The United States Central Intelligence Agency has been involved in a “multi-year effort” to break through Apple’s security code, according to a new report from the Intercept.
Another reveals efforts to embed surveillance and counter-surveillance for iOS devices (note the British Government Communications Headquarters logo and the reference to the WARRIOR PRIDE program that was revealed by Snowden last year.
The slides don’t reveal any successful operations, but the practice could potentially create security weaknesses within everyday apps used by millions of iPhone and iPad users as well as compromise the security of every app made by targeted developers.
Even more troublesome is the kind of data the CIA was supposedly extracting from these devices. According to one slide, it was attempting to extract GID keys, not UID keys. UID keys allow access to an individual’s data on one phone. It’s something you’d want access to if you were trying to track a terrorist, according to Zdziarski. However, the GID 256-bit key shared by all devices with the same application processor.
“So what that tells me is that the CIA was NOT interested in getting to encrypted personal data on individual devices, but was instead interested in cooking their own low-level boot firmware to install across an entire product line of devices.” Zdziarski said.
This is just one accusation in series of damning allegations against the NSA and cooperating security agencies. The NSA worked in conjunction with the British equivalent organization Government Communications Headquarters (GCHQ) to steal SIM encryption keys, according to an earlier report from the Intercept.