Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

34 points

Dmg Security

Hi, I'm trying to determine this for many of my business clients who are considering switching away from Apple products to Open Source due to the recent NSA disclosures.

Does Apple's DMG format have a backdoor to allow Apple access to the data within them to comply with government?

I'm not suggesting that I believe the AES encryption itself has an inherent issue, I want to know if anyone has been able to independently verify that Apple's implementation with DMG is lacking a backdoor that can bypass AES.

We already know there's a backdoor for iPhones that Apple will access for law enforcement.

http://news.cnet.com/8301-13578_3-57583843-38/apple-deluged-by-police-demands-to -decrypt-iphones/

Is an Apple DMG also subverted with a backdoor as well?

Thank you.

P.S. This is a sincere security question for clients that have proprietary information and want to know what their risks are with Apple DMGs. Please don't bring politics into this.

Posted on Sep 16, 2013 1:47 AM

Best reply

etresoft

Level 8

46,654 points

Posted on Sep 16, 2013 7:42 AM

First of all, iPhones have nothing to do with DMG files. The default passcode on an iPhone is 4 numerical digits. Assuming it takes one second to attempt to enter a passcode, one could try all possible passcodes in less than 3 hours. I am sure that Apple has the ability to try passcodes faster than that and has the ability to disable automatic wiping after 10 failed attempts. Only Apple has access to the hardware and software designs to do this.

DMG files allow full passphrases that would take tens of thousands of years to decrypt that way. iPhones support those too but few people use them because they are hard to type on a small device.

Those same government agencies that need Apple's help to break even this simple passcode are, however, able to infiltrate secure open-source networks like Tor and the Internet all by themselves. Therefore, it seems like Apple offers a far more secure option for your clients. People debate whether or not the NSA and the FBI have the legal authority to break into these networks, but obviously they have the technological means. With a valid search warrant, government agencies have the legal authority to break into Apple encryption but still can't do it by themselves.

There are always risks when one is trying to use technology whose details are beyond one's technical abilities. Using open source would multiply those risks many times because, even without encryption, it is so much harder to use and understand. You may be worried about a backdoor in Apple technology, but there are 10,000 other things to be worried about with open source. For all you know, your open source software is uploading your passwords in plain text.

View in context

17 replies

etresoft

Level 8

46,654 points

Sep 19, 2013 4:58 AM in response to Cowicide Moo

Cowicide Moo wrote:

I see your point, it's not technically a backdoor, but one does have to wonder why Apple doesn't make it much more difficult to circumvent the "security wipe" that anyone can accomplish with a jailbreak and some third party tools.

If you are jailbreaking your phone, you obviously aren't concerned with security anymore. What could Apple possibly do to make iPhones more secure? Add a fingerpint detector?

While semantically it's not a "backdoor", it's still a flaw in the implementation. We may never know if that was done purposefully or not.

It is not a flaw in the implementation. It is inherent in the design of any public key encryption method. It was done purposefully because that is the way public key encryption is done.

I'm not sure what you mean when you say use it as a "criteria", but many corporations use Open Source technology. Times have changed. I've worked with a multi-billion dollar publishing company that uses it extensively for a host of reasons, including better security (in their case).

The critiera that smart people use to make technological decisions are cost, reliability, support, and install base. Whether or not it is open source is irrelevent. It just so happens that a few, well-known open source projects score well on all four points. The vast majority of open source projects do not and no one uses them.

You linked to "Facts and Fallacies of Software Engineering" by Robert L. Glass. It's a bit more complex than what you imply. Linus' Law doesn't just pertain specifically to security bugs. Rather, it applies to all bugs including security bugs.

Correct, but it is completely false regardless of what it applies to.

Studies have shown that Open Source projects have less bugs than proprietary projects.

No, they don't. I have read many studies on open source. High security and high quality are not an inherent traits of open source projects. Harassment and sexual discrimination, however, are.

Like I said, there's compelling reasons to choose open source over proprietary code as long as you make a calculated, educated decision.

No, there aren't. There are critiera to make good technology decisions, but the only time open source is a factor is when you are making decisions based on emotions and political opinion.

If you have a small amount of lines of code and a tremendous amount of input, it's very likely to be more secure than propieatry code where you have to trust instead of verify.

No, that is false.

That's not how it works, changes are peer-reviewed and verfied with a simple md5 check. You seem to be very focused on diparaging Open Source with inaccurate info, I'm not sure why.

