Access Now phủ nhận truy cập hoặc xâm nhập vào hệ thống bảo mật kỹ thuật của Apple | Tin tức Công nghệ

An Apple logo in front of a keyboard and some binary code. (Image Credit: Reuters).

In late October and early November, a number of politicians started receiving alerts on their smartphones, about attempts by state sponsored attackers to compromise their devices. Union Minister Ashwini Vaishnaw pointed out that the claims made by Apple were vague, and that a probe will be conducted to get to the bottom of the matter. The Indian Computer Emergency Response Team (CERT-In) then released an alert on vulnerabilities in old and unpatched iPhones and iPads.

The alerts only confirm an attempt at compromising the device by state sponsored actors. Whether the devices were actually compromised or not, has not been confirmed. The alerts have created a divide on social media platforms such as Reddit and X, where fanboys are praising Apple for its proactive stance to cybersecurity, and interpreting the whole controversy as free publicity for Apple. On the other hand, there are haters who instantly judged the news to be an indication of the weak security in Apple devices, and have considered it as a hit on the reputation of the brand.

I am just making a common-sense point on the Apple alert issue. Just read the language of the notification. It is full of loaded language like “because of who you are or what you do” – hardly a technical alert. Also odd how it states “state-sponsored” without any proof 1/n pic.twitter.com/oGy1t5Bu4M

— Sanjeev Sanyal (@sanjeevsanyal) November 1, 2023

The email version of the alert suggested that the affected customers reach out and get help from experts, with a link to the page of Access Now, that has the tools and resources to support its mission, to protect the digital rights of an individual anywhere on the planet. Economist and writer Sanjeev Sanyal raised some ‘common sense’ questions for Apple on X, and concluded that handing over customers to Access Now could only be because of “Three possibilities: (1) This is an impersonation – but Apple has not yet claimed this (2) Apple has outsourced its technical security systems to an NGO (3) Apple’s security team has been infiltrated by agenda driven groups that are now driving it (which has many implications).”

Access now has an open website where individuals targeted by state sponsored attacks can get genuine help from experts

We reached out to Access Now with a pair of simple questions, 1) Has Apple has outsourced its technical security systems to Access Now? and 2) Has Access Now infiltrated Apple’s security team? Enrique Gasteazoro, Director of Communications and Engagement with Access Now, responded with, “The answer to both the questions in your email is no.” In the support page for the threat notifications of state-sponsored attackers, Apple has provided a link to a number of resources where affected users can get help, including Access Now.

Also Read | Here is how you can safeguard yourself from cyber threats on your Apple device

Access Now has responded to the controversy with a clear message on the need for privacy and blacklisting of malware or spyware that infringes on the rights of citizens. Rand Hammound, Surveillance Campaigner at Access Now said, “These Apple notifications underline the lack of action and accountability on spyware abuse in India over the years. The continued use of invasive surveillance tech, especially on journalists and critical voices, erodes democratic processes and values, hinders press freedom, and enables repeated human rights violations.” Access Now has also pointed out that no meaningful action has been taken in India despite the 2021 revelations that the Pegasus spyware had been used to compromise hundreds of Indian devices.

States have tools and resources at their disposal beyond the means of run-of-the-mill cybercriminals

State sponsored attackers use highly sophisticated tools that have been honed to evade detection, and compromise devices of users through zero day exploits, unpatched shortcomings in the code of software that malicious actors use to get a toehold on devices. Securing users from such focused, targeted attacks is not the same as protecting users from garden variety cyber criminals, and is something that even major technology companies such as Apple, may not be equipped to handle. Often when users are facing such attacks, they may be at threat through channels and avenues extending much beyond just their devices and their private data. This is why notifying its users is considered as a responsible move by Apple, even though the details are ‘vague’.

Following the controversy, Apple released this statement: “Apple does not attribute the threat notifications to any specific state-sponsored attacker. State-sponsored attackers are very well-funded and sophisticated, and their attacks evolve over time. Detecting such attacks relies on threat intelligence signals that are often imperfect and incomplete. It’s possible that some Apple threat notifications may be false alarms, or that some attacks are not detected. We are unable to provide information about what causes us to issue threat notifications, as that may help state-sponsored attackers adapt their behavior to evade detection in the future.” Despite the clarification, the statement, and indeed the alerts themselves, have ended up raising more questions than answers.

What has happened here is that Apple’s new threat notification system has worked as intended and has proactively taken steps to inform and educate its users about the threat that they are facing, and suggesting further action that they can take to secure their data and devices. There would not have been a controversy or a ‘problem’ at all if Apple had simply decided not to send out any alerts at all, but warning its users was the responsible step to take here, and is a commendable move by Apple.

Also Read | Apple hacking alert becomes latest flashpoint between Opposition and Centre | What’s the controversy all about