12 ms·

Edward Snowden interview: 'Smartphones can be taken over'

256 points by mhandley 11y ago

jgrahamc 11y ago
Old, old news: http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartp...
- epistasis 11y ago
  Yes, but it certainly bears repeating, until it is also widely known.
  - cheepin 11y ago
    Personally, I did not remember this capability until I saw this article, and I've followed the whole deal a lot closer than my circle of friends. People either don't know or don't care and don't know that they should care. In the presidential debates and primary campaigns, how many times did you see someone say that this is a major issue? I can definitely point to presidential hopefuls making the opposite point, however.
- corin_ 11y ago
  Have only skimmed your link, don't have time to read right now, but at a glance it seems to be entirely about passively spying on data being communicated, whereas this new claim is that they can actively take control of your phone remotely, which is pretty different. Forgive me if more time reading would have made this comment irrelevant. Will be coming back to this thread later and reading more.
  - jgrahamc 11y ago
    Why bother composing a response like that without reading the article I posted?
    - Someone1234 11y ago
      I read your article in full. It is mostly about the broad collection of data passively (e.g. from smartphone apps, or other leaky sources). It has two slides at the bottom hinting at phone plants, but that isn't really what the article is about and it doesn't spend a lot of time talking about them. I'd agree with the above poster, your article is mostly irrelevant if otherwise interesting. I will say a lot has been said about phone plants previously, but your article isn't about that really.
    - sigmar 11y ago
      He already told you the reason, he doesn't have time to read it right now. Did you read the link you posted? Because I read it, and his skimming is 100% accurate. The article talks about Angry Birds, Facebook, google maps, and other social apps leaking personal data by transmitting it over the internet and being intercepted. Completely different from the new BBC article.
- acaloiar 11y ago
  I believe the salient claim here is the exploitability of smartphones via SMS, a la Stagefright. The Guardian article makes no such claim.
rm_-rf_slash 11y ago
None of this should be a surprise. We should expect that any device with Internet access can be hacked by someone, regardless of their intentions. If it isn't the NSA it's Chinese "patriot hackers" or Russian cyber-criminals operating with the consent of their governments. Or many others. Instead of seeing this security state as a binary, we should always consider two questions: 1: How much do we value our privacy and security versus the needs of society (in the case of backdoors and so on), and, 2: How much do we trust the people whose business is having the ability to break into our phones? I don't like how invasive our security agencies are but if they end up preventing major crimes or terrorist attacks I can't say what they do is wrong. At the end of the day, I want the people defending me to be more powerful than the people attacking me, but I don't want my defenders to use their same tools against me.
- DanBC 11y ago
  I agree with your post but you left out "How much should we trust companies who are intent on slurping as much data as possible, storing it insecurely, with the main purpose of selling it". NSA's / GCHQ's work is made easier by companies who ask for too much data, and who don't know how to send that data securely or keep it secure on their servers.
- Zigurd 11y ago
  It's true that everyone wants to hack your device.The difference is that NSA has set the tone: Make the technology providers under your influence include exploitable flaws and back doors. PCs are fully mature products and 99% of customers don't need performance breakthroughs. That means it should be possible to make open hardware and open software that make exploits much harder than they are today. Phones are getting there. It's time to make hardware and software that optimize for verifiable security.
  - bb101 11y ago
    When Blackberry 10 handsets boot up, they spend a few seconds verifying the security of the software. Since the handsets are practically impossible to root, I'm guessing any alterations would be flagged up.
cdnsteve 11y ago
The all seeing eye...
patrickaljord 11y ago
Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone if asked by the government. As long as you don't control the backend and even the frontend, you're at the mercy of whoever controls it (Apple in this case). That's why all the Apple talks on privacy lately sounds like not much more than good marketing to me.
- rsync 11y ago
  "Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone" ... or on your SIM card, which is a full computer with CPU and memory and can run arbitrary java programs that your carrier can upload to it.
  - _vn5r 11y ago
    AFAIK, sim cards are basically storage devices. When did they get CPUs?
    - blackguardx 11y ago
      I think in the 90s. Check out: https://en.wikipedia.org/wiki/Universal_Integrated_Circuit_Card https://en.wikipedia.org/wiki/Universal_Integrated_Circuit_C...
    - kw71 11y ago
      They have always had CPUs. Just like most other types of ISO7816 cards, including any that have any kind of pin protection for the data stored within.
    - effie 11y ago
      More on this little computer: http://www.gemalto.com/techno/sim/ http://www.gemalto.com/techno/sim/
      - _vn5r 11y ago
        Wow, thanks!
djyaz1200 11y ago
Edward Snowden is not a hero IMO, anyone who cared to look knew for years the government had vast surveillance powers. Is anyone else tired of seeing his headlines? The guy seems to really want to be a celebrity? Does he deserve that? I'm not trying to be rude, only suggesting we rethink our attention to him.
- hbosch 11y ago
  I choose to think he's rolling out headlines, over time, in order to make sure this issue never fades away like so many other things do. The pace of our media and culture makes important items this NSA scandal become forgotten quickly.
  - krapp 11y ago
