Apple Not Trying Hard Enough to Protect Users Against Surveillance, Researchers Say

Following the news of widespread commercial hacking spyware on targeted iPhones, a large number of security researchers are now saying that Apple could do more to protect its users (via Wired).

tim cook privacy
Earlier this week, it was reported that journalists, lawyers, and human rights activists around the world had been targeted by governments using phone malware made by the surveillance firm NSO Group known as "Pegasus."

Now, security researchers are stating that Apple could and should do more to protect its users against advanced surveillance tools like Pegasus. Independent security researcher Cedric Owens told Wired:

It definitely shows challenges in general with mobile device security and investigative capabilities these days. I also think seeing both Android and iOS zero-click infections by NSO shows that motivated and resourced attackers can still be successful despite the amount of control Apple applies to its products and ecosystem.

The security community has frequently criticized Apple for its limits on the ability to conduct forensic investigations into the security of iOS and the use of monitoring tools. A greater level of access to the operating system itself would, they claim, help to catch attacks and vulnerabilities more easily. For example, combating spyware like Pegasus would need access to read a device's filesystem, the ability to examine which processes are running, access to system logs, and more.

Android also places limits on "observability," but the locked-down nature of iOS, in particular, has drawn the ire of security researchers because Apple has heavily leaned into its focus on privacy and strong security protections, especially compared to other platforms. SentinelOne threat researcher Juan Andres Guerrero-Saade commented:

The truth is that we are holding Apple to a higher standard precisely because they're doing so much better. Android is a free-for-all. I don't think anyone expects the security of Android to improve to a point where all we have to worry about are targeted attacks with zero-day exploits.

Johns Hopkins University cryptographer Matthew Green similarly said: "Apple is trying, but the problem is they aren't trying as hard as their reputation would imply." iOS security researcher Will Strafach suggested that there are many options open for Apple to allow observation and imaging of iOS devices to catch bad actors in a safe environment.

On the other hand, there is a level of concern in the security community that more openness and an increased number of system indicators could inadvertently give attackers more leverage. For example, there are already suspicious applications on macOS that antivirus tools cannot fully remove since the system gives them a heightened level of trust, potentially by mistake. It is likely that any new system privileges in iOS would likewise be used by rogue analysis tools.

Nevertheless, the discovery of Pegasus and its severity is prompting discourse around device security and calls for Apple to do more to prevent surveillance, as well as discussion around the potential need for a government-supported global ban on private spyware.

Top Rated Comments

eicca Avatar
13 weeks ago
Oh really? What do these same researchers have to say about Google, Amazon, Facebook et al?
Score: 26 Votes (Like | Disagree)
Phil77354 Avatar
13 weeks ago
Interesting and a reminder that these issues are going to impact everyone regardless of platform.

If this helps to motivate Apple to step up their efforts, then I'm all for that!
Score: 19 Votes (Like | Disagree)
edgonzalez32 Avatar
13 weeks ago
I swear to god, most of you don't even bother reading the articles that are linked to these posts.


infections by NSO shows that motivated and resourced attackers can still be successful despite the amount of control Apple applies to its products and ecosystem.
That's a very valid observation. Apple claims that the system and app store is locked down for security, yet this happens. I'm not saying they need to be perfect, but just for a second take your fanboy hat off and read that. That's a valid criticism.

Also this

“The truth is that we are holding Apple to a higher standard precisely because they're doing so much better,” says SentinelOne principal threat researcher Juan Andres Guerrero-Saade. “Android is a free-for-all. I don't think anyone expects the security of Android to improve to a point where all we have to worry about are targeted attacks with zero-day exploits.”
Again, valid. I mean Jesus are you guys incapable of reading and just having a discussion? Nobody is saying to hate on apple. You know what makes the things you love better? Criticism and feedback. You know what makes me a better graphic designer? Criticism. How am I supposed to get better if all people do is praise me? You can STILL LOVE your precious Apple products and criticize them at the same time.
Score: 18 Votes (Like | Disagree)
lkrupp Avatar
13 weeks ago

Oh really? What do these same researchers have to say about Google, Amazon, Facebook et al?
Apple is the go-to target. If you write a negative screed abut Apple it gets millions of clicks. If you say Facebook sucks no one cares.
Score: 17 Votes (Like | Disagree)
nikaru Avatar
13 weeks ago
"A greater level of access to the operating system itself would, they claim, help to catch attacks and vulnerabilities more easily. "

Sure...just like making easier for thieves to enter my home, I actually make it safer because it is easier to catch them.
Score: 14 Votes (Like | Disagree)
Just sayin... Avatar
13 weeks ago
I’ve said it before and I’ll say it again: unless and until Apple provides full, end-to-end encryption for iCloud backups, their privacy/security words are merely “marketing-speak”.

https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT
Score: 12 Votes (Like | Disagree)

