Tag Archive for: Questionable

Apple Leak Shows Corellium’s Questionable Dealings


A picture of a hand holding up a grey iPhone with the camera side facing the viewer, against a blurred background.
Apple tries to uphold its copyright claim, but loses hands down to Corellium.
Image credit: Unsplash 

A 507-page leaked document from an Apple lawsuit against Corellium alleges the cybersecurity firm of copyright infringement and intentionally compromising user data with an iOS tool. The document claims the firm sold the software to spyware and malware distributors, including the NSO Group—creators of the infamous Pegasus spyware—DarkMatter, Paragon, and Pwnzen Infotech.   

Failing to prove the copyright infringement claims against Corellium, which were based on the Digital Millenium Copyright Act, Apple settled out of court in 2020. However, the settlement terms remain confidential. 

Corellium is a cybersecurity firm specializing in creating iOS and Android virtualized systems. These systems help researchers conduct security testing on devices, like iPhones, without actually buying them. 

But, in 2019, when it created and sold duplicate iOS systems, Apple sued the firm for copyright infringement. Confident in the security of its operating system, Apple had offered a $1 million bug bounty to anyone who could find gaps in it. 

According to the leaked document, Correlium’s virtualization technology went beyond security testing, and violated users’ privacy. An excerpt from the document alleges:

“Although Corellium paints itself as providing a research tool for those trying to discover security vulnerabilities and other flaws in Apple’s software, Corellium’s true goal is profiting off its blatant infringement…Far from assisting in fixing vulnerabilities, Corellium encourages its users to sell any discovered information on the open market to the highest bidder.”
Apple states Correlium virtualization technology goes beyond its scope and harms users instead of merely trying to discover bugs.

Direct Emails to Banned Surveillance Firms

Basing its lawsuit on copyright infringement claims, Apple asserted Corellium had no license to duplicate the iOS infrastructure and to virtualize it for its customers. It requested the court to stop Corellium from selling and marketing Apple’s software. However, copyright infringement isn’t the only claim…

Source…

Game Of (Internet) Life: How Social Media Reacts To Questionable News

On April 11, Princeton mathematician and the inventor of “Game of Life” John Horton Conway passed away from the coronavirus. Known as a “magical genius” whose curiosity extended beyond just mathematics, the passing was a devastating blow to many who loved the man.

Yet as news of his passing broke, an interesting scenario developed. Instead of a formal statement from the institution or his family, the news first appeared on Twitter. With no verifiable proof of the claim, many were left struggling to determine whether to believe the story.

This scenario––a questionable story that can be proven true or false in time––presents a challenge for combating the spread of false information online. As we have seen many times before on social media, stories are often shared prior to the information being verified. Unfortunately, this will increasingly occur––especially in an election year and during a pandemic. Therefore, examining how social media responded during this particular event can help better determine the rules and patterns that drive the spread of information online.

Around 2:00 pm EST on Saturday, April 11, news started to spread on social media that John Horton Conway had died. The main source was a tweet that came from a fellow mathematician, who expressed his condolences and shared a story of Conway writing a blog post for April Fool’s Day.

As the news began to spread, most individuals who saw the tweets accepted the information as true and began expressing condolences themselves.

However some started to question the news; mainly because the original tweet had no source verifying the claim. As time went on, people began to speculate that this may indeed be a hoax, and many began deleting and retracting earlier tweets; a void existed where a source should be.

Users filled that void with Wikipedia, a platform where any individual can make changes to the information on any given page. However, this led to a series of citation conflicts, where users would post and then others would delete the post, claiming a lack of source.

The confusion eventually died down as more individuals who knew John Horton Conway explained what had happened, and how they knew. Indeed, the account that first broke the news followed up later with an explanation of what happened. But in that brief window where questions arose, we received a glimpse into how social media reacts to questionable news. And as if discovering the rules to a “Game of Misinformation,” this teaches us a few important lessons about user behavior and how misinformation spreads over time.

First, most users quickly trusted the initial reports as the information filtered in. This is to be expected: research has shown that individuals tend to trust those in their social networks. And indeed, the mathematician whose tweet was the primary source, while not the closest person to the deceased, was in the same community. In other words, what he said had weight. Further, by linking an article in Scientific American, users may have made a connection between the news and the article, even when the tweet did specify that was not the case.

