SOUCE: NSA via Edward Snowden
FORTUNE — You don’t have to put on a tin hat to find the timing of the “Apple” entry in the attached Powerpoint slide suspicious, although a tin hat probably helps.
The slide, marked TOP SECRET, was one of the first documents leaked to The Guardian and the Washington Post by NSA whistleblower Edward Snowden last June. It lays out the timeline for when the U.S. government’s top cyberspies gained access to user data on the servers of the major U.S. Internet companies: Microsoft (MSFT) in 2007, Google (GOOG) in 2009, AOL (AOL) in 2011 and Apple (AAPL) in Oct. 2012.
What makes that last entry so intriguing to conspiracy theorists is what computer experts discovered over the weekend about the security hole Apple patched — at least in part — on Friday. By comparing the original code to Apple’s fix, Adam Langley, a web encryption expert at Google, was able to pinpoint the problem.
The culprit, if you care about such things, was a short line of code — a “goto fail” without a corresponding “if” clause (see below) — in the software Apple uses to make sure a computer you are connecting to securely over the Internet is the computer it claims to be. This is critical when the website belongs to, say, a bank.
“It’s as bad as you could imagine, that’s all I can say,” Johns Hopkins University cryptography professor Matthew Green told Reuters.
[Readers who know more about this subject than I disagree. “It takes an elaborate hoax to exploit,” henry3dogg wrote in the comment stream to an earlier version of the story. “Nobody is going to benefit from it accidentally. And it is unlikely that anyone would set up such an elaborate hoax, unless they knew that the loop hole existed.”]
Anyway, here’s where the timing gets interesting. According to Jeffrey Grossman, whose Confide iPhone app depended on Apple’s security protocols to deliver “off the record conversations,” the bug appeared in iOS 6.0 and was not present in iOS 5.11.
iOS 6.0 was released in September 2012, just before the NSA penetrated Apple’s servers .
To summarize:
- Sept. 24, 2012: iOS 6.0 is released
- Oct. 2012: Apple is added to the NSA’s list of penetrated servers
- Dec. 1, 2012 to May 31, 2013: Apple receives 4,000 to 5,000 requests about 9,000 to 10,000 accounts and devices. (Per “Apple’s Commitment to Customer Privacy“.)
The evidence is purely circumstantial, but as Daring Fireball‘s John Gruber notes, “the shoe fits.” He goes on to connect the dots and offer “five levels of paranoia”:
1. Nothing. The NSA was not aware of this vulnerability.
2. The NSA knew about it, but never exploited it.
3. The NSA knew about it, and exploited it.
4. NSA itself planted it surreptitiously.
5. Apple, complicit with the NSA, added it.
Apple has explicitly denied No. 5. Gruber leans to No. 3, which leaves open the possibility that there are other, still undiscovered security holes through which user data is being funneled to the NSA.
The patch Apple released on Friday closed the “goto fail” hole for iPhones, iPads and iPod Touches. It remains open on the current version of OS X for the Mac.
“We are aware of this issue,” an Apple spokesperson told Reuters on Saturday, “and already have a software fix that will be released very soon.”
Below: The bug. (Can you spot the extra “goto fail”?)
LINKS:
- A good write-up for security professionals: ThreatPost‘s Dennis Fisher
- Analysis of the press coverage: AppleInsider’s Daniel Eran Dilger
