Pwn All The ThingsVerified account

Typical. Rain starts 2 minutes after I go out, stops 2 minutes after I come back in.

Extremely niche tweet but my God it delivershttps://mobile.twitter.com/jckarter/status/1428093469755527168 …

Does Apple ask other auditors for free labor after setting them up to fail? "Hi accountants, our calculation on this napkin is correct and the warehouse of receipts is subject to inspection by accountants who wish to verify it'? Of course not. Only this industry gets screwed.

And notice the implicit assumption here in the first place. Security researchers *will* do the review, fighting over all of the obstacles intended to make actually doing the review simple. For free. Why? Why is this considered acceptable?

Perhaps one way would be to write your own app to find unusual ways to compute the master hash and validate that it is valid, without relying on static graphical elements that hackers or Apple could surgically manipulate. But you think that app would get past AppStore review?

That's even before we get into the various encrypted firmwares where you can't even see the binary, or the apps on the device that are partially or fully encrypted.

Analysis of the binary itself is not even sufficient if Apple itself is in your threat model; the kernel sits underneath it, and is enormous and, you guessed it, also symbol stripped to frustrate reverse-engineering.

How about dynamic analysis? Unless Apple is planning on giving the iCloud app the get-task-allow permission so you can attach a debugger, that would be out of the question on an vanilla iPhone. You'd need to resort to jailbreaks, or, heaven forbid, a Corellium device

Are they going to do static analysis of the binary? Ok. But iOS binaries are intentionally stripped of non-essential symbols precisely to make this kind of analysis harder.

If the evidence were real, it would be both easy, and in their interests, to show it plainly and widely. And instead we have layers of intentionally stripping context and obfuscation. Because it's fraud.

Someone took probably an http log or wireshark, stripped it of context to obfuscate where it came from, put it in an RTF document, and then to further hide what it means, intentionally encoded it into hex to make it look scary and technical.

In case you're wondering, the IP addresses are a filtered list of normal web-crawlers that just continuously scan the entire internet, (and you'll see similar logs on literally every website on the internet).