I am not trying to disparage open source. I use it all the time. I have been a software engineer for over 20 years. There is no inherent "peer review" in open source. Each project is different. A very, very few have high standards but most do not. You are fooling yourself here.

It's well known that some (including the FBI) will use Apple products because of its better secuirty (for various reasons) that can thwart investigations, etc.

I've spent my whole career working for the government. Mac are extrordinarily rare.

I'm merely asking about the possibility of a backdoor in the DMG format and/or OS in light of recent NSA disclosures.

Your "NSA disclosures" are carefully orchestrated leaks by proven liars and criminals. They only "disclosed" the things that make the NSA look bad. They keep secret all of the good things the NSA does.

The same thing happens here in these forums. You only see posts from a few hundred people who are having a particular problem and you think the problem is pandemic to all Apple devices, but the other 499,999,499 users aren't having any problems. Your NSA paranoia is much worse. You are making assumptions based outright, deliberate lies. Their intent is to deceive you and it is working.

I'm personally not worried about DMGs. I have clients that have implemented the technology and I'm investigating in forums all around the world to gather consensus. This Apple thread is only one of about 30 where I've initiated the discussion. Unfortunately, out of all the other forums this is the only one where I've been met with hostility and derision, by the way.

That's because this is the only one where people actually know about security in DMG files.

But, I'm not one to be detered by bullies.

Good. You will need that trait with open source.

Please be polite, thanks. When you resort to an insulting demeanor it only makes me take you less seriously. Most top secuirty experts have said that if certain encyrption is implemented carefeully and properly even the NSA can't crack it. The math behind encryption is sound and the NSA can't magically crack the best implementation depsite their vast resources. Most experts say that teh NSA very likely relies on mistakes in implementation and possible backdoors.

What is not being polite? Pointing out your errors in logic? You are concerned about Apple's abilities to manipulate their own source code in their own building. But you are not at all concerned when anyone can do the same thing?

You aren't even reading your own propaganda about the NSA. If you want to accuse me of not being polite, then perhaps I shouldn't even bother with pretences.

You don't have any clients. You aren't trying to learn anything about DMG files. You are only here to spread open source, anti-government political propaganda. Unfortunately, out of all the forums you have tried, we are the only ones who haven't fallen for it. Thank you. We appreciate the compliment.

Cowicide Moo Author

Level 1

34 points

Sep 19, 2013 3:34 PM in response to etresoft

If you are jailbreaking your phone, you obviously aren't concerned with security anymore.

You missed my point completely.

It is not a flaw in the implementation. It is inherent in the design of any public key encryption method. It was done purposefully because that is the way public key encryption is done.

Being able to bypass features that help thwart brute force attacks is a feature?

The critiera that smart people use to make technological decisions are cost, reliability, support, and install base. Whether or not it is open source is irrelevent.

People of average intelligence can also take into account security issues and the disadvantages of proprietary code in certain circumstances. It's not as black and white as you portray. For those that have more experience in real-world business consulting they understand there's more nuance in the needs of various businesses.

Open source and the size of the project's code itself is an important factor you're leaving out. Also, the speed in which bugs are fixed is a factor as well if one isn't going to ignore long-term issues for clients in certain circumstances. To say that's irrelevant doesn't make sense in the real business world, in my opinion.

Correct, but it is completely false regardless of what it applies to.

It's not completely false. There's nuance. It depends on the ratio of lines of code to those that inspect the code along with many other factors.

Your "NSA disclosures" are carefully orchestrated leaks by proven liars and criminals. ... Your NSA paranoia is much worse. You are making assumptions based outright, deliberate lies.

You're welcome to your opinion, but the NSA and other government officials have confirmed the leaks are accurate. I've requested that we keep politics out of this and will stop here.

As far a me making assumptions go, I don't assume there's a backdoor in Apple's DMG format. If anything, I've stated repeatedly that I think it's unlikely. I'm merely researching the possibility. That's a big difference.

As I've said, I've been approached by many clients who are now concerned about it and I'm practicing due diligence in light of the NSA disclosures. You may also think some of these Fortune 500 companies are "paranoid", but I think they'd beg to differ with you. They want me to look into, I'm doing it. Calling me paranoid and acting like a bully isn't going to dissuade me and is'nt productive, sorry.

This Apple thread is only one of about 30 where I've initiated the discussion. Unfortunately, out of all the other forums this is the only one where I've been met with hostility and derision, by the way.