Because of this level of trust within networks, individuals must carefully consider the content and the context by which they share information. Rushing to post breaking news can cause significant harms when that information is incorrect. At the same time, presentation can also have a drastic impact on how the reader digests the information. In this case, linking to the Scientific American story provided interesting context about the man behind the name, but also could give the reader the impression that the article supported the claim that he had died. That is not to say that any tweets in this situation were hasty or ill-conceived, but individuals must remain mindful of how the information shared online is presented and may be perceived by the audience.

Second, people do read comments and replies. The original tweet or social media post may receive the most attention, but many users will scroll through the comments, especially those who post the original material. This leads to two key conclusions. First, users should critically examine information and wait for additional verification before accepting assertions as truth. Second, when information seems incorrect, or at least unverified, users can and should engage with the content to point out the discrepancy. This can mean the difference between a false story spreading between 1,000 people or 1,000,000 people before the information is verified/disproven. Again, while this will not stop the spread of false information outright, it can lead to retractions and a general awareness from other users, which will “flatten the misinformation curve”, so to speak.

Finally, when a void of sources exists, individuals may try to use other mediums or hastily reported news to bolster their point of view. In this case, so-called “edit wars” developed on John Conway’s Wikipedia page, with some writing that he had died while others removed the information. While it is impossible to say whether the same individuals who edited the Wikipedia page also used it as evidence to support the original tweet, it does highlight how easy it could be to use a similar method in the future. Users often have to rely on the word of a small number of individuals in the hours following the release of a questionable story. When this is the case, some may try to leverage the implicit trust we have in other institutions to bolster their claims and arguments. In this case, it was Wikipedia, but it could be others. Users must carefully consider the possible biases or exploits that exist with specific sources.

Like Conway’s Game of Life, there are patterns to how information spreads online. Understanding these patterns and the rules by which false information changes and grows will be critical as we prepare for the next challenge. Sadly, the story that spread earlier this month turned out to be true, but the lessons we can learn from it can be applied to similar stories moving forward.

Jeffrey Westling is a technology and innovation policy fellow at the R Street Institute, a free-market think tank based in Washington, D.C.

Techdirt.

Samsung Galaxy S20/+ Review: Smartphones this good shouldn’t have questionable cameras – 9to5Google

Samsung Galaxy S20/+ Review: Smartphones this good shouldn’t have questionable cameras  9to5Google
“Don’t Plug Your Phone into a Charger You Don’t Own” – read more

Apple Filed A Silly, Questionable DMCA Notice On A Tweeted iPhone Encryption Key… Before Backing Down

Copyright continues to serve its purpose as a tool for censorship, it seems. This week there was some hubbub over Apple’s highly questionable decision to send a DMCA takedown notice over a tweet by a security researcher who goes by “Siguza,” and who appeared to publish an iPhone encryption key on Twitter:

Twitter took it down upon receipt of the takedown notice, but later put it back after Apple rescinded the takedown — either realizing that the takedown was bogus or futile (or, I guess, both).

You can understand (sorta) why Apple would want to protect the key, but copyright seems like exactly the wrong tool for the job. Of course, that’s often the case, but copyright is such an easy tool to abuse to try to silence speech that it is often the preferred tool of would-be censors. This is just one example. But it does raise questions. Is an encryption key even copyright-eligible? That seems highly unlikely. Copyright only is supposed to apply to the creative elements of a work, and it would be difficult to argue that an encryption key meets the “creative” level necessary. US courts have already decided that phone numbers are not subject to copyright (even made up numbers), so it seems unlikely that an encryption key would pass muster for getting a copyright.

Potentially Apple could have been making a DMCA 1201 “anti-circumvention” argument as well — but even that seems silly, and only highlights the problems of the anti-circumvention provisions of Section 1201 of the DMCA. When a single tweet with a single code is seen as “circumvention” then there’s a big problem — and that problem is the law.

It’s good that Apple backed down on this, though it still highlights the problems of the DMCA takedown process, and how it can be used unfairly for censorship — even if that “censorship” completely backfired this time.

Permalink | Comments | Email This Story

Techdirt.