They could probably go directly to the app platform like Apple Apple Store or Google Play Store, I think Apple and Google has the signing keys to forcibly push an update (correct me if I’m wrong, but I’m pretty sure that’s the case).
Can governments compell mobile app developers to push out targeted updates as a privilege escalation or pivot point on a "suspect's" device?
Submitted 2 weeks ago by andyortlieb@lemmy.sdf.org to [deleted]
Comments
IDKWhatUsernametoPutHereLolol@lemmy.dbzer0.com 2 weeks ago
WhyJiffie@sh.itjust.works 2 weeks ago
google does for sure. a few years ago they demanded all developers to hand in their keys in the pretense of efficiency
kibiz0r@midwest.social 2 weeks ago
Probably, but they don’t really have to. Exploiting the OS itself is way better.
slazer2au@lemmy.world 2 weeks ago
Depending on the country Yes.
Australia for example has the Technical Access and Assistance laws for this specific purpose.
Now, consider Australia is part of Five Eyes that means US, NZ, UK, and Canada has this capability via proxy.
bjoern_tantau@swg-empire.de 2 weeks ago
Probably. Though they would probably rather go. through Apple or Google to do it.
spidertrolled@lemmy.blahaj.zone 2 weeks ago
Android app dev here, i cant tell you what governments are capable of, but i can describe for you some of the complicating factors preventing them from doing this.
For one, to prevent impersonation, apps are cryptographically signed by the developer using a private key they never share with anyone (like a password), and the public key is sent to Google Play and the App Store so that they can verify the identity of the uploader. This prevents app store listings from being hijacked by rivals, competetors, hackers, pirates, foreign governments, and yes, their own government. So, any goverment cant just walk up and push a rogue update to the store.
For two, deploying app updates isn’t my job, it’s Google’s and Apple’s. In my opinion if the government wanted to hijack the supply chain, going directly to Apple or Google would be the way to do it. The narrowest group of people I can push updates to are the people who opted into alpha or beta versions. To target an individual, youd have to do it through Google or Apple.
For three, my boss barely gives me enough time and resources to meet the company’s own goals, let alone letting me clean up tech debt. The idea of a government that twists my boss’s arm to force me to work for the government instead of the shareholders is kinda funny and nonsensical. I live in the USA, where shareholders are king. I bet that even if we went full toltalitarian this would never happen because of rich people backlash. So i dont think the hacking coming from inside a company would happen. Then again, i perhaps dont work for a juicy enough place to see how a government could solve this problem.
And last, money money money. Programmers are not cheap. Designing and dedicating and selecting targets for an attack isnt cheap. Hacking into a company to steal their private key isnt cheap, and could also be expensive in a political sense if the wrong people get pissed off aboit it… If paranoia is what drives your question, then ask yourself, are you a high profile politician? A billionaire? A high profile leader of a movement like Martin Luther King Jr? Someone actually worth spending several millions of dollars on to spy on? If you’re a simple petty theif or protestor than i wouldn’t bother worrying about this.
Tl;dr So basically, id only worry about relying on apps owned by the government.
Rhynoplaz@lemmy.world 2 weeks ago
I would bet that some devs could be persuaded by some governments, but I don’t suspect that any major company would do that without MAJOR benefits to themselves.
Which means, yes, it’s probably happened, and will again, and they were probably Chinese or Russian apps.