That's because this is the only one where people actually know about security in DMG files.

Actually, I've found that this forum (while helpful in some ways) has been by far the most lacking in expressing the knowledge of the security of DMGs compared to many of the other sources I'm following and interrelating with.

Even if it is true that people (you mean yourself?) in this forum are more knowledgeable, I'm not sure how that would dictate as an excuse for being rude, hostile or derisive. It's really unnecessary and only makes people look bad.

If my lack of knowledge upsets someone of your expertise, I apologize. Nonetheless, I'm trying to be polite with you and I'd appreciate if that common courtesy was returned.

But, I'm not one to be detered by bullies.

Good. You will need that trait with open source.

I haven't found that I've needed that trait in dealing with open source for over 15 years, but in this thread it's been another case.

You don't have any clients. You aren't trying to learn anything about DMG files. You are only here to spread open source, anti-government political propaganda.

I have clients from over 15 years of business consulting, etc. I understand you are very upset about the NSA disclosures, but your hopped-up emotions are not germane to this discussion. Please focus on the technology.

As I've said, some of my clients have approached me specifically about the DMG format and whether it's secure in light of recent NSA disclosures. I came here asking about the format and the possibility of a backdoor in light of their questions. Ad hominem attacks aren't productive and I politely ask that you refrain from them in the future.

What is not being polite?

Well, calling me paranoid and a propagandist is several examples I can think of. Also, now calling me a liar who doesn't have any clients can be considered extremely impolite by most people's standards. If this is how you want to continue to talk with me, that's fine. I'll just be the better person and continue to ask that you stick with technology instead of deriding me personally. Thank you for your cooperation.

No, they don't. I have read many studies on open source. High security and high quality are not an inherent traits of open source projects. Harassment and sexual discrimination, however, are.

You're now equating Open Source to being an enabler of "harassment and sexual discrimination"? Ok.... I'm not going to respond to that because it seems that would lend itself to some other kind of philosophical discussion that has very little to do with this thread.

If you are only finding studies that show that Open Source is more buggy than proprietary code in all cases, then I think you're being pretty selective in your info diet.

As I've said, it depends on the ratio. Smaller projects tend to be superior to proprietary projects:

http://readwrite.com/2013/05/07/study-reveals-open-source-software-quality-is-hi gher-than-proprietary-code-up-to-a-point#awesm=~ohV3j0JfuqIQNu

Also, bugs tend to be fixed more rapidly in Open Source projects than in commercial software:

http://ostatic.com/blog/research-shows-foss-bugs-get-rapid-response-commercial-s oftware-not-so-much

Like I've said, there's studies (often industry-sponsored) that show that proprietary code is better. But, there's also studies that show that Open Source is. It's much more nuanced than you keep implying:

http://www.tgdaily.com/software-features/54546-open-source-safest-for-healthcare -it-study-claims

For even more nuance, here's an analysis of 450 million lines of code initiated between Coverity and the U.S. Department of Homeland Security. It says that code quality for open source software basically mirrors proprietary software (overall), but there's nuance, of course:

http://www.net-security.org/secworld.php?id=14871

Once again, it confirms it that it may depend on the size of the project, etc. on which solution or hybrid thereof is better.

Studies have also shown proprietary code's "security through obscurity" doesn’t provide any additional security:

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.145.1586&rep=rep1&type= pdf

They also conclude that some things are more secure in Open Source (i.e. Apache versus Micro- soft IIS) while propretary can be more secure in other projects (S/COMP or GEMSOS** versus Gnu/Linux).

It's nuanced. This comprehensive work paper shows that it can be good to have a combination of proprietary and Open Source for many organizations as long as you study the potential conflicts of interests, etc.

http://hp.gredeg.cnrs.fr/torre/workpap/DARMON_LETEXIER_TORRE.pdf

Now, this might send you for a loop, but the NSA (National Security Administration) also details why Open Source has advantages over proprietary code in many circumstances including when dealing with hardening/customization. (This is the crux of why many of my clients use Open Source, by the way):

http://www.nsa.gov/research/tnw/tnw182/articles/pdfs/TNW_18_2_Web.pdf

Personally, I think it's a good idea to expand research horizons a bit when things like nuance go out the window.

I do appreciate you responding to my questions and you've been helpful in some regards. Thank you. I also think it's very commendable that Apple embraces Open Source as much as they do especially when compared to Miscrosoft.

Dmg Security