Report: CIA compromised BitLocker, explored attacking Apple devices

— 11:05 AM on March 11, 2015

When you build a strong door and put something valuable behind it, you shouldn't be surprised when somebody comes along and tries to break it down. In today's drama, the gatekeepers are Apple and Microsoft, the valuables are personal data stored on iPhones and encrypted with BitLocker, and the party with the battering ram is the CIA. According to a new report based on top-secret documents obtained by The Intercept, America's premier intelligence agency has been exploring ways to defeat the encryption inherent to Apple products and applications like BitLocker for years.

The worst news seems to affect BitLocker. The Intercept claims the CIA has been able to extract the keys used by Microsoft's full-disk encryption tool since 2010. If true, that means the agency has long been able to decode drives scrambled by BitLocker. This news also implies that a vulnerability may exist somewhere in Microsoft's encryption scheme.

The CIA's prodding of Apple's security measures seems to have been more experimental in nature. One such exploration reportedly involved obtaining half of the key pair burnt into Apple's SoCs. Called the Group ID, this key pair is shared among all Apple SoCs of the same type. According to The Intercept, obtaining the full pair could serve as a stepping-stone to the eventual decryption of the device firmware, leading to the discovery of further low-level vulnerabilities.

Another novel (and terrifying) attack allegedly considered by the CIA involved the distribution of a modified version of Xcode, Apple's development environment for iOS and Mac applications. According to The Intercept's information, apps developed with this build could surreptitiously compromise the security of the operating system—and any data on the device.

News of this potential attack has raised concerns among Apple developers, since a compromised compiler can insert vulnerabilities into binary code that can be extremely difficult to detect. However, the documents obtained by The Intercept don't include any concrete examples of a compromised Xcode being used in the wild.

These new developments are the latest in a long line of depressing revelations from the documents released by former NSA employee Edward Snowden. For a fuller picture of the CIA's attempts to circumvent encryption measures, The Intercept's full report is well worth a read.

Tip: You can use the A/Z keys to walk threads.
View options

This discussion is now closed.