As someone who bought an iPhone specifically for privacy reasons, I'm not really upset about this. What I'm concerned about is passive, mass-scale corporate surveillance, not a one-off bug that allows an individual with mal-intent to listen through my microphone for a few seconds and also let me know about it.
Are you able to root an iPhone or use one without signing in with an Apple account (that's tied to a credit card, etc)? If not, then I believe the devices are still very much part of a mass-scale corporate surveillance network.
You can root, but it's security-suicide because the OS' security model isn't designed for that.
> or use one without signing in with an Apple account
Technically yes, although you couldn't download any apps so you really don't want to.
> If not, then I believe the devices are still very much part of a mass-scale corporate surveillance network.
What I always tell people is to look at the economic incentives. Apple makes the vast majority of its money from paying customers, not advertisers, so it has less use for big data. It has also invested huge amounts of money in marketing itself as a champion of privacy, a key diversifier from its competitors. If it tried to do some shady data-gathering, it would have relatively little to gain and everything to lose when that inevitably leaked. Apple usually can't even keep the next iPhone a secret; there's no way they could conceal a massive conspiracy to secretly collect data on customers. And if they did, and it became public knowledge, their sales would go down the tube. It's just bad business. I don't trust any corporation to do what's right out of the goodness of their hearts, but I certainly trust them to do what's best for business.
Well, that's a plain and simple lie, since you can't download apps from the App Store without an Apple account, nor do I believe you can install software updates.
I haven't tried in a while, but last I checked, updates worked fine.
It's not necessary to download apps from the App Store to use an iPhone.
I'm not sure what was the need for you to call me a liar. If anything I've said is inaccurate, I guess it has changed in the last few months, and I would love to know that.
Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior?
It’s not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it’s not as bad: the attacker’s Apple ID ends up in the call logs of the affected person.
Are there prior examples of any phone manufacturer being reputationally damaged by vulnerabilities like this? Heck, Samsung’s phones literally caught fire and they’re still selling phones just fine.
> Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior?
Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!
I feel like you're answering a different question that I asked. I don't think the bug is low-severity.
I'm asking:
Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug?
I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is similar to other issues, like the Sony PSN hack, where despite the gravity of the issue, everything continued long-term as if nothing had happened.
> Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug?
That reads much clearer, you're right, I misunderstood what you meant. I think it depends, PSN isn't as personal as someone's potential unsolicited nudes being extracted by total strangers. If enough bad press came of it, it wouldn't be the same ballpark. I certainly hope nothing horrible comes of it.
> Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug?
I'm sure Apple "worries" about any bug and its potential impact on its reputation, particularly in the area of privacy, where it has a leg up on Android at least in perception.
That said, what historical bug is up to this one for iOS? This is a big deal and I cannot recall anything similar.
edit 1: this hasn't exactly been a banner couple of months for iPhone. You'd expect that mitigating any negative news about the device would be paramount
edit 2: look to Facebook. I find it encouraging that people have reacted so negatively to a company acting so cavalier with their personal data and privacy. Yes, I think Apple cares, moreso than with other bugs.
The article slug is misleading, and suggests a fundamental misunderstanding of the scope of the bug. A RCE in Messages does not allow attackers to steal your passwords.
The ask from the comment I’m responding to was for comparable vulnerabilities to this one, since this comment thread is discussing reputational damage from high-sev vulnerabilities. This vuln gives RCE in iMessage, which is an app that has microphone/camera access, so I’d say it’s clearly comparable.
Well this is the top Twitter trend right now, for starters. It's a very visible, very easy to reproduce bug in a very popular service, and it's definitely going to hurt their reputation with consumers more than if it was something more technical yet equally or more dangerous.
Again, are there examples that show it will “definitely” hurt their reputation at all? I’ll broaden my example set: are there any examples of consumer devices where the company suffered clear damage to their brand as a result of a security issue?
As an information security professional I wish security breaches would permanently damage a company's reputation, and even put some companies out of business if the breach demonstrates they have no business handling sensitive personal information. But if that was the case, Target and Home Depot and Equifax wouldn't exist, and no one would dare touch an Android phone or a Windows computer.
The sad fact is consumers don't care one bit. The only people who care are people who have some interest in disliking the company who was breached, in which case they're likely not paying customers anyway.
Surely you understand that different bugs create vastly different problems?
Audio and video leaking without knowledge from such a personal device that people take with them everywhere is about as bad as it gets in terms of privacy breach.
For me, reputational damage would be having a bug that allowed a phone to be compromised via text message and then not sending any kind of fix for months, or years. Oh wait.
If Apple fixes this bug this week, I will consider it a significant bug with a good response, and move on. If I wanted more privacy, what would I switch to anyway? Android? Ha!
Apple has shipped versions of its Mail program that delete email without warning¹ and versions of the Finder or OS X that delete² files. And much more. Yet their reputation is intact: the masses still believe that they put out quality software. They are truly the Teflon corporation.
Neither of your links seem to work, and the second one in particular seemed to have been dead for what seems like half a decade. Have you just kept these links around to whip out in support of this argument, without checking once whether they actually go somewhere?
Not to defend Apple but I'm not sure there are higher quality options really. I don't think Apple makes good software but it can be the best without being good.
Come on this is an overreaction. It’s a bug plain and simple. A bad one for sure but still Apple disabled the feature (allegedly) while they push a fix out. Shit happens.
I'm curious how they can mitigate the reputational damage.
Edit:
It gets worse:
https://www.theverge.com/2019/1/28/18201383/apple-facetime-b...
If the recipient rejects the call by pressing the power button, it starts sending video.