8 ms·

I'm surprised HN readers don't already know this. It still astonishes me how so many so called "tech savvy" users are content with surrendering their privacy a

by wicket 11y ago

I'm surprised HN readers don't already know this. It still astonishes me how so many so called "tech savvy" users are content with surrendering their privacy and freedoms to Google or Apple so that they can run the latest "apps". This is why I'm backing the Neo900[1]. It might be a bit pricey and low spec'ed by today's market (a consequence of it catering for a niche market meaning it won't be mass produced) but in my opinion that's a small price to pay to actually own your phone (it's actually more akin to a mobile computer than a phone). [1] http://neo900.org/ http://neo900.org/

dogma1138 11y ago
I don't think any one with even basic understanding of technology thought that an intelligence agency can't breach their cellphone. You have a GPS receiver, a microphone, camera, and a data capable modem on you all the time this is pretty much a cold-war era dream come true to those agencies. Heck the layman is probably more "aware" of this than people with better understanding of technology simply because they do not understand the technical difficulties that might be involved in remotely accessing a mobile device. As for the Neo900, It's a nice project and it's has been posted on this site many time, but you should have serious doubts about it being any more NSA proof than a burner you pickup at the bargain bin at Walmart. Yes they have all their physical electronically resetable fuses that in theory will allow you to disconnect the modem, and they do some power usage analysis to ensure that the radio is actually off, but still they are using regulated off-the-shelf hardware, if the NSA wan't to break into that phone remotely they'll find a way if they won't have a way in straight of the bat to begin with which is also quite likely.
- drdaeman 11y ago
  If the interconnections are limited to the extent said off-the-shelf hardware just can't have privileged access to the other parts of the system, it's safe. That said, it doesn't matter if modem is hacked if it can't do much. Backdooring an MCU so it'd allow access on a secret code from anywhere is surely possible in theory, but it'll be hard to hide the cost of adding such backdoor.
  - dogma1138 11y ago
    The baseband can be compromised, the SOC can be compromised, the OS can be compromised, the SIM card can be compromised, and more importantly the base station it self can be lawfully and unlawfully accessed. The safe part is in theory, there are only a handful of companies that could actually audit a mobile system in any effective matter pretty much all of them are also the vendors of various mobile interception, tracking, and exploitation solutions. Dealing with any type of security requires you to identify and quantify your threat agents, if your threat agents are a foreign or a national intelligence service of any note i wouldn't bet anything on the N900 nor on any other cellphone. If you ask anyone, layman or expert what is a secure device that the NSA could not hack the only thing that they might come up with is a brick, and i wouldn't even trust that[1]. At best the N900 might give you some reliability that when it's off and when the radio is turned off it's actually off, considering that sleep mode power consumption can vary by quite a bit in the same SOC based on conditions like temperature it wouldn't surprise me if you could fool that as well. [1]https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
    - drdaeman 11y ago