    Snowden isn't "rolling out headlines over time," media companies are. Although it's obvious Edward Snowden is consciously trying to leverage media (and now social media - his Twitter account is obviously image-conscious) to his advantage in keeping the narrative alive, let's not act like he's actually running things. The linked article seems to be as much advertisement for Snowden-related BBC properties as it is an attempt at maintaining awareness of the subject of Snowden's revelations themselves.
- bdamm 11y ago
  He's the one who provided the evidence. Without evidence you're just a conspiracy theorist. (Note the theory part.) And frankly he doesn't deserve the fame, and I don't particularly think he wants it either. But the data he provided (illegally, at continuing risk to himself) opened up a much-needed conversation.
  - vezzy-fnord 11y ago
    He's the one who provided the evidence. The evidence was there for a while. Most people could not suspend their disbelief long enough to take it seriously.
- striking 11y ago
tdaltonc 11y ago
Top Comment Paraphrase: "I knew about this before it was cool." When someone posts a new python/lua/lisp feature intro, no one says "I knew that already!" or "No new info here!" But if it's about security or privacy, the HN zeitgeist wants to denigrate it as "old news."
- deleted 11y ago
  [deleted]
- seiji 11y ago
  Nerds tend to operate in a sphere of "once I know something, nobody must ever tell me again." So, they know something and, just by feelings, assume everybody else knows it too. They assume hearing repeated information wastes the time of everybody. The truth is, average people don't even pick up on ideas until the 5th or 8th time they hear them. Even the Snowden revelations weren't revelations per se. We knew about Carnivore before and about the AT&T splicing room and even in the 90s people would half joke half serious comment about how the government watched all online communications. The Snowden documents just solidified the nerd fears. Plus, since the 90s, the Internet grew so big and so popular that people just kinda gave up on the idea that it could even be monitored or tapped en masse. The benefit of the Snowden dump was showing it is possible and it is happening (instead of just being conspiracy theories) and you can't do squat about it.
  - xeromal 11y ago
    I must be average as shit then.
  - vezzy-fnord 11y ago
    even in the 90s people would half joke half serious comment about how the government watched all online communications The 90s actually had one of the most visible examples of NSA intervention, that of the Clipper chip. They assume hearing repeated information wastes the time of everybody. The issue isn't really repeating things, as much as the fact that it took up until Snowden for people to start being legitimately shocked, when they bluntly dismissed decades of prior art.
sigmar 11y ago
It seems strange to me that the Snowden is only now mentioning the "text message" attack vector, after everyone already knows about Stagefright. Is he out of things to leak? or did he mention it before and go unnoticed?
- deleted 11y ago
  [deleted]
- kentt 11y ago
  Yes, he had mentioned it before. Of the top of my head, in "No Place to Hide" he discusses it, but I'm sure you could find a better source if necessary.
- justin66 11y ago
  He handed all his confidential and sensitive documents to reporters before fleeing so, in a real sense, he is "out of things to leak." He seems to be transitioning to a role of explaining to the mainstream press, in short words they can understand, what is going on.
- sweden 11y ago
  The kind of attacks that he is referring are located at the lower levels of the phone, at the SoC level, not at the operating system level. It's something that neither Apple nor Google can control.
  - aaronbrethorst 11y ago
    Allow me to quote the first sentence from the Wikipedia article linked to below: Apple Inc. has developed a range of "System on Chip" (SoC) as well as "System in Package" (SiP) to power their mobile consumer devices. https://en.wikipedia.org/wiki/Apple_system_on_a_chip https://en.wikipedia.org/wiki/Apple_system_on_a_chip
    - spacemanmatt 11y ago
      That's still only the processor that runs iOS. They don't make their own cell processor.
btbuildem 11y ago
HN regulars may well be aware of all these things, but it's good to see this on the pages of the mass media.
daenz 11y ago
> Mr Snowden said GCHQ could gain access to a handset by sending it an encrypted text message and use it for such things as taking pictures and listening in. Are there hardware GCHQ keys in the phone for verifying the encrypted text? I imagine there would have to be, otherwise anybody (with enough time and research) could construct one of these messages to gain control of the phone.
- noir_lord 11y ago
  > otherwise anybody (with enough time and research) could construct one of these messages to gain control of the phone. Which is exactly one of the strongest arguments against building backdoors into products, eventually you won't be the only one with the keys.
- mike_hearn 11y ago
  I suspect "encrypted text" is the result of a journalist mangling "text containing shellcode" or something like that. Obviously once they have malware in the phone itself, controlling it via encrypted / silent SMS would be a fine way to do things though.
verytrivial 11y ago
My understanding may be dated, but I have often wondered if the battle for privacy is a lost cause in the mobile phone space. Even with a ground-up open platform for the phone and OS, current regulation requires blob of 'certified' hardware and software between you and the antenna/network. Short of using my phone to acoustically-couple a 2400baud cryto-stream (the call meta-data of which still being snitched), I'm really not sure if privacy is possible.
- webXL 11y ago
  Not total privacy since the network knows who's on both ends, or at least that you're on one end, but as long as you can tunnel encrypted traffic over it via a hotspot, I'm not sure how that could be cracked.
  - shostack 11y ago
    One way that I've been wondering about is all these new keyboards coming on the market. Things like Swype, Swiftkey etc. They have cloud storage for storing data to feed predictive algorithms, but it essentially becomes a cloud-based keystroke logger. So you may be sending encrypted traffic via hotspot, but your keyboard process running in the background has the raw input data and is feeding that to a server. I'd love to read a more detailed writeup on the security of such apps, which ones are trusted (ie. only using local encrypted storage, no phoning home), etc.