Related Stories

apple devices security bug bounty mac iphone ipad

Security Researchers Unhappy With Apple's Bug Bounty Program

Thursday September 9, 2021 10:00 am PDT by
Apple offers a bug bounty program that's designed to pay security researchers for discovering and reporting critical bugs in Apple operating systems, but researchers are not happy with how it operates or Apple's payouts in comparison to other major tech companies, reports The Washington Post. In interviews with more than two dozen security researchers, The Washington Post collected a number...
corellium

Apple and Corellium Agree on Settlement to Bring Lawsuit to an End

Tuesday August 10, 2021 11:36 pm PDT by
Apple this week dropped its long-standing lawsuit against Corellium, the security research company that provides security researchers with a replica of the iOS operating system, allowing them to locate possible security exploits within Apple's mobile operating system, The Washington Post reports. Apple filed a lawsuit against Corellium in 2019, claiming the security company was infringing...
apple pay express transit london

Security Experts Warn of Apple Pay Express Transit Hack That Enables Large Unauthorized Visa Payments From Locked iPhones

Thursday September 30, 2021 12:14 am PDT by
Researchers in the U.K. have demonstrated how large unauthorized contactless payments can be made on locked iPhones by exploiting Apple Pay's Express Transit feature when set up with Visa. Express Transit is an Apple Pay feature that allows for tap-and-go payment at ticket barriers, eliminating the need to authenticate with Face ID, Touch ID, or a passcode. The device does not need to be...
corellium

Apple Appeals Corellium Copyright Lawsuit Loss After Settling Other Claims

Tuesday August 17, 2021 7:23 pm PDT by
Back in December, Apple lost a copyright lawsuit against security research company Corellium, and today, Apple filed an appeal in that case, reports Reuters. The judge in the copyright case determined that Corellium was operating under fair use terms and that its use of iOS was permissible, throwing out several of Apple's claims. For those unfamiliar with Corellium, the software is designed...
appleprivacyad

Corellium Launching New Initiative to Hold Apple Accountable Over CSAM Detection Security and Privacy Claims

Tuesday August 17, 2021 1:35 am PDT by
Security research firm Corellium this week announced it is launching a new initiative that will "support independent public research into the security and privacy of mobile applications," and one of the initiative's first projects will be Apple's recently announced CSAM detection plans. Since its announcement earlier this month, Apple's plan to scan iPhone users' photo libraries for CSAM or...
iPhone 13 Security

Researcher Says Apple Ignored Three Zero-Day Security Vulnerabilities Still Present in iOS 15

Friday September 24, 2021 10:42 am PDT by
In 2019, Apple opened its Security Bounty Program to the public, offering payouts up to $1 million to researchers who share critical iOS, iPadOS, macOS, tvOS, or watchOS security vulnerabilities with Apple, including the techniques used to exploit them. The program is designed to help Apple keep its software platforms as safe as possible. In the time since, reports have surfaced indicating...
iPhone 13 Security

Apple Apologizes to Researcher for Ignoring iOS Vulnerabilities, Says It's 'Still Investigating'

Monday September 27, 2021 12:55 pm PDT by
Last week, security researcher Denis Tokarev made several zero-day iOS vulnerabilities public after he said that Apple had ignored his reports and had failed to fix the issues for several months. Tokarev today told Motherboard that Apple got in touch after he went public with his complaints and after they saw significant media attention. In an email, Apple apologized for the contact delay...
app store blue banner

Apple Says iOS is Safer Than Android Because Sideloading Apps Isn't Allowed

Wednesday October 13, 2021 5:00 am PDT by
In response to the European Commission's proposed Digital Markets Act, which could force sideloading of apps on the iPhone in Europe, Apple has shared an in-depth document highlighting the security and privacy risks of sideloading. Sideloading refers to installing apps outside of the App Store, such as from a website or a third-party app store. Apple's document, titled Building a Trusted...
Child Safety Feature Purple

Apple's Proposed Phone-Scanning Child Safety Features 'Invasive, Ineffective, and Dangerous,' Say Cybersecurity Researchers in New Study

Friday October 15, 2021 12:23 am PDT by
More than a dozen prominent cybersecurity experts hit out at Apple on Thursday for relying on "dangerous technology" in its controversial plan to detect child sexual abuse images on iPhones (via The New York Times). The damning criticism came in a new 46-page study by researchers that looked at plans by Apple and the European Union to monitor people's phones for illicit material, and called...
nso israeli surveillance firm

Report: Pegasus Spyware Sold to Governments Uses Zero-Click iMessage Exploit to Infect iPhones Running iOS 14.6

Monday July 19, 2021 12:35 am PDT by
Journalists, lawyers, and human rights activists around the world have been targeted by authoritarian governments using phone malware made by Israeli surveillance firm NSO Group, according to multiple media reports. An investigation by 17 media organizations and Amnesty International's Security Lab uncovered a massive data leak, indicating widespread and continuing abuse of the commercial...