      Everything can be backdoored, but what about costs? If the interconnection between the baseband and SoC is restricted in a way baseband can't just do DMA requests and mess with the system, the compromised baseband has to talk to the the compromised SoC to compromise the OS. NSA have to either develop a specific backdoor for a specific device (or, better say, schematically similar devices group) and hook into their supply chain (hmmmm...), or develop a quite cost-adding generic backdoor system. They surely have resources to design anything and even beyond that, but added cost to the production just can't be easy to conceal. There must be some sane limit to NSA's possible omnipotence. And then there are reverse engineers who love to peek what's done in silicon. NSA has to shut up not only original part vendor (easy for them, sure), but a bunch of engineers around the world, stealing designs for the chips so they'd make a clone. You know, some countries are famous for that stuff. Add: as for base stations - they're outside the phone. We don't consider plaintext data outside to be secure. If you're about the voice calls - E2E-encrypted VoIP to the rescue.
ljk 11y ago
if the cell towers can be hacked, aren't these "security features" moot?
- wicket 11y ago
  As far as I'm aware, UMTS has not been hacked. You can tell the device to connect to UMTS only. Of course this doesn't stop carriers from giving government agencies direct access to communications. If secure communications is your concern then you should always encrypt your calls and data. The Neo900 modem is sandboxed at hardware-level, monitors all activity and gives the user complete control over it so you will know if something fishy is being attempted and you will be able to prevent it. This makes it very difficult, if not impossible for an adversary to take over the device. Regular Linux (by that I mean not Android) can be installed so it is far less likely to contain any backdoors. If triangulation of your location is a concern, just switch off the modem.
- seba_dos1 11y ago
  If the internet providers can be hacked, aren't the "security features" of your PC moot?
raverbashing 11y ago
You're not accomplishing what you want to accomplish with this > are content with surrendering their privacy and freedoms to Google or Apple so that they can run the latest "apps". You have the choice of not running apps. Get a feature phone. You can create a fake account on Google (or even better, get an Amazon fire phone, or some Chinese one that is based only on stock Android). Or just Ubuntu Phone/Cyanogen mod it > it's actually more akin to a mobile computer than a phone Based on the original N900 let me say it is going to be a much worse experience than your Average android phone, especially running Debian and having a resistive touchscreen. And the phone company will still know your location
- wicket 11y ago
  > You're not accomplishing what you want to accomplish with this How do you know what it is that I want to accomplish? I will accomplish everything that I want to accomplish. > You have the choice of not running apps. Get a feature phone. Except that I do want to run and write my own software. With a feature phone I would have very little control over the operating system and other software, not to mention the baseband modem. > You can create a fake account on Google Do you suggest a Google account every task I undertake? One single fake Google account for everything I do would be pointless. Of course you've already made the assumption that I want to use Google services (which I don't). > (or even better, get an Amazon fire phone, or some Chinese one that is based only on stock Android). Or just Ubuntu Phone/Cyanogen mod it You continue to assume that I want to use an operating system designed to collect as much information as possible on me. Replicant would be a better choice than Cyanogenmod, however neither that nor Ubuntu Phone solve the closed hardware problem where the baseband modem is not isolated from the rest of the device. > Based on the original N900 let me say it is going to be a much worse experience than your Average android phone, especially running Debian and having a resistive touchscreen. That's your own opinion. I still use my N900 because there isn't a device that comes close to what it offers. As a Linux/Unix professional, I much prefer the experience over any Android phone. I run Debian natively which I can't do on any Android device. I much prefer the stylus precision of the resistive touchscreen than the fat-fingers capacitive mentality. > And the phone company will still know your location Not when you choose to switch off the modem they can't.
- 11y ago
on_ 11y ago
