8 ms·
Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone if asked by the government. As long as you don't
by patrickaljord 11y ago
Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone if asked by the government. As long as you don't control the backend and even the frontend, you're at the mercy of whoever controls it (Apple in this case). That's why all the Apple talks on privacy lately sounds like not much more than good marketing to me.
- rsync 11y ago"Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone" ... or on your SIM card, which is a full computer with CPU and memory and can run arbitrary java programs that your carrier can upload to it.
- _vn5r 11y agoAFAIK, sim cards are basically storage devices. When did they get CPUs?
- blackguardx 11y agoI think in the 90s. Check out: https://en.wikipedia.org/wiki/Universal_Integrated_Circuit_Card https://en.wikipedia.org/wiki/Universal_Integrated_Circuit_C...
- kw71 11y agoThey have always had CPUs. Just like most other types of ISO7816 cards, including any that have any kind of pin protection for the data stored within.
- effie 11y agoMore on this little computer: http://www.gemalto.com/techno/sim/ http://www.gemalto.com/techno/sim/
- _vn5r 11y agoWow, thanks!
- slasaus 11y agoAnd on the Gemalto sim-card hack by the NSA and GCHQ: https://theintercept.com/2015/02/25/gemalto-doesnt-know-doesnt-know/ https://theintercept.com/2015/02/25/gemalto-doesnt-know-does... "In the secret documents, provided by NSA whistleblower Edward Snowden, the intelligence agencies described a successful effort to obtain secret encryption keys used to protect hundreds of millions of mobile devices across the globe."
- bdamm 11y agoThere's no such thing as a front-end that you control.
- bcruddy 11y agoWhat do you mean? I can turn javascript off in my browser which effectively takes control of the front end by preventing communication with the server. Native is a different story but saying "there's no such thing as a front-end that you control," is misleading.
- misnome 11y agoDid you write the browser yourself? On an operating machine that you hand-coded on a CPU architecture that you clean-room designed and implemented personally?
- oldfatslow 11y agoI even soldered the cpu
- spacemanmatt 11y agoI smelted my own silicon
- tripzilch 11y agoHow do you know the silicon in the Matrix was not back-doored?
- mtgx 11y agoGoogle can do that, too, through the "Play Services" framework, in case others weren't aware of it. We know this because Google has already used these "powers" to uninstall apps/malware from phones (non-Nexus).
- on_ 11y ago> Mr Snowden said GCHQ could gain access to a handset by sending it an encrypted text message and use it for such things as taking pictures and listening in. This sentence is as much context as the article provides, and I won't rehash my other comment, but this could be from a recently purchased ~$20 burner to a ~$800 iPhone. Not every phone is windows/android/apple and connected. idk, I found it pretty eye opening.
- shostack 11y agoYeah--reading the Ars Technica review of Marshmallow terrified me with some of the things they are doing there. Like the fact that users have more granular control over permissions now, but internet is always on for apps no matter what, there's a whole slew of permissions that aren't exposed through the user-controllable permissions that are pretty bad, and there's new stuff in there that allows screenshots to be sent from an app to Google for "searching in the app." I try to read this stuff without a tinfoil hat, but they sure don't make it easy.
- mike_hearn 11y agoThe internet permission has been semi-broken from Android 1.0 onwards. In particular, people tended to interpret it as "this app cannot upload my data to the internet". But then it was discovered apps could do things like request the music app to play an audio stream from an arbitrary URL. Any data to exfiltrate can be put into the query params. Or the app can request the browser to open, same trick. By the time the user realises what's happened the data is gone already. In fact more or less any app that can be convinced via IPC to open an attacker-controlled URL can be used to circumvent the expected meaning of the internet permission. And then there's the inconvenient fact that virtually all apps need it for one reason or another, so it just became meaningless. Good riddance, I say.
- nsgi 11y agoApple can, but what about GCHQ?
- TazeTSchnitzel 11y agoThey just need to (il)legally compel Apple to do it.
- bargl 11y agoIsn't that true of anything that has automatic updates? Browsers, games, operating systems, etc. Does this mean that if we don't trust our government we should stop pushing anything that automatically updates?
- marssaxman 11y agoThat has seemed to me like the reasonable approach for a good while now.