TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

233 点作者 NTroy将近 4 年前

9 条评论

jonathanmayer将近 4 年前
(Context: I teach computer security at Princeton and have a paper at this week&#x27;s Usenix Security Symposium describing and analyzing a protocol that is similar to Apple&#x27;s: <a href="https:&#x2F;&#x2F;www.usenix.org&#x2F;conference&#x2F;usenixsecurity21&#x2F;presentation&#x2F;kulshrestha" rel="nofollow">https:&#x2F;&#x2F;www.usenix.org&#x2F;conference&#x2F;usenixsecurity21&#x2F;presentat...</a>.)<p>The proposed attack on Apple&#x27;s protocol doesn&#x27;t work. The user&#x27;s device adds randomness when generating an outer encryption key for the voucher. Even if an adversary obtains both the hash set and the blinding key, they&#x27;re just in the same position as Apple—only able to decrypt if there&#x27;s a hash match. The paper could do a better job explaining how the ECC blinding scheme works.
评论 #28104915 未加载
评论 #28106123 未加载
kfprt将近 4 年前
It won&#x27;t be long until these type of systems are mandated. Combined with a hardware root of trust it&#x27;s not inconceivable that modifying your hardware not to report home will also be made a crime. It never stops with CSAM either, pretty soon it&#x27;s terrorism and whatever vague new definition they use.<p>The focus on CSAM seems extremely hypocritical when authorities make such little effort to stop ongoing CSA. I would encourage everyone to research the Sophie Long case. Unless there is image or video evidence the police make little effort to investigate CSA because it&#x27;s resource intensive.
评论 #28108886 未加载
评论 #28108933 未加载
joe_the_user将近 4 年前
Regardless of whether this attack works or not, you&#x27;d assume this scheme produces a wider attack surface against pictures in iCloud and against iCloud users. One attack I could imagine is a hacker uploading child porn to a hacked device to trigger immediate enforcement against a user (and sure, maybe there are more controls involved but would you carry around a very well-protected, well-designed hand grenade in your wallet just so you&#x27;re bad, it&#x27;ll explode).
评论 #28106355 未加载
评论 #28105324 未加载
jl6将近 4 年前
For some reason, after reading the initial reporting on this system, I thought it was running against <i>any</i> photos on your iPhone, but now I read the actual paper, it seems like it only applies to photos destined to be uploaded to iCloud? So users can opt out by not using iCloud?
评论 #28104753 未加载
评论 #28104870 未加载
评论 #28104721 未加载
评论 #28107386 未加载
评论 #28106069 未加载
评论 #28105087 未加载
评论 #28104742 未加载
shuckles将近 4 年前
The question presumes the database leak also comes with the server side secret for blinding the CSAM database, which is unlikely (that’s not how HSMs work) and would be a general catastrophe (it would leak the Neural Hashes of photos in the NCMEC database, which are supposed to remain secret).
评论 #28104270 未加载
评论 #28104261 未加载
ashneo76将近 4 年前
Pretty soon housing your own infra and not using the mandated govt phone could be made a crime.<p>But think of the children and security of the society. Couple that with constant monitoring of your car and you can be monitored anywhere
评论 #28106792 未加载
kook_throwaway将近 4 年前
Barely related, but is CSAM a new acronym? I hadn&#x27;t heard it until this fiasco.
评论 #28104239 未加载
whatever1将近 4 年前
Why does Apple even bother with encryption? They should just skip all of the warrant requirements etc and use their iCloud keys to unlock our content and store it unencrypted at rest.<p>Maybe they can also build an api so that governments can search easily for dissidents without the delays that the due process of law causes.
评论 #28105043 未加载
评论 #28105099 未加载
评论 #28104673 未加载
roody15将近 4 年前
thanks e