Feel like this is begging the question a bit. While a phone is a massive attack vector it is pretty non obvious that from a text message a user can have a stealth rootkit installed and persisted to all their devices.
- conceit 11y ago
  The firmware of the gsm-modem, called the baseband, can be updated by the service-providers at any-time. Triggering any kind of exploit of the user OS is trivial then. Heck, you don't even need to think as complicated as that, looking at the permissions granted to the most installed apps.
  - on_ 11y ago
    Absolutely. The article didn't provide much color on it, but I am thinking about a <$20 pay as you go phone that is turned off, with the known information of simply a cellphone number. While the gov't has crazy access to these telco companies, there is really zero friction if this is universal. Scenario: If you infect 'target 0' you now have a seed to feed to your maliscious googleR00t bot, that just indexes a phone book and sends these root sms messages out. Possible/likely even to and from powered off phones. They could even do a badbios/thunderstrike-like attack on a laptop or otherwise airgapped computer. If you find one person who has that number in their phone, even if never turned on, when it does, it connects to the network. Broadcasts the location and data, and becomes a carrier of some pretty next-level malware. Now, if you think critically I guess the OTA phone attack thing is a conclusion you could draw. However, 'the Government' is a huge organization. The capabilities are clearly staggering and somewhat known, but who has access? Imagine if Edward Snowden, or someone like him, got the exploitDB and all the source? Who would know? The gov't can't admit it has zero days to every piece of technology and have packaged up these payloads into something as easy to use as a rails API or SMS message. That hacker for sure wouldn't let the public know because unknown vulns === big money. So, who is to say this hasn't happened, won't happen, or even how many people are 'legally[0]' allowed to use this in Virginia. [0]this word can be interpreted quite loosely.
happyscrappy 11y ago
I am surprised people don't know that there are two types of security, Mossad and non-Mossad. You can't win against Mossad.
caskance 11y ago
It still astonishes me how so many so called "tech savvy" users think they can do the technological equivalent of defending themselves from the military with a store-bought handgun.
- seba_dos1 11y ago
  Looking at the state of security in GSM and related technologies, it's not necessarily the military you may want to protect yourself from. I'd be rather worried about agencies doing mass surveillance and/or script kiddies. When you're specifically targeted by big guys, you're screwed. Otherwise, you have plenty of ways to defend yourself. Many (me included) believe that it's still worth it.
rsync 11y ago
"This is why I'm backing the Neo900[1]. It might be a bit pricey and low spec'ed by today's market (a consequence of it catering for a niche market meaning it won't be mass produced) but in my opinion that's a small price to pay to actually own your phone (it's actually more akin to a mobile computer than a phone)." You misunderstand. neo900, while interesting in many ways, has a standard, off the shelf (closed) baseband, and that baseband has control over your processor and memory as deep as DMA. Your carrier owns you. Your carrier can literally flip bits in your memory with silent OTA updates that you have no knowledge of, or control over. This is not to mention the other, third computer in your hand, which is the SIM card, which you also have no control over and which your carrier can upload arbitrary executables to, which run outside of your control. The neo900 does not save you.
- seba_dos1 11y ago
  "and that baseband has control over your processor and memory as deep as DMA" No, that's false. The Neo900's baseband is connected to the main application processor by USB (and UART). Yes, it is closed, but it has exactly the same access to your memory as a USB dongle connected to your laptop. Modem and SIM are the blackboxes outside of the user's control, that's right. That's why the rest of the system is designed with keeping that in mind.