madez 11y ago
I’m trying as good as I can to protect myself against such attacks. My android smartphone is permanently in airplane mode and I don’t use a sim card. Do you still see a security risk?
- blazespin 11y ago
  I keep the battery out at all times, even when I'm using it. Just to be safe.
- copperx 11y ago
  It wouldn't be totally surprising for an airplane mode phone to "phone home" after it has been, say, 72 hours in that mode. I can hardly imagine a trip that long.
- beeboop 11y ago
  I doubt removing the SIM makes any difference, it's only used by your carrier to identify you. If the NSA wants to target you specifically, it wouldn't stop them.
- rdl 11y ago
  Best thing is probably an iPod Touch or iPad Mini without cellular (I'm pro iOS vs. Android, mainly due to secure element and iOS > Android security; there's an argument you could use a secure element plus a new ROM on Android devices to surpass iOS), with a wifi or bt or usb link to an external wifi-4g modem or wifi-wifi router (mifi, portal, whatever).
- TazeTSchnitzel 11y ago
  Airplane mode might lie. Use a faraday cage.
mixmastamyk 11y ago
I would be surprised if Apple has let a vulnerability of "send text message, pwn phone" linger for very long. Article doesn't mention brands or versions, but it is quite important to fully understand. Or does this work at a lower level? I've heard the radio chips themselves are untrustworthy, but how would they control the main OS on another chip?
- mortenjorck 11y ago
  The implication here seems to be that at least Stagefright did, in fact, have software exploiting it in the wild. Perhaps there are similar exploits yet to be found publically, even on iOS, or perhaps this vector has "gone dark" now.
- endymi0n 11y ago
  Enter "the baseband". A dark, undocumented, hardly accessible, obfuscated piece of code that has access to your microphone, GPS, battery management and lots of other gimmicks. https://news.ycombinator.com/item?id=6722292 https://news.ycombinator.com/item?id=6722292 If I were a three-letter-agency I knew where to hide dead bodies while everyone was arguing over operating system security.
  - username223 11y ago
    That sure goes a long way toward showing how powerful Stingrays are, and why Harris and the government really, really don't want information about them getting out. I got a chuckle out of this near the end of the article: > Whenever someone does dive into baseband software, many bugs and issues are found, which raises the question just how long this rather dubious situation can continue. Well, the baseband software was written in the 90s, the article was written in 2013, and I'll bet nothing has changed in the last two years.
    - shostack 11y ago
      Really have to wonder how many of these bugs and issues are "bugs" and "issues."
blazespin 11y ago
The question I have is the issues around crashing a device via texts[1]. Was that part of this scheme? Was it put in there on purpose? 1. http://www.techtimes.com/articles/55893/20150527/one-text-message-crash-iphone-heres-fix.htm http://www.techtimes.com/articles/55893/20150527/one-text-me...
- rtkwe 11y ago
  That's doubtful, 'effective power' (incidentally that bit of the text was completely arbitrary) was (seemingly) a hard crash caused by an error in the text shortening for the banner notification pop down. Tom Scott has a good speculation video on what might be going on that seems pretty sound. https://www.youtube.com/watch?v=hJLMSllzoLA https://www.youtube.com/watch?v=hJLMSllzoLA
cryoshon 11y ago
"Describing the relationship between GCHQ and its US counterpart, he said: "GCHQ is to all intents and purposes a subsidiary of the NSA. "They [the NSA] provide technology, they provide tasking and direction as to what they [GCHQ] should go after." " This is the juciest part. This is the confirmation we've been suspecting for a long time: CGHQ is the NSA, and all of their programs are shared. This means that we can pin the worst abuses of GCHQ onto the NSA, and also confirm that US citizens are directly targeted by even the most outrageously invasive surveillance efforts-- there is no exempt population, proving the NSA's PR lies once again.
- rhino369 11y ago
  Snowden wasn't a liaison between CGHQ and the NSA. How would he know if it were a subsidiary of the CGHQ. If it's from documents he took, then were is the documents showing it? I'm sure there is a lot of cross sharing of information, but to call it a subsidiary is a bold claim. Snowden was a database admin, not John Brennan.
  - cryoshon 11y ago
    I don't have the ultimate answer here, but why were the (highly classified, some marked "no foreign national viewing") GCHQ slide decks on NSA servers? I also assume that their slides reference each others programs frequently. Maybe this is incorrect.
    - caskance 11y ago
      The most obvious answer is that the NSA pwned them.
    - rhino369 11y ago
      They obviously work together very closely. I'm just objecting to the idea that the UK spy agencies are just American outposts and that each agency is responsible for the mistakes/crimes of the others. Maybe they are really pushed around by the US, but I'd have to see more than Snowden making unfounded statements about it. In the past, he's made some illogical leaps based on some of the information he took. It's very easy to do that when you expect the worst of someone/thing.
wicket 11y ago
I'm surprised HN readers don't already know this. It still astonishes me how so many so called "tech savvy" users are content with surrendering their privacy and freedoms to Google or Apple so that they can run the latest "apps". This is why I'm backing the Neo900[1]. It might be a bit pricey and low spec'ed by today's market (a consequence of it catering for a niche market meaning it won't be mass produced) but in my opinion that's a small price to pay to actually own your phone (it's actually more akin to a mobile computer than a phone). [1] http://neo900.org/ http://neo900.org/
- dogma1138 11y ago
