US intelligence contractor on use of Corellium

66 points by willstrafach 7y ago

exabrial 7y ago
Apple is just mad someone is doing virtualization, a technology the refuse to embrace.
- colejohnson66 7y ago
  While they may not embrace virtualization, they certainly don’t stop people from doing it. If they wanted to, they could disable the Intel VMX instructions, but VM programs on macOS clearly show that they don’t. As for Hackintoshes, that’s just because Apple doesn’t have a financial incentive to write drivers for hardware that isn’t their own; They make money from the hardware, not software (macOS is actually free and has been for a few years). You’re free to buy compatible hardware or write your own drivers. In fact, many do write drivers for incompatible hardware; That’s how the Hackintosh hardware selection grows.
  - jayd16 7y ago
    The EULA states you're only allowed to run two OSX VMs on a machine already running OSX or to install OSX on a Apple hardware. It does not grant permission to install on custom hardware. If you can show me how I can legally run a virtualized OSX build farm please please tell me how. https://images.apple.com/legal/sla/docs/macosx107.pdf https://images.apple.com/legal/sla/docs/macosx107.pdf
    - colejohnson66 7y ago
      I never said it was legal or illegal; I said that they don’t stop people from doing it. For example, they don’t go: “oh, this is a Hackintosh? I’ll wipe your efivars so your computer won’t boot.”
    - youngtaff 7y ago
      Installing Apple's OS on non Apple hardware is at most a Breach of Contract which is very different from being illegal.
      - wyldfire 7y ago
        While it's not criminal, infringement or breach of contract does create an opportunity for Apple to bring suit and have discovery.
  - Flockster 7y ago
    You seem to be talking about macOS. The Corellium case is about virtual iOS instances.
- sigjuice 7y ago
  Apple does virtualization. They include a hypervisor in macOS. https://developer.apple.com/documentation/hypervisor https://developer.apple.com/documentation/hypervisor
lolc 7y ago
A lot of interesting stuff may become public from this. 1. Is Apple scared that backdoors will be found in Ios? It's much easier to find them in a virtual environment. 2. As the article mentions, there may be zerodays for Ios developed by Corellium. It would be great to know the extent of this. 3. We might learn more about current phone cracking capabilites in general. That may open a few eyes, including mine. I'm currently just very happy to have learned that people are poking at Apple's walled garden. Watching from the sidelines, I will appreciate any and all punches in this conflict. When secretive organizations battle in court, collateral exposure may happen :-)
- NotSammyHagar 7y ago
  It should be guaranteed at this point that there are zero days in both main cellphone platforms, apparently an endless number. They keep coming out, there is so much value in them commercially. I want to push a view and wish it was more widespread in the software world that finding zero days and not reporting them responsibly (like time to fix by the vendor before publication) is unacceptable. The second part of this view is that it is immoral to work at a company where you find zero days and exploit them. Working at the companies that find these and end up selling them to dictatorial regimes, secret police, as well as to the Harvey Weinstein's of the world is wrong. As a software engineer in a western country I'm fortunate to have some choice in my employers, as many of us do. My choices have some reflection on my character - and like everyone else, I'm hardly perfect myself. There are legal and illegal activities, and companies hide behind "we only sell to countries where it's legal". It's still immoral and wrong, and I don't want to work with immoral developers. Doing this kind of stuff is not the ultimate scarlet letter - but if you are working this field, please consider the impact of your actions.
  - _bxg1 7y ago
    Is this really a minority view? I got the sense that most people in tech feel this way
- threeseed 7y ago
  You seem to have a very flippant attitude on this. Backdoors in Android and iOS costs lives. There are many governments who today kidnap, torture and kill citizens and even non-citizens based on compromised phones e.g. Jamal Khashoggi. And to have companies like Correlium enabling and profiting from this is utterly reprehensible. They aren't altruistic or making the world safer or being selective in who they sell their technology. They are simply the modern day equivalent of a shady arms dealer.
roseway4 7y ago
> In his own words, as filed with the court, Federighi said: “On Saturday February 8, 2020, a process server was outside of my home. He came to my front door and attempted to serve a subpoena to me, but my wife turned him away.” That's not harassment. It's due process.
- Keverw 7y ago
  Wonder if it's normal to serve people at their homes instead of at the office? But sounds pretty standard stuff otherwise if you have to serve them.

