Last week Google disclosed a large-scale hacking effort that it said targeted users of Apple devices. It was a bombshell story.
But now Apple has gone on the attack - angry in public, and absolutely incensed in private at what is being seen as something of a stitch up. Google is standing by its research.
In a statement posted on Friday, Apple took issue with Google’s characterisation that this was a broad attack on all iPhone users.
"Google’s post, issued six months after iOS patches were released, creates the false impression of 'mass exploitation' to 'monitor the private activities of entire populations in real time,' stoking fear among all iPhone users that their devices had been compromised,” it reads.
"This was never the case.”
Apple’s bone of contention isn’t so much about what Google’s Project Zero team included in its report. Rather, Apple is upset about what was left out. The view from Cupertino is that Google’s business interests in China led it to pull back on describing the attack as being targeted at the persecuted Uighur community.
"The sophisticated attack was narrowly focused, not a broad-based exploit of iPhones 'en masse' as described. The attack affected fewer than a dozen websites that focus on content related to the Uighur community.”
Android affected
This perspective is backed up by independent research from Volexity, a cyber-security firm based in Washington DC. It published a report earlier this month looking into the same threat, and stated unequivocally that Uighurs were the target - detailing 11 websites that had been used to carry out the attack.
Most notably, the Volexity report states that as well as Apple’s iOS, Google’s own mobile operating system, Android, was also targeted - a detail that was missing from Google’s research.
Google insists it didn’t know Android was affected - but it’s well aware how it looks.
Tim Willis, a researcher on the Project Zero team, wrote in a tweet that Google’s Threat Analysis Group "only saw iOS exploitation on these sites when TAG found them back in Jan 2019 (and yes, they looked for everything else as well)”.
The independent researchers I’ve spoken to are mostly giving Project Zero the benefit of the doubt on that point. It’s a highly respected group in the cyber-security space, and hasn’t been seen as some kind of weapon against Google’s rivals. Besides, this isn’t exactly the first time it’s found something involving Apple - the group has reported over 200 vulnerabilities to the company to date, most without this kind of fanfare or controversy.
"Project Zero posts technical research that is designed to advance the understanding of security vulnerabilities, which leads to better defensive strategies,” a spokesperson said.
"We stand by our in-depth research which was written to focus on the technical aspects of these vulnerabilities. We will continue to work with Apple and other leading companies to help keep people safe online.”
Skin in the game
But there are big questions about how Google is handling the dreaded “C” word: China. There’s no mention of the country in Project Zero’s research, and a spokesman on Friday wouldn’t tell me if Google had known the Uighurs were being targeted. But given the researchers said they’d identified various web addresses affected, it seems very unlikely that two-and-two were not put together. One of the URLs, to give you an example, was quite clearly a news site aimed at Uighur readers, or at least those interested in their plight.
Google has form in this area. You may remember a story last month regarding China-backed misinformation efforts on Facebook, Twitter and YouTube, designed to sow discord in troubled Hong Kong. Unlike Facebook and Twitter, which stated clearly they felt Beijing was behind the efforts - Google stopped short, saying only that it had removed material related to protests in Hong Kong.
There are also questions for Apple, however. If, as claimed in its statement, Apple knew about the iOS flaw before Google informed them, why did they not properly inform their users? Why, if it knew there were several booby-trapped websites scooping up data on the Uighurs, did it not warn them?
And Apple, like Google, won’t say if they think Beijing is directly responsible. That’s the bigger story here - the extent to which China’s malicious behaviour is being swept under the carpet, because the companies involved have too much skin in the game.
DISCLAIMER: The Views, Comments, Opinions, Contributions and Statements made by Readers and Contributors on this platform do not necessarily represent the views or policy of Multimedia Group Limited.
Latest Stories
-
CLOGSAG vows to resist partisan appointments in Civil, Local Government Service
12 minutes -
Peasant Farmers Association welcomes Mahama’s move to rename Agric Ministry
13 minutes -
NDC grateful to chiefs, people of Bono Region -Asiedu Nketia
16 minutes -
Ban on smoking in public: FDA engages food service establishments on compliance
16 minutes -
Mahama’s administration to consider opening Ghana’s Mission in Budapest
18 minutes -
GEPA commits to building robust systems that empower MSMEs
21 minutes -
Twifo Atti-Morkwa poultry farmers in distress due to high cost of feed
23 minutes -
Central Region PURC assures residents of constant water, power supply during yuletide
24 minutes -
Election victory not licence to misbehave – Police to youth
26 minutes -
GPL 2024/2025: Nations thrash struggling Legon Cities
28 minutes -
Electoral offences have no expiry date, accountability is inevitable – Fifi Kwetey
29 minutes -
Ghanaians to enjoy reliable electricity this Christmas – ECG promises
36 minutes -
Police deny reports of election-related violence in Nsawam Adoagyiri
39 minutes -
‘We’re not brothers; we’ll show you where power lies’ – Dafeamekpor to Afenyo-Markin
43 minutes -
EPA says lead-based paints are dangerous to health, calls for safer alternatives
3 hours