  I don't think any one with even basic understanding of technology thought that an intelligence agency can't breach their cellphone. You have a GPS receiver, a microphone, camera, and a data capable modem on you all the time this is pretty much a cold-war era dream come true to those agencies. Heck the layman is probably more "aware" of this than people with better understanding of technology simply because they do not understand the technical difficulties that might be involved in remotely accessing a mobile device. As for the Neo900, It's a nice project and it's has been posted on this site many time, but you should have serious doubts about it being any more NSA proof than a burner you pickup at the bargain bin at Walmart. Yes they have all their physical electronically resetable fuses that in theory will allow you to disconnect the modem, and they do some power usage analysis to ensure that the radio is actually off, but still they are using regulated off-the-shelf hardware, if the NSA wan't to break into that phone remotely they'll find a way if they won't have a way in straight of the bat to begin with which is also quite likely.
  - drdaeman 11y ago
    If the interconnections are limited to the extent said off-the-shelf hardware just can't have privileged access to the other parts of the system, it's safe. That said, it doesn't matter if modem is hacked if it can't do much. Backdooring an MCU so it'd allow access on a secret code from anywhere is surely possible in theory, but it'll be hard to hide the cost of adding such backdoor.
venomsnake 11y ago
If a device is known it can be hacked. Anonymity is the key. Use roaming sim card (it will require some cooperation of the remote operator, so kinda makes it harder). What to do to mitigate - no sim card. If have to use sim card - imei randomizer. Wifi mac address randomizer.
junto 11y ago
Everybody talks about the OS, buy nearly everyone forgets about the base band, the hidden OS on every phone that you have almost no control over. Whilst the media is worrying about Apple iCloud and phone encryption, GCHQ are quietly delving into your base band and enjoying the smoke and mirrors. To use analogy, we are worrying about the government looking under our clothes, whilst in fact they are peeling back or skin and skulls and peering into our humanity.
- niutech 11y ago
  A good read about baseband RTOS: http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...
- mike_hearn 11y ago
  People talk about it less these days because modern modem/baseband chips are sandboxed. In older phones they had bus master access and could do whatever they wanted, hence their frequent targeting by unlockers. But they didn't need all that access and have since been locked down a fair bit. Also, Qualcomm at least got more serious about security and started hardening their firmwares. Also, intelligence agencies tend to be after stuff that the baseband doesn't have any convenient access to, like photos and files on disk. Even though an un-sandboxed baseband could theoretically access the hardware, it'd be doing so in parallel with the real OS and that'd be super painful to implement. Finally, why bother when the OS is such a bigger surface area? The IC's aren't magic, even if they developed some impressive tricks under the cover of secrecy. They attack systems in the same way as your average defcon presenter does.
- aexaey 11y ago
  What about free baseband? http://bb.osmocom.org/trac/ http://bb.osmocom.org/trac/
meapix 11y ago
What strike me most is the amount of people around me who don't care about this.
- r00fus 11y ago
  Well, it's a sort of institutionalized resignation... I mean, if there's nothing you can do about it, what should you be doing? Switching to a blackphone? What if your organization doesn't support a truly secure option? It's like hearing that Microsoft and the NSA had a backdoor 20 years ago - at the time I didn't have an option for my work machine, so I just grunted and went along.
coldcode 11y ago
As much as I admire Mr. Snowden for what he did, he is not an expert outside of the documents he took with him. He isn't privy to anything happening now. He didn't build anything or code anything. All he did was steal from some idiots that should have known better how to secure information. This does not make him omniscient.
- brianpan 11y ago
  What are you arguing here? Is something he said incorrect? I don't think anyone is claiming he is a deity.
DanBlake 11y ago
"Nosey Smurf is the 'hot mic' tool. For example if it's in your pocket, [GCHQ] can turn the microphone on and listen to everything that's going on around you - even if your phone is switched off because they've got the other tools for turning it on." Are they implying that all/most smartphones still communicate with cell towers when turned off? (obviously this isnt happening) - Or do they pwn the device before hand to have it fake that its turning off while remaining on?
- niutech 11y ago
  Well, it can happen: http://www.tomsguide.com/us/nsa-remotely-turn-on-phones,news-18854.html http://www.tomsguide.com/us/nsa-remotely-turn-on-phones,news... and http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...
  - r00fus 11y ago
    Next up: Explosion of sales of Faraday cases for smartphones (and the subsequent banning of sales through ITC and/or legislation). Oh, who am I kidding.
    - mike_hearn 11y ago
      When Snowden met Greenwald+Poitras he apparently just used a fridge to store the phones.
- shostack 11y ago
  Presumably removing the battery stops this? Or is there another internal power source they have access to?
- qq66 11y ago
  I do know that both smartphones and feature phones can turn on while "off," if you set an alarm. However I doubt that they ping cell towers when off, as I've left them off for weeks/months with little battery drain.
shostack 11y ago
What about 3rd party keyboards like those that have recently made their way to iPhones and have been on Android for a while? All of them (even Samsung's swype style keyboard) seem to have some sort of cloud-based storage for your data so it can remain equally predictive across your devices. Is there any good security research out there on how safe these keyboards are and which ones are the worst offenders? Seems like it is essentially a user-installed cloud-based keystroke logger ripe for abuse. I love the functionality of some of them, but man do they terrify me.
nick_name 11y ago
Looks like Vysk's QS1 is aiming to mitigate the baseband hacks - http://www.theguardian.com/technology/2014/jul/25/startup-claims-to-have-built-an-un-hackable-phone-case-that-encrypts-your-calls http://www.theguardian.com/technology/2014/jul/25/startup-cl...

