The IT Nerd

It didn’t take long for people to react to Apple’s disclosure of what the purpose of these “backdoors” that are floating around iOS are. Let’s start with the guy who found them. Here’s a bit of what Jonathan Zdziarski had to say via a blog post:

I give Apple credit for acknowledging these services, and at least trying to give an answer to people who want to know why these services are there – prior to this, there was no documentation about file relay whatsoever, or its 44 data services to copy off personal data. They appear to be misleading about its capabilities, however, in downplaying them, and this concerns me. I wonder if the higher ups at Apple really are aware of how much non-diagnostic personal information it copies out, wirelessly, bypassing backup encryption. All the while that Apple is downplaying it, I suspect they’ll also quietly fix many of the issues I’ve raised in future versions. At least I hope so. It would be wildly irresponsible for Apple not to address these issues, especially now that the public knows about them.

Well, he’s not impressed. Neither is blogger, journalist, and science fiction writer Cory Doctorow who via BoingBoing is extremely unimpressed with Apple and the way they’ve reacted to the discovery of these “backdoors”:

The original paper (paywall), published in Elsevier’s Digital Investigation sparked a non-denial denial from Apple, basically admitting that the back-doors were there, but misleadingly suggesting that they were only for enterprise administration.

But as you can see from Zdziarski’s slides (PDF), neither this nor other excuses really hold water. The backdoors are actively maintained code that can be accessed over networks, possibly over cellular networks, without developer tools, and even on devices that are not in enterprise mode. The backdoors expose deep and sensitive data that is nominally encrypted and locked, and there are tools and systems in the field that rely on them, including law-enforcement tools for slurping up data from people who’ve been detained — a practice the Supreme Court recently held to be illegal.

So it seems that Apple’s disclosure this morning has done little to make this go away. That is why I’m going back to what I said in this post when Apple denied that these were “backdoors”:

I really think that Apple needs to be completely transparent here as I suspect that this is not going to go away anytime soon.

I am sticking with this because I’m not too impressed with Apple’s explanations either at the moment. I think it’s safe to say that many people also aren’t either.

The last time I posted on the circus surrounding the discovery of backdoors in iOS, I called on Apple to be far more transparent about all of this as their response did little to make people feel better. Now they have. A support document has been posted that details what these functions within iOS do:

Each of these diagnostic capabilities requires the user to have unlocked their device and agreed to trust another computer. Any data transmitted between the iOS device and trusted computer is encrypted with keys not shared with Apple. For users who have enabled iTunes Wi-Fi Sync on a trusted computer, these services may also be accessed wirelessly by that computer.

The article then goes on to explain in some amount of detail the three functions and what they are used for. Now it’s unusual for explanations about “diagnostic capabilities” in Apple software to be documented in a public support document. That implies that Apple wants people to find them. Now it’s a safe bet that security experts and others will still have questions about these three functions, but at least Apple is showing that they recognize that they can’t just sweep this under the rug.