Hello world,
Apple is about to start automatically scanning your iPhone’s photo library to see if you
have any illegal pictures.
And yet more ransomware drama, a disgruntled affiliate of the Conti ransomware group has
leaked the gang’s infamous playbook.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news.
From next month, Apple will start automatically scanning all the photos stored on your iPhone
for instances of abuse imagery involving minors. This is pretty big news coming from a company
which bills itself as having privacy at the heart of its values, Apple taking the age
old “think of the children” stance to justify rolling back privacy has pissed off
a hell of a lot of people. Whilst on the face of it, hunting down pedos is a great idea,
there are some critical flaws in this plan which threaten the privacy of all of us. Now
from here on out I’m going to refer to the type of content Apple is hunting, via their
own initialism of ‘CSAM’, if only to avoid this video being put on a list.
How does this work? Well, Apple has teamed up with child protection organisations to
procure a library of many thousands of these CSAM images. Apple has run all of these pictures
through an advanced hashing function, producing a number for each which identifies the image.
All these thousands of hashes will be stored locally on your iPhone or iPad. Whenever a
photo stored on your phone is uploaded to iCloud your iOS device will check it against
the local library of hashes, if a match is found then a variable, let’s call it a pedo
score on your phone is incremented. If a device’s pedo score breaches a certain threshold then
the offending photos will be sent to Apple to manually verify, at which point the offender
would be locked out of their account and law enforcement will be notified.
Apple’s clever hashing algorithm takes into account cropping of photos and degradation
of quality due to encoding, so it should be quite effective.
Apple claims their “method of detecting known CSAM is designed with user privacy in
mind” - is this true? Kind of, I suppose, but also not really. The image scanning is
done locally on your phone, so it’s not like this is being computed on some central
server potentially run by the NSA. In addition, a pedo score needs to rise above a certain
threshold before your iPhone even notifies Apple, a single image isn’t enough to do
it apparently. Also, photos are only being compared to a library of pre-existing CSAM
material, it’s not like Apple is using some advanced AI to figure out if any random image
you take with your phone is sus. Also, according to the fruity overlord, their system has an
“extremely high level of accuracy and ensures less than a one in one trillion chance per
year of incorrectly flagging a given account.” Anyway, there’s my devil’s advocacy out
of the way, let’s get to the reasons why you might not want to be on board with this.
The fact that Apple wants to nab kiddy fiddlers isn’t the problem, if that was the only
variable here no one would take issue with this plan. The issue is, the mere fact that
this type of technology is being deployed, regardless of the justification. Whilst currently
it is only being used to detect CSAM images, it would not be rocket science... in fact
it would be quite simple to repurpose this tech and use it to detect: anti government
imagery, photos relating to certain ideologies, and so on. And we would never know, because
remember only hashes corresponding to the offending imagery are stored locally on your
device, it would be impossible to ascertain if these hashes relate to CSAM or something
else.
To make matters even worse Apple isn’t immune from FBI interference, one very interesting
example of this is evident in a Reuters report from last year, which describes how Apple
planned to offer end-to-end encryption for data stored in iCloud - as whilst currently
user data stored on iCloud is encrypted, Apple themselves hold the keys, enabling end-to-end
encryption would have made it impossible for law enforcement and other government agencies
to access your files, as you would be the only one with those precious decryption keys.
However, after several secret meetings with the FBI, Apple apparently backtracked, canning
the idea.
Yet another issue caused by this charade - is that if there’s one thing we’ve learnt
in the tech world, once Apple sets a precedent, all the other tech giants listen and tend
to adopt it. For example, getting rid of the headphone jack was just a crazy thing Apple
did, until 2 years passed and a bunch of other phone manufacturers hopped on the bandwagon,
even the ones which initially made fun of the idea.
There is the question of would this be all that effective, after all pedos also read
the news, they could simply stop using iPhones, leaving the rest of us having to deal with
this kind of surveillance. And just a heads up, randomly switching to Android in the next
couple weeks, is about to become very, very sus. From as early as next month this feature
is going to be enabled on all iOS devices, though only on American registered products
for the time being - whether this is even possible to implement in Europe due to stricter
privacy laws, remains to be seen.
I ran a poll on instagram to gauge your guys’ views on all of this, you should totally follow
me for behind the scenes stuff, I’m @Jhonti. You guys were rather split, 30 for, 70 against.
Let's get a debate going in the comments, are you up in arms over Apple’s new feature,
or do you think it’s a necessary evil?
Apple have published a blog post announcing their plans, as well as a technical summary
which explains how this will be implemented - though this is only a very high level explanation,
it isn’t open source of course, by using an iPhone from here on out you are trusting
that this system is secure and won’t be exploited.
A disgruntled affiliate of the Conti ransomware gang has turned on the group and leaked a
treasure trove of data which the gang use to train up new recruits. Conti is described
as one of the most ruthless ransomware gangs. While many groups have a quasi code of ethics,
claiming they won’t go after hospitals, government departments, critical infrastructure,
and so on. Conti bucks the trend and has been observed attacking “911 dispatch carriers,
emergency medical services and law enforcement agencies”.
Conti, like virtually all other ransoming rapscallions operate an affiliate program
- in which, the affiliate is responsible for spreading the malware, gaining the initial
infection, for which they are awarded usually a 70% cut of any ransom paid. Whereas Conti
themselves handles the actual ransomware development.
In this case it would seem our malcontented affiliate here, was hacked off over not being
paid his fair share. Bleepingcomputer published a screenshot of his post on an unnamed Russian
cybercrime forum, I’m assuming this was translated from Russian as I can’t make
much sense of it - he seems to have gone on a tirade about how the Conti gang took his
share of the spoils and divvied it up between themselves. Following which he leaked the
IP addresses Conti uses for their cobalt strike command and control servers. Cobalt strike
being a legit pentesting tool made for professionals, which was leaked on github a while back, since
then it’s become the industry standard for cybercrooks intent on maintaining control
of victim PCs.
Our affiliate, one Mr “HDD-Drive” then went on to post 111MB of files “including
hacking tools, manuals written in Russian, training material, and help documents that
are allegedly provided to affiliates when performing Conti ransomware attacks.” I
can’t read Russian, but Vitali Kremez, CEO of advanced intelligence, told bleeping computer
that “By and large, it is the holy grail of the pentester operation behind the Conti
ransomware”. It is essentially a whole training package of materials which allows “new pentester
ransomware operators to level up their pentester skills for ransomware step by step.” In
the same way that a company might keep manuals for new employees on how to do certain tasks,
this is essentially that.
This leak shows just how vulnerable ransomware gangs are, as all it takes is one peeved off
affiliate to spill the gang’s secrets. In order to tempt cyber crime scoundrels to rat
out their bosses, as bleeping computer goes on to explain, the US government is offering
up to a $10 million reward for “details that can help identify and locate any person
that acts on behalf of a foreign government in malicious cyber operations.”
Now of course, ransomware isn’t state operated, usually… save for some notable exceptions,
North Korea comes to mind. The US Department of State has set up a dark web site where
you can submit tips completely anonymously, upon making a submission you’re given a
code name which acts as a kind of password so you can further communicate with agents
on return visits. In addition the $10 million ransom has the option of being paid out in
crypto currency - making it easier for cyber crime operators with a grudge to stab their
associates in the back.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next go check out my previous video on how a hacker group with the most
amazing name ever ‘Imperial Kitten’ catfished employees of western defence contractors.
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.