256 points by mhandley 11y ago

Old, old news: http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartp...

epistasis 11y ago
Yes, but it certainly bears repeating, until it is also widely known.
- cheepin 11y ago
  Personally, I did not remember this capability until I saw this article, and I've followed the whole deal a lot closer than my circle of friends. People either don't know or don't care and don't know that they should care. In the presidential debates and primary campaigns, how many times did you see someone say that this is a major issue? I can definitely point to presidential hopefuls making the opposite point, however.
corin_ 11y ago
Have only skimmed your link, don't have time to read right now, but at a glance it seems to be entirely about passively spying on data being communicated, whereas this new claim is that they can actively take control of your phone remotely, which is pretty different. Forgive me if more time reading would have made this comment irrelevant. Will be coming back to this thread later and reading more.
- jgrahamc 11y ago
  Why bother composing a response like that without reading the article I posted?
  - Someone1234 11y ago
    I read your article in full. It is mostly about the broad collection of data passively (e.g. from smartphone apps, or other leaky sources). It has two slides at the bottom hinting at phone plants, but that isn't really what the article is about and it doesn't spend a lot of time talking about them. I'd agree with the above poster, your article is mostly irrelevant if otherwise interesting. I will say a lot has been said about phone plants previously, but your article isn't about that really.
  - sigmar 11y ago
    He already told you the reason, he doesn't have time to read it right now. Did you read the link you posted? Because I read it, and his skimming is 100% accurate. The article talks about Angry Birds, Facebook, google maps, and other social apps leaking personal data by transmitting it over the internet and being intercepted. Completely different from the new BBC article.
acaloiar 11y ago
I believe the salient claim here is the exploitability of smartphones via SMS, a la Stagefright. The Guardian article makes no such claim.

rm_-rf_slash 11y ago

None of this should be a surprise. We should expect that any device with Internet access can be hacked by someone, regardless of their intentions. If it isn't the NSA it's Chinese "patriot hackers" or Russian cyber-criminals operating with the consent of their governments. Or many others. Instead of seeing this security state as a binary, we should always consider two questions: 1: How much do we value our privacy and security versus the needs of society (in the case of backdoors and so on), and, 2: How much do we trust the people whose business is having the ability to break into our phones? I don't like how invasive our security agencies are but if they end up preventing major crimes or terrorist attacks I can't say what they do is wrong. At the end of the day, I want the people defending me to be more powerful than the people attacking me, but I don't want my defenders to use their same tools against me.

DanBC 11y ago
I agree with your post but you left out "How much should we trust companies who are intent on slurping as much data as possible, storing it insecurely, with the main purpose of selling it". NSA's / GCHQ's work is made easier by companies who ask for too much data, and who don't know how to send that data securely or keep it secure on their servers.
Zigurd 11y ago
It's true that everyone wants to hack your device.The difference is that NSA has set the tone: Make the technology providers under your influence include exploitable flaws and back doors. PCs are fully mature products and 99% of customers don't need performance breakthroughs. That means it should be possible to make open hardware and open software that make exploits much harder than they are today. Phones are getting there. It's time to make hardware and software that optimize for verifiable security.
- bb101 11y ago
  When Blackberry 10 handsets boot up, they spend a few seconds verifying the security of the software. Since the handsets are practically impossible to root, I'm guessing any alterations would be flagged up.

cdnsteve 11y ago

The all seeing eye...

patrickaljord 11y ago

Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone if asked by the government. As long as you don't control the backend and even the frontend, you're at the mercy of whoever controls it (Apple in this case). That's why all the Apple talks on privacy lately sounds like not much more than good marketing to me.

rsync 11y ago
"Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone" ... or on your SIM card, which is a full computer with CPU and memory and can run arbitrary java programs that your carrier can upload to it.
- _vn5r 11y ago
  AFAIK, sim cards are basically storage devices. When did they get CPUs?
  - blackguardx 11y ago
    I think in the 90s. Check out: https://en.wikipedia.org/wiki/Universal_Integrated_Circuit_Card https://en.wikipedia.org/wiki/Universal_Integrated_Circuit_C...
  - kw71 11y ago
    They have always had CPUs. Just like most other types of ISO7816 cards, including any that have any kind of pin protection for the data stored within.
  - effie 11y ago
    More on this little computer: http://www.gemalto.com/techno/sim/ http://www.gemalto.com/techno/sim/
    - _vn5r 11y ago
      Wow, thanks!

djyaz1200 11y ago

Edward Snowden is not a hero IMO, anyone who cared to look knew for years the government had vast surveillance powers. Is anyone else tired of seeing his headlines? The guy seems to really want to be a celebrity? Does he deserve that? I'm not trying to be rude, only suggesting we rethink our attention to him.