66 points by willstrafach 7y ago

exabrial 7y ago

Apple is just mad someone is doing virtualization, a technology the refuse to embrace.

colejohnson66 7y ago
While they may not embrace virtualization, they certainly don’t stop people from doing it. If they wanted to, they could disable the Intel VMX instructions, but VM programs on macOS clearly show that they don’t. As for Hackintoshes, that’s just because Apple doesn’t have a financial incentive to write drivers for hardware that isn’t their own; They make money from the hardware, not software (macOS is actually free and has been for a few years). You’re free to buy compatible hardware or write your own drivers. In fact, many do write drivers for incompatible hardware; That’s how the Hackintosh hardware selection grows.
- jayd16 7y ago
  The EULA states you're only allowed to run two OSX VMs on a machine already running OSX or to install OSX on a Apple hardware. It does not grant permission to install on custom hardware. If you can show me how I can legally run a virtualized OSX build farm please please tell me how. https://images.apple.com/legal/sla/docs/macosx107.pdf https://images.apple.com/legal/sla/docs/macosx107.pdf
  - colejohnson66 7y ago
    I never said it was legal or illegal; I said that they don’t stop people from doing it. For example, they don’t go: “oh, this is a Hackintosh? I’ll wipe your efivars so your computer won’t boot.”
  - youngtaff 7y ago
    Installing Apple's OS on non Apple hardware is at most a Breach of Contract which is very different from being illegal.
    - wyldfire 7y ago
      While it's not criminal, infringement or breach of contract does create an opportunity for Apple to bring suit and have discovery.
- Flockster 7y ago
  You seem to be talking about macOS. The Corellium case is about virtual iOS instances.
sigjuice 7y ago
Apple does virtualization. They include a hypervisor in macOS. https://developer.apple.com/documentation/hypervisor https://developer.apple.com/documentation/hypervisor

lolc 7y ago

A lot of interesting stuff may become public from this. 1. Is Apple scared that backdoors will be found in Ios? It's much easier to find them in a virtual environment. 2. As the article mentions, there may be zerodays for Ios developed by Corellium. It would be great to know the extent of this. 3. We might learn more about current phone cracking capabilites in general. That may open a few eyes, including mine. I'm currently just very happy to have learned that people are poking at Apple's walled garden. Watching from the sidelines, I will appreciate any and all punches in this conflict. When secretive organizations battle in court, collateral exposure may happen :-)

NotSammyHagar 7y ago
It should be guaranteed at this point that there are zero days in both main cellphone platforms, apparently an endless number. They keep coming out, there is so much value in them commercially. I want to push a view and wish it was more widespread in the software world that finding zero days and not reporting them responsibly (like time to fix by the vendor before publication) is unacceptable. The second part of this view is that it is immoral to work at a company where you find zero days and exploit them. Working at the companies that find these and end up selling them to dictatorial regimes, secret police, as well as to the Harvey Weinstein's of the world is wrong. As a software engineer in a western country I'm fortunate to have some choice in my employers, as many of us do. My choices have some reflection on my character - and like everyone else, I'm hardly perfect myself. There are legal and illegal activities, and companies hide behind "we only sell to countries where it's legal". It's still immoral and wrong, and I don't want to work with immoral developers. Doing this kind of stuff is not the ultimate scarlet letter - but if you are working this field, please consider the impact of your actions.
- _bxg1 7y ago
  Is this really a minority view? I got the sense that most people in tech feel this way
threeseed 7y ago
You seem to have a very flippant attitude on this. Backdoors in Android and iOS costs lives. There are many governments who today kidnap, torture and kill citizens and even non-citizens based on compromised phones e.g. Jamal Khashoggi. And to have companies like Correlium enabling and profiting from this is utterly reprehensible. They aren't altruistic or making the world safer or being selective in who they sell their technology. They are simply the modern day equivalent of a shady arms dealer.

roseway4 7y ago

> In his own words, as filed with the court, Federighi said: “On Saturday February 8, 2020, a process server was outside of my home. He came to my front door and attempted to serve a subpoena to me, but my wife turned him away.” That's not harassment. It's due process.

Keverw 7y ago
Wonder if it's normal to serve people at their homes instead of at the office? But sounds pretty standard stuff otherwise if you have to serve them.