The Fight for Privacy– Apple vs. the Federal Government

AVG’s Chief Legal Officer, Harvey Anderson recently sat down with Marty Gonzalez from San Francisco’s Kron 4 Morning News Weekend to discuss why Apple is fighting back against privacy disclosure.

Over the last few weeks the entire country has been discussing the court order enforcing Apple to unlock data security from the iOS device used by one of the alleged terrorists in the San Bernardino shooting.  Whether talks of support were in favor of the Federal government or for the tech giant, the larger issue that continues to rise to the surface is how this could jeopardize the privacy of millions of iOS users.

Recently, AVG’s Chief Legal Officer, Harvey Anderson sat down with San Francisco’s own Marty Gonzalez from Kron 4 Morning News Weekend, to discuss the severity of Apple complying with the ruling and unlocking the door to privacy.

VIDEO: Chief Legal Officer discusses Apple vs Federal Government

Gonzalez: ….So far it’s been a stalemate between the FBI and Apple. What would be the long term range impact of Apple refusing this court order to crack the code?

Anderson: I think it’s dangerous what’s happening right now…You’re essentially asking a company to introduce a vulnerability, a bug, a security flaw into its system. Once that happens, there’s not a lot of confidence that this bug will only be used for this case. Suppose an authoritarian government gets it, suppose a malicious hacker gets it. Will it also be used the next time you want to get data….?

Gonzalez: Let’s say people are, people are thinking, wait a minute, why doesn’t Apple just give the FBI the phone, Apple cracks the code and gives it back to the FBI and it’s just a one-time deal. Is that not plausible?

Anderson: Not really. Actually, what happened in this case is that Apple was working very closely with the FBI and right after the phone was taken into custody it appears that we just learned is that the Apple ID password was reset. So Apple has a very easy way to do an iCloud backup of this phone. The phone could have been brought to a trusted network, the network would have recognized the data, and then the government could have gotten the data from Apple’s Cloud which it has access to. But someone within the San Bernardino county officials recently tweeted that the FBI asked them to reset the passwords, which prevented this easy method to get the data.

Gonzalez: Apple and the Federal government have been arguing the whole topic about encryption for years. This is just the latest step. Where do you think this issue goes from here?

Anderson: It’s so unknown. It’s such a dangerous precedent. If this order is upheld. As you know this order was actually an ex parte order. Apple has not had a chance to oppose it legally but I think it’s such a dangerous to force a company to introduce a security flaw. The problem is that there is no privacy without security. That’s the underlining paradigm that exists here. Once you start to take away security, it starts to compromise people’s privacy. It’s not privacy against the proper judicial use of disclosure and discover it’s against others.

Gonzalez: Apple is arguing that once it’s gone, it’s gone.

Anderson: Exactly.

Apple Releases Security Update for Apple TV

Original release date: February 25, 2016

Apple has released a security update for Apple TV to address multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected device.

US-CERT encourages users and administrators to review the Apple security update for Apple TV 7.2.1 (3rd generation) and apply the necessary update.


This product is provided subject to this Notification and this Privacy & Use policy.

Executable installers are vulnerable^WEVIL (case 26): the installer of GIMP for Windows allows arbitrary (remote) and escalation of privilege

Posted by Stefan Kanthak on Feb 25

Hi @ll,

the executable installer gimp-2.8.16-setup-1.exe (and of course
older versions too) available from <http://www.gimp.org/downloads/>
loads and executes UXTheme.dll from its “application directory”.

For software downloaded with a web browser the application
directory is typically the user’s “Downloads” directory: see
<https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html

Re: Executable installers are vulnerable^WEVIL (case 26): the installer of GIMP for Windows allows arbitrary (remote) and escalation of privilege

Posted by Stefan Kanthak on Feb 25

“Jernej Simončič” <jernej|s-os () eternallybored org> wrote:

UXTheme.dll is loaded when “visual styles” and/or “themes” are
DISABLED (which is the case in my test systems), either via GUI, via

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemeManager]
“ThemeActive”=”0”

or via stopping/disabling the “themes” service:

NET.EXE Stop Themes
SC.EXE Config Themes…

Executable installers are vulnerable^WEVIL (case 4): InstallShield's wrapper and setup.exe

Posted by Stefan Kanthak on Feb 25

Hi @ll,

executable installers [°] created with InstallShield (see
<http://www.flexerasoftware.com/producer/products/software-installation/installshield-software-installer/>
alias <http://installshield.com/>) are vulnerable:

1. Their wrappers/self-extractors load and execute a rogue/bogus/
malicious RichEd32.dll [‘] (and other DLLs too, dependent on
the version of Windows) eventually found in the directory they
are…

Various Linux Kernel USERNS Issues

Posted by halfdog on Feb 25

Hello List,

Here are some issues recently discovered:

* Overlayfs over Fuse Privilege Escalation: On some systems, e.g.
Ubuntu Wily, it is possible to place an USERNS overlayfs mount over a
fuse (file system in userspace) mount. Inactive SUID binaries in the
user-controllable fuse filesystem may then be copied to other
filesystems in copy_up, thus allowing unprivileged users to create
arbitrary SUID binaries on the disk. Read more…

(CRD…