hbosch 11y ago
I choose to think he's rolling out headlines, over time, in order to make sure this issue never fades away like so many other things do. The pace of our media and culture makes important items this NSA scandal become forgotten quickly.
- krapp 11y ago
  Snowden isn't "rolling out headlines over time," media companies are. Although it's obvious Edward Snowden is consciously trying to leverage media (and now social media - his Twitter account is obviously image-conscious) to his advantage in keeping the narrative alive, let's not act like he's actually running things. The linked article seems to be as much advertisement for Snowden-related BBC properties as it is an attempt at maintaining awareness of the subject of Snowden's revelations themselves.
bdamm 11y ago
He's the one who provided the evidence. Without evidence you're just a conspiracy theorist. (Note the theory part.) And frankly he doesn't deserve the fame, and I don't particularly think he wants it either. But the data he provided (illegally, at continuing risk to himself) opened up a much-needed conversation.
- vezzy-fnord 11y ago
  He's the one who provided the evidence. The evidence was there for a while. Most people could not suspend their disbelief long enough to take it seriously.
striking 11y ago

tdaltonc 11y ago

Top Comment Paraphrase: "I knew about this before it was cool." When someone posts a new python/lua/lisp feature intro, no one says "I knew that already!" or "No new info here!" But if it's about security or privacy, the HN zeitgeist wants to denigrate it as "old news."

deleted 11y ago
[deleted]
seiji 11y ago
Nerds tend to operate in a sphere of "once I know something, nobody must ever tell me again." So, they know something and, just by feelings, assume everybody else knows it too. They assume hearing repeated information wastes the time of everybody. The truth is, average people don't even pick up on ideas until the 5th or 8th time they hear them. Even the Snowden revelations weren't revelations per se. We knew about Carnivore before and about the AT&T splicing room and even in the 90s people would half joke half serious comment about how the government watched all online communications. The Snowden documents just solidified the nerd fears. Plus, since the 90s, the Internet grew so big and so popular that people just kinda gave up on the idea that it could even be monitored or tapped en masse. The benefit of the Snowden dump was showing it is possible and it is happening (instead of just being conspiracy theories) and you can't do squat about it.
- xeromal 11y ago
  I must be average as shit then.
- vezzy-fnord 11y ago
  even in the 90s people would half joke half serious comment about how the government watched all online communications The 90s actually had one of the most visible examples of NSA intervention, that of the Clipper chip. They assume hearing repeated information wastes the time of everybody. The issue isn't really repeating things, as much as the fact that it took up until Snowden for people to start being legitimately shocked, when they bluntly dismissed decades of prior art.

sigmar 11y ago

It seems strange to me that the Snowden is only now mentioning the "text message" attack vector, after everyone already knows about Stagefright. Is he out of things to leak? or did he mention it before and go unnoticed?

deleted 11y ago
[deleted]
kentt 11y ago
Yes, he had mentioned it before. Of the top of my head, in "No Place to Hide" he discusses it, but I'm sure you could find a better source if necessary.
justin66 11y ago
He handed all his confidential and sensitive documents to reporters before fleeing so, in a real sense, he is "out of things to leak." He seems to be transitioning to a role of explaining to the mainstream press, in short words they can understand, what is going on.
sweden 11y ago
The kind of attacks that he is referring are located at the lower levels of the phone, at the SoC level, not at the operating system level. It's something that neither Apple nor Google can control.
- aaronbrethorst 11y ago
  Allow me to quote the first sentence from the Wikipedia article linked to below: Apple Inc. has developed a range of "System on Chip" (SoC) as well as "System in Package" (SiP) to power their mobile consumer devices. https://en.wikipedia.org/wiki/Apple_system_on_a_chip https://en.wikipedia.org/wiki/Apple_system_on_a_chip
  - spacemanmatt 11y ago
    That's still only the processor that runs iOS. They don't make their own cell processor.

btbuildem 11y ago

HN regulars may well be aware of all these things, but it's good to see this on the pages of the mass media.

daenz 11y ago

> Mr Snowden said GCHQ could gain access to a handset by sending it an encrypted text message and use it for such things as taking pictures and listening in. Are there hardware GCHQ keys in the phone for verifying the encrypted text? I imagine there would have to be, otherwise anybody (with enough time and research) could construct one of these messages to gain control of the phone.

noir_lord 11y ago
> otherwise anybody (with enough time and research) could construct one of these messages to gain control of the phone. Which is exactly one of the strongest arguments against building backdoors into products, eventually you won't be the only one with the keys.
mike_hearn 11y ago
I suspect "encrypted text" is the result of a journalist mangling "text containing shellcode" or something like that. Obviously once they have malware in the phone itself, controlling it via encrypted / silent SMS would be a fine way to do things though.

verytrivial 11y ago

My understanding may be dated, but I have often wondered if the battle for privacy is a lost cause in the mobile phone space. Even with a ground-up open platform for the phone and OS, current regulation requires blob of 'certified' hardware and software between you and the antenna/network. Short of using my phone to acoustically-couple a 2400baud cryto-stream (the call meta-data of which still being snitched), I'm really not sure if privacy is possible.

webXL 11y ago
Not total privacy since the network knows who's on both ends, or at least that you're on one end, but as long as you can tunnel encrypted traffic over it via a hotspot, I'm not sure how that could be cracked.
- shostack 11y ago
  One way that I've been wondering about is all these new keyboards coming on the market. Things like Swype, Swiftkey etc. They have cloud storage for storing data to feed predictive algorithms, but it essentially becomes a cloud-based keystroke logger. So you may be sending encrypted traffic via hotspot, but your keyboard process running in the background has the raw input data and is feeding that to a server. I'd love to read a more detailed writeup on the security of such apps, which ones are trusted (ie. only using local encrypted storage, no phoning home), etc.

madez 11y ago

I’m trying as good as I can to protect myself against such attacks. My android smartphone is permanently in airplane mode and I don’t use a sim card. Do you still see a security risk?

