Apple are much much smarter than me, so I’m sure have mitigated against this, but this feels like a securirty nightmare waiting to happen:
Bad guy gets hold of the technology, works out an exploit to send unofficial update and then “patches” a containership full of iPhones.
Trusted certificate exchange negates that scenario.
I’m sure it’s fool-proof and no state-level actor will ever find a way around it
Why would they attempt to go through unsold iPhones? They can simply force Apple to push updates to all existing iPhones.
If I’m (say) the UK intelligence service and I want to spy on (rolls dice) a group of people in Switzerland- it much easier for me to intercept their packages and patch them in transit then having to talk to Apple.
I disagree. If the packages aren’t routed through UK, you’d have to work with other countries secret service, distribution companies, and you have much more legal troubles to consider.
Because clearly a secret service of one country could never infiltrate FedEx’s distribution depot in another.
Because the secret service of one country acting in another country where they don’t have jurisdiction is an international political crisis that could lead to war. Don’t play dumb.
One means a country forcing a company acting inside that country to do something. The other means one country having to ask another country to be allowed to force a company acting inside the other country to do something. See where one is much easier?
I think this is very clever, a great idea. I also think someone is going to figure out how to turn on iphones via NFC and upload malware of some kind.