by wicket 11y ago

dogma1138 11y ago

I don't think any one with even basic understanding of technology thought that an intelligence agency can't breach their cellphone. You have a GPS receiver, a microphone, camera, and a data capable modem on you all the time this is pretty much a cold-war era dream come true to those agencies. Heck the layman is probably more "aware" of this than people with better understanding of technology simply because they do not understand the technical difficulties that might be involved in remotely accessing a mobile device. As for the Neo900, It's a nice project and it's has been posted on this site many time, but you should have serious doubts about it being any more NSA proof than a burner you pickup at the bargain bin at Walmart. Yes they have all their physical electronically resetable fuses that in theory will allow you to disconnect the modem, and they do some power usage analysis to ensure that the radio is actually off, but still they are using regulated off-the-shelf hardware, if the NSA wan't to break into that phone remotely they'll find a way if they won't have a way in straight of the bat to begin with which is also quite likely.

drdaeman 11y ago
If the interconnections are limited to the extent said off-the-shelf hardware just can't have privileged access to the other parts of the system, it's safe. That said, it doesn't matter if modem is hacked if it can't do much. Backdooring an MCU so it'd allow access on a secret code from anywhere is surely possible in theory, but it'll be hard to hide the cost of adding such backdoor.
- dogma1138 11y ago
  The baseband can be compromised, the SOC can be compromised, the OS can be compromised, the SIM card can be compromised, and more importantly the base station it self can be lawfully and unlawfully accessed. The safe part is in theory, there are only a handful of companies that could actually audit a mobile system in any effective matter pretty much all of them are also the vendors of various mobile interception, tracking, and exploitation solutions. Dealing with any type of security requires you to identify and quantify your threat agents, if your threat agents are a foreign or a national intelligence service of any note i wouldn't bet anything on the N900 nor on any other cellphone. If you ask anyone, layman or expert what is a secure device that the NSA could not hack the only thing that they might come up with is a brick, and i wouldn't even trust that[1]. At best the N900 might give you some reliability that when it's off and when the radio is turned off it's actually off, considering that sleep mode power consumption can vary by quite a bit in the same SOC based on conditions like temperature it wouldn't surprise me if you could fool that as well. [1]https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
  - drdaeman 11y ago
    Everything can be backdoored, but what about costs? If the interconnection between the baseband and SoC is restricted in a way baseband can't just do DMA requests and mess with the system, the compromised baseband has to talk to the the compromised SoC to compromise the OS. NSA have to either develop a specific backdoor for a specific device (or, better say, schematically similar devices group) and hook into their supply chain (hmmmm...), or develop a quite cost-adding generic backdoor system. They surely have resources to design anything and even beyond that, but added cost to the production just can't be easy to conceal. There must be some sane limit to NSA's possible omnipotence. And then there are reverse engineers who love to peek what's done in silicon. NSA has to shut up not only original part vendor (easy for them, sure), but a bunch of engineers around the world, stealing designs for the chips so they'd make a clone. You know, some countries are famous for that stuff. Add: as for base stations - they're outside the phone. We don't consider plaintext data outside to be secure. If you're about the voice calls - E2E-encrypted VoIP to the rescue.

ljk 11y ago

if the cell towers can be hacked, aren't these "security features" moot?

wicket 11y ago
As far as I'm aware, UMTS has not been hacked. You can tell the device to connect to UMTS only. Of course this doesn't stop carriers from giving government agencies direct access to communications. If secure communications is your concern then you should always encrypt your calls and data. The Neo900 modem is sandboxed at hardware-level, monitors all activity and gives the user complete control over it so you will know if something fishy is being attempted and you will be able to prevent it. This makes it very difficult, if not impossible for an adversary to take over the device. Regular Linux (by that I mean not Android) can be installed so it is far less likely to contain any backdoors. If triangulation of your location is a concern, just switch off the modem.
seba_dos1 11y ago
If the internet providers can be hacked, aren't the "security features" of your PC moot?

raverbashing 11y ago

You're not accomplishing what you want to accomplish with this > are content with surrendering their privacy and freedoms to Google or Apple so that they can run the latest "apps". You have the choice of not running apps. Get a feature phone. You can create a fake account on Google (or even better, get an Amazon fire phone, or some Chinese one that is based only on stock Android). Or just Ubuntu Phone/Cyanogen mod it > it's actually more akin to a mobile computer than a phone Based on the original N900 let me say it is going to be a much worse experience than your Average android phone, especially running Debian and having a resistive touchscreen. And the phone company will still know your location

wicket 11y ago
> You're not accomplishing what you want to accomplish with this How do you know what it is that I want to accomplish? I will accomplish everything that I want to accomplish. > You have the choice of not running apps. Get a feature phone. Except that I do want to run and write my own software. With a feature phone I would have very little control over the operating system and other software, not to mention the baseband modem. > You can create a fake account on Google Do you suggest a Google account every task I undertake? One single fake Google account for everything I do would be pointless. Of course you've already made the assumption that I want to use Google services (which I don't). > (or even better, get an Amazon fire phone, or some Chinese one that is based only on stock Android). Or just Ubuntu Phone/Cyanogen mod it You continue to assume that I want to use an operating system designed to collect as much information as possible on me. Replicant would be a better choice than Cyanogenmod, however neither that nor Ubuntu Phone solve the closed hardware problem where the baseband modem is not isolated from the rest of the device. > Based on the original N900 let me say it is going to be a much worse experience than your Average android phone, especially running Debian and having a resistive touchscreen. That's your own opinion. I still use my N900 because there isn't a device that comes close to what it offers. As a Linux/Unix professional, I much prefer the experience over any Android phone. I run Debian natively which I can't do on any Android device. I much prefer the stylus precision of the resistive touchscreen than the fat-fingers capacitive mentality. > And the phone company will still know your location Not when you choose to switch off the modem they can't.
11y ago