blazespin 11y ago
I keep the battery out at all times, even when I'm using it. Just to be safe.
copperx 11y ago
It wouldn't be totally surprising for an airplane mode phone to "phone home" after it has been, say, 72 hours in that mode. I can hardly imagine a trip that long.
beeboop 11y ago
I doubt removing the SIM makes any difference, it's only used by your carrier to identify you. If the NSA wants to target you specifically, it wouldn't stop them.
rdl 11y ago
Best thing is probably an iPod Touch or iPad Mini without cellular (I'm pro iOS vs. Android, mainly due to secure element and iOS > Android security; there's an argument you could use a secure element plus a new ROM on Android devices to surpass iOS), with a wifi or bt or usb link to an external wifi-4g modem or wifi-wifi router (mifi, portal, whatever).
TazeTSchnitzel 11y ago
Airplane mode might lie. Use a faraday cage.

mixmastamyk 11y ago

I would be surprised if Apple has let a vulnerability of "send text message, pwn phone" linger for very long. Article doesn't mention brands or versions, but it is quite important to fully understand. Or does this work at a lower level? I've heard the radio chips themselves are untrustworthy, but how would they control the main OS on another chip?

mortenjorck 11y ago
The implication here seems to be that at least Stagefright did, in fact, have software exploiting it in the wild. Perhaps there are similar exploits yet to be found publically, even on iOS, or perhaps this vector has "gone dark" now.
endymi0n 11y ago
Enter "the baseband". A dark, undocumented, hardly accessible, obfuscated piece of code that has access to your microphone, GPS, battery management and lots of other gimmicks. https://news.ycombinator.com/item?id=6722292 https://news.ycombinator.com/item?id=6722292 If I were a three-letter-agency I knew where to hide dead bodies while everyone was arguing over operating system security.
- username223 11y ago
  That sure goes a long way toward showing how powerful Stingrays are, and why Harris and the government really, really don't want information about them getting out. I got a chuckle out of this near the end of the article: > Whenever someone does dive into baseband software, many bugs and issues are found, which raises the question just how long this rather dubious situation can continue. Well, the baseband software was written in the 90s, the article was written in 2013, and I'll bet nothing has changed in the last two years.
  - shostack 11y ago
    Really have to wonder how many of these bugs and issues are "bugs" and "issues."

blazespin 11y ago

The question I have is the issues around crashing a device via texts[1]. Was that part of this scheme? Was it put in there on purpose? 1. http://www.techtimes.com/articles/55893/20150527/one-text-message-crash-iphone-heres-fix.htm http://www.techtimes.com/articles/55893/20150527/one-text-me...

rtkwe 11y ago
That's doubtful, 'effective power' (incidentally that bit of the text was completely arbitrary) was (seemingly) a hard crash caused by an error in the text shortening for the banner notification pop down. Tom Scott has a good speculation video on what might be going on that seems pretty sound. https://www.youtube.com/watch?v=hJLMSllzoLA https://www.youtube.com/watch?v=hJLMSllzoLA

cryoshon 11y ago

"Describing the relationship between GCHQ and its US counterpart, he said: "GCHQ is to all intents and purposes a subsidiary of the NSA. "They [the NSA] provide technology, they provide tasking and direction as to what they [GCHQ] should go after." " This is the juciest part. This is the confirmation we've been suspecting for a long time: CGHQ is the NSA, and all of their programs are shared. This means that we can pin the worst abuses of GCHQ onto the NSA, and also confirm that US citizens are directly targeted by even the most outrageously invasive surveillance efforts-- there is no exempt population, proving the NSA's PR lies once again.

rhino369 11y ago
Snowden wasn't a liaison between CGHQ and the NSA. How would he know if it were a subsidiary of the CGHQ. If it's from documents he took, then were is the documents showing it? I'm sure there is a lot of cross sharing of information, but to call it a subsidiary is a bold claim. Snowden was a database admin, not John Brennan.
- cryoshon 11y ago
  I don't have the ultimate answer here, but why were the (highly classified, some marked "no foreign national viewing") GCHQ slide decks on NSA servers? I also assume that their slides reference each others programs frequently. Maybe this is incorrect.
  - caskance 11y ago
    The most obvious answer is that the NSA pwned them.
  - rhino369 11y ago
    They obviously work together very closely. I'm just objecting to the idea that the UK spy agencies are just American outposts and that each agency is responsible for the mistakes/crimes of the others. Maybe they are really pushed around by the US, but I'd have to see more than Snowden making unfounded statements about it. In the past, he's made some illogical leaps based on some of the information he took. It's very easy to do that when you expect the worst of someone/thing.

