Researchers working for the CIA began attempting to compromise Apple iPhones a year before the phone was released publicly, in what has now become a decade-long "sustained effort" to crack the security of the company's phones and tablets, according to documents released by former NSA contractor Edward Snowden and published by The Intercept.
Documents provided to The Intercept detail a number of initiatives, including one in which government researchers targeted essential security keys that are used to encrypt data stored on Apple devices, a clear attempt to bypass the company's mobile security provided to hundreds of millions of customers.
"Studying both 'physical' and 'non-invasive' techniques, U.S. government-sponsored research has been aimed at discovering ways to decrypt and ultimately penetrate Apple's encrypted firmware," reported The Intercept. "This could enable spies to plant malicious code on Apple devices and seek out potential vulnerabilities in other parts of the iPhone and iPad currently masked by encryption."
CIA researchers even claimed at a secret annual gathering, called the "Jamboree," that they had developed their own modified version of XCode, Apple's proprietary software application development tool, allowing them to stealthily install surveillance backdoors into any app or program created with the tool. Such tools would allow the CIA to steal and decrypt users' passwords and communications, though it's not clear how CIA hackers would get Apple developers to use their modified tools.
It's part of a broader top-secret program by the U.S. government and British intelligence agencies to hack "secure communications products, both foreign and domestic," including Google Android phones, in order to "develop exploitation capabilities against the authentication and encryption schemes," according to The Intercept.
Researchers even demonstrated how a modified version of the program Apple uses to deliver updates to laptops, OS X updater, could be used to install key-loggers on Mac computers, allowing the CIA to record all keystrokes on the device.
One extremely sophisticated interception method involved studying the electromagnetic emissions of Apple's Group ID to extract the encryption key, while another presentation focused on how to physically extract the key
"If U.S. products are OK to target, that's news to me," Matthew Green, a cryptography expert at Johns Hopkins University's Information Security Institute, told The Intercept. "Tearing apart the products of U.S. manufacturers and potentially putting backdoors in software distributed by unknowing developers all seems to be going a bit beyond 'targeting bad guys.' It may be a means to an end, but it's a hell of a means."
The documents stop short of specifying how successful these methods have been and don't mention any specific examples of hacks conducted by the CIA or other intelligence agencies. Both the CIA and Apple declined to comment on the story.