on_ 11y ago

Feel like this is begging the question a bit. While a phone is a massive attack vector it is pretty non obvious that from a text message a user can have a stealth rootkit installed and persisted to all their devices.

conceit 11y ago
The firmware of the gsm-modem, called the baseband, can be updated by the service-providers at any-time. Triggering any kind of exploit of the user OS is trivial then. Heck, you don't even need to think as complicated as that, looking at the permissions granted to the most installed apps.
- on_ 11y ago
  Absolutely. The article didn't provide much color on it, but I am thinking about a <$20 pay as you go phone that is turned off, with the known information of simply a cellphone number. While the gov't has crazy access to these telco companies, there is really zero friction if this is universal. Scenario: If you infect 'target 0' you now have a seed to feed to your maliscious googleR00t bot, that just indexes a phone book and sends these root sms messages out. Possible/likely even to and from powered off phones. They could even do a badbios/thunderstrike-like attack on a laptop or otherwise airgapped computer. If you find one person who has that number in their phone, even if never turned on, when it does, it connects to the network. Broadcasts the location and data, and becomes a carrier of some pretty next-level malware. Now, if you think critically I guess the OTA phone attack thing is a conclusion you could draw. However, 'the Government' is a huge organization. The capabilities are clearly staggering and somewhat known, but who has access? Imagine if Edward Snowden, or someone like him, got the exploitDB and all the source? Who would know? The gov't can't admit it has zero days to every piece of technology and have packaged up these payloads into something as easy to use as a rails API or SMS message. That hacker for sure wouldn't let the public know because unknown vulns === big money. So, who is to say this hasn't happened, won't happen, or even how many people are 'legally[0]' allowed to use this in Virginia. [0]this word can be interpreted quite loosely.

happyscrappy 11y ago

I am surprised people don't know that there are two types of security, Mossad and non-Mossad. You can't win against Mossad.

caskance 11y ago

It still astonishes me how so many so called "tech savvy" users think they can do the technological equivalent of defending themselves from the military with a store-bought handgun.

seba_dos1 11y ago
Looking at the state of security in GSM and related technologies, it's not necessarily the military you may want to protect yourself from. I'd be rather worried about agencies doing mass surveillance and/or script kiddies. When you're specifically targeted by big guys, you're screwed. Otherwise, you have plenty of ways to defend yourself. Many (me included) believe that it's still worth it.

rsync 11y ago

"This is why I'm backing the Neo900[1]. It might be a bit pricey and low spec'ed by today's market (a consequence of it catering for a niche market meaning it won't be mass produced) but in my opinion that's a small price to pay to actually own your phone (it's actually more akin to a mobile computer than a phone)." You misunderstand. neo900, while interesting in many ways, has a standard, off the shelf (closed) baseband, and that baseband has control over your processor and memory as deep as DMA. Your carrier owns you. Your carrier can literally flip bits in your memory with silent OTA updates that you have no knowledge of, or control over. This is not to mention the other, third computer in your hand, which is the SIM card, which you also have no control over and which your carrier can upload arbitrary executables to, which run outside of your control. The neo900 does not save you.

seba_dos1 11y ago
"and that baseband has control over your processor and memory as deep as DMA" No, that's false. The Neo900's baseband is connected to the main application processor by USB (and UART). Yes, it is closed, but it has exactly the same access to your memory as a USB dongle connected to your laptop. Modem and SIM are the blackboxes outside of the user's control, that's right. That's why the rest of the system is designed with keeping that in mind.