wicket 11y ago

I'm surprised HN readers don't already know this. It still astonishes me how so many so called "tech savvy" users are content with surrendering their privacy and freedoms to Google or Apple so that they can run the latest "apps". This is why I'm backing the Neo900[1]. It might be a bit pricey and low spec'ed by today's market (a consequence of it catering for a niche market meaning it won't be mass produced) but in my opinion that's a small price to pay to actually own your phone (it's actually more akin to a mobile computer than a phone). [1] http://neo900.org/ http://neo900.org/

dogma1138 11y ago
I don't think any one with even basic understanding of technology thought that an intelligence agency can't breach their cellphone. You have a GPS receiver, a microphone, camera, and a data capable modem on you all the time this is pretty much a cold-war era dream come true to those agencies. Heck the layman is probably more "aware" of this than people with better understanding of technology simply because they do not understand the technical difficulties that might be involved in remotely accessing a mobile device. As for the Neo900, It's a nice project and it's has been posted on this site many time, but you should have serious doubts about it being any more NSA proof than a burner you pickup at the bargain bin at Walmart. Yes they have all their physical electronically resetable fuses that in theory will allow you to disconnect the modem, and they do some power usage analysis to ensure that the radio is actually off, but still they are using regulated off-the-shelf hardware, if the NSA wan't to break into that phone remotely they'll find a way if they won't have a way in straight of the bat to begin with which is also quite likely.
- drdaeman 11y ago
  If the interconnections are limited to the extent said off-the-shelf hardware just can't have privileged access to the other parts of the system, it's safe. That said, it doesn't matter if modem is hacked if it can't do much. Backdooring an MCU so it'd allow access on a secret code from anywhere is surely possible in theory, but it'll be hard to hide the cost of adding such backdoor.

venomsnake 11y ago

If a device is known it can be hacked. Anonymity is the key. Use roaming sim card (it will require some cooperation of the remote operator, so kinda makes it harder). What to do to mitigate - no sim card. If have to use sim card - imei randomizer. Wifi mac address randomizer.

junto 11y ago

Everybody talks about the OS, buy nearly everyone forgets about the base band, the hidden OS on every phone that you have almost no control over. Whilst the media is worrying about Apple iCloud and phone encryption, GCHQ are quietly delving into your base band and enjoying the smoke and mirrors. To use analogy, we are worrying about the government looking under our clothes, whilst in fact they are peeling back or skin and skulls and peering into our humanity.

niutech 11y ago
A good read about baseband RTOS: http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...
mike_hearn 11y ago
People talk about it less these days because modern modem/baseband chips are sandboxed. In older phones they had bus master access and could do whatever they wanted, hence their frequent targeting by unlockers. But they didn't need all that access and have since been locked down a fair bit. Also, Qualcomm at least got more serious about security and started hardening their firmwares. Also, intelligence agencies tend to be after stuff that the baseband doesn't have any convenient access to, like photos and files on disk. Even though an un-sandboxed baseband could theoretically access the hardware, it'd be doing so in parallel with the real OS and that'd be super painful to implement. Finally, why bother when the OS is such a bigger surface area? The IC's aren't magic, even if they developed some impressive tricks under the cover of secrecy. They attack systems in the same way as your average defcon presenter does.
aexaey 11y ago
What about free baseband? http://bb.osmocom.org/trac/ http://bb.osmocom.org/trac/

meapix 11y ago

What strike me most is the amount of people around me who don't care about this.

r00fus 11y ago
Well, it's a sort of institutionalized resignation... I mean, if there's nothing you can do about it, what should you be doing? Switching to a blackphone? What if your organization doesn't support a truly secure option? It's like hearing that Microsoft and the NSA had a backdoor 20 years ago - at the time I didn't have an option for my work machine, so I just grunted and went along.

coldcode 11y ago

As much as I admire Mr. Snowden for what he did, he is not an expert outside of the documents he took with him. He isn't privy to anything happening now. He didn't build anything or code anything. All he did was steal from some idiots that should have known better how to secure information. This does not make him omniscient.

brianpan 11y ago
What are you arguing here? Is something he said incorrect? I don't think anyone is claiming he is a deity.

DanBlake 11y ago

"Nosey Smurf is the 'hot mic' tool. For example if it's in your pocket, [GCHQ] can turn the microphone on and listen to everything that's going on around you - even if your phone is switched off because they've got the other tools for turning it on." Are they implying that all/most smartphones still communicate with cell towers when turned off? (obviously this isnt happening) - Or do they pwn the device before hand to have it fake that its turning off while remaining on?

niutech 11y ago
Well, it can happen: http://www.tomsguide.com/us/nsa-remotely-turn-on-phones,news-18854.html http://www.tomsguide.com/us/nsa-remotely-turn-on-phones,news... and http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...
- r00fus 11y ago
  Next up: Explosion of sales of Faraday cases for smartphones (and the subsequent banning of sales through ITC and/or legislation). Oh, who am I kidding.
  - mike_hearn 11y ago
    When Snowden met Greenwald+Poitras he apparently just used a fridge to store the phones.
shostack 11y ago
Presumably removing the battery stops this? Or is there another internal power source they have access to?
qq66 11y ago
I do know that both smartphones and feature phones can turn on while "off," if you set an alarm. However I doubt that they ping cell towers when off, as I've left them off for weeks/months with little battery drain.

shostack 11y ago

What about 3rd party keyboards like those that have recently made their way to iPhones and have been on Android for a while? All of them (even Samsung's swype style keyboard) seem to have some sort of cloud-based storage for your data so it can remain equally predictive across your devices. Is there any good security research out there on how safe these keyboards are and which ones are the worst offenders? Seems like it is essentially a user-installed cloud-based keystroke logger ripe for abuse. I love the functionality of some of them, but man do they terrify me.

nick_name 11y ago

Looks like Vysk's QS1 is aiming to mitigate the baseband hacks - http://www.theguardian.com/technology/2014/jul/25/startup-claims-to-have-built-an-un-hackable-phone-case-that-encrypts-your-calls http://www.theguardian.com/technology/2014/jul/25/startup-cl...