Re:What Businessweek got wrong about Apple
by rocqua on Friday October 05, 2018 @11:19AM
(#18148807)
Something like triggering a memory-read of a specific address the moment you see a TLS diffie helman exchange on the wire?
The idea being that you can recover the session key, and thus break the encryption retroactively.
That requires more than just access to the network, but it is rather simple.
With just access to the network, perhaps one could do spoofed DNS responses that are never seen on the network? A very simple '1% of the time, set the gmail.com A record to the chinese gmail IP' might be enough.
One could create mayhem by sending false ARP or DHCP responses, but that is only mayhem. Perhaps if it is externally triggerable it is useful offensively as DoS.
If we're talking about being able to make changes at the OS level, surely those should be relatively easy to spot?
If we're talking about copying packets, wouldn't that be useless under most circumstances?
If we're talking about doing whatever on a mass scale, surely most of the data would be junk and a huge and very clever backend would be needed to sift out the useful elements?
Presumably none of this is impossible, but I haven't yet seen a good description of how it's all supposed to fit together.