20 ms·

Edward Snowden's New Research Aims to Keep Smartphones from Betraying Owners

296 points by secfirstmd 10y ago

DigitalJack 10y ago
This does seem feasible for the specific use case of a protected phone for "clandestine" meetings. My initial thought was they'd have to redesign it for every phone, but that's not necessarily the case. If eaves dropping is such a concern for you, I would think you would be okay with not having the latest gen phone. Or having an old one just for these sorts cases. I suppose the concern then shifts to whether this device is easily subverted, or whether it's easy to determine if it has been subverted.
- DamnYuppie 10y ago
  Why does not wanting to have someone eaves drop on me mean I have to use inferior technology? I find that to be offense in the extreme. Everyone should be concerned about or more ideally not have to worry about people accessing their phone without their knowledge.
semi-extrinsic 10y ago
No disrespect to Snowden and Bunnie, but it seems to me that a much simpler solution giving you a much higher OPSEC is to buy a smartphone with a removable battery. No battery, no radios are on. And if you are truly paranoid, it's simple to disassemble the phone and look for/remove any backup batteries. I know, I had to pull the backup battery from my wife's Moto G after it fell in the sink.
- ashitlerferad 10y ago
  No battery leads to a useless mobile computer.
  - pyre 10y ago
    Depends on your use-case. If you only want to stop communications during a specified period of time (e.g.) during a "secret" conversation, then this is useful. If you have any apps installed that might be polling the 'net for information (e.g. checking the weather), then this is useless in the general case of "the phone is on my desk next to me while I'm working."
    - semi-extrinsic 10y ago
      What is described in the article does not do traffic inspection, it only verifies that all radios are off. I see the argument that there is a use case for the smartphone for taking pictures while operating without radios. But wouldn't a better solution then be a compact digital camera and a notebook? You can invent your own code for note taking that becomes arbitrarily hard to break. You can disguise a compact camera as a smartphone using just a case and a hot glue gun.
  - panax 10y ago
    There is also the convenience factor. I do remove my battery frequently from my phone but it is too easy to just leave it on. People will generally not want to hassle with it if they don't have to.If security is easier and requires less effort then it lowers the cost and will be favored more often and it will protect more people. There are also many times that people have been unhappy because I have my phone off and unable to reach me. There are also other times you want to be available. Unfortunately, if your phone is owned then they can just exfiltrate the data when normal data transfer occurs. The data will still need to be stored for transmission later though. With the iphone, you also need to monitor Bluetooth and WiFi in addition to cellular activity. Hopefully they will also monitor these.
- vhdjdjvhdhd 10y ago
  Actually smartphones, even with a removable battery, have a very small second cell hooked up to the baseband hardware for emergency purposes. I've taken a few apart and confirmed this firsthand.
- nfjstjstns 10y ago
  Actually, regardless of whether or not smartphones have a removable battery, there's always a small second battery connected to the baseband for emergency purposes. I've confirmed this firsthand by taking apart several models, and you make out small coin cells on most online disassembly documentation as well. The one in my old Atrix was a good 250mAh.
  - walterbell 10y ago
    What would the baseband transmit in an emergency and how would it know that there was an emergency, if the phone itself had lost power? When a phone is off or out of power, is the baseband periodically pinging cell towers?
    - sliverstorm 10y ago
      I could see coordinates, e.g. of a lost party, or someone who called 911 but got disconnected by a low battery, that kind of thing. Cell phone pings can be extremely handy for SAR.
    - yardie 10y ago
      If it has a 250mAh battery then that is good for a continuous 1/4W transmission for 1 hour. But I imagine the batter is mainly there for the watchdog and RTC. Which is why you never have to set the clock every time you turn the phone on.
      - jeffbush 10y ago
        You don't need to set the clock when you turn on the phone because it gets the time from the network when it registers.
        yardie 10y ago
        Pull your sim and battery. Reinsert the battery and turn the phone on. The time is still there, network or not.
  - 10y ago
- awqrre 10y ago
  Wouldn't it be easier to use some kind of case or pocket [0] that acts as a Faraday cage? 0: http://www.popsci.com/sites/popsci.com/files/styles/large_1x_/public/import/2013/images/2013/08/Off%20Pocket.jpg http://www.popsci.com/sites/popsci.com/files/styles/large_1x...
  - milesokeefe 10y ago
    That seems safer, with Snowden's device it has to detect transmission after it begins to occur in order to trigger shutdown or alert the user, so it's going to leak some amount of RF even if little. A properly constructed Faraday cage shouldn't though.
    - awqrre 10y ago
      I think that Snowden's device would play a different role, I was comparing it to removing the main and backup batteries.
  - misnome 10y ago
    So it records and transmits later, at opportunity.
    - awqrre 10y ago
      Good point. I guess it depends on the use case.
- rl3 10y ago
  Better yet, install a small custom switch that enables you to physically disconnect power from the battery without actually having to remove it from the phone. Much less conspicuous if you're in public under physical surveillance, and provides options for phones with non-removable batteries assuming the right modifications are made.
- superuser2 10y ago
  +1. If you are trying to detect surveillance by considering RF emissions but only some of the time, a sane attacker will simply have the bug record what it needs and transmit it in a burst later when you will not find RF activity suspicious. You need to prevent the thing from recording you in the first place.
- Iv 10y ago
  A metal case will block any unwanted RF emission. That said, the article states that the goal is to make it possible for users to still use their smartphones as camera, GPS, or whatever tool you need on it, while being safe. As someone who knows a bit about computer security I find it mindblowing that journalists would go into war zones and expect to be stealthy with their smartphones in their pockets but they apparently are willing to risk their lives for their iPhones, so the best we can do is offer tools to mitigate the risks.
- jokoon 10y ago
  Snowden explained that the CMOS button battery is enough to send a transponder signal that can be heard by a drone. He said the only way to shut it down is to put it in a freezer. I mean, I'm a programmer, I am not an expert on sigint stuff, but I don't think it's very hard to innovate in intelligence gathering technologies.
jakobdabo 10y ago
When I place my smartphone on the desk near the computer speakers any time it is going to ring the speakers start making a funny noise a second or two before the ringing starts. So I presume it must be possible to DIY a cheap sensor for GSM signal detection based on a little speaker.
- retox 10y ago
  This is a silly question but I'd like to understand if it's possible for a human to sense those same signals. So many times I have had a sensation that my phone will ring and then moments later it does. Probably confirmation bias or maybe I'm subconsciously hearing the interference in speakers and taking the hint from there. It doesn't happen every time and I don't receive a lot of calls. HN seems a decent place to settle it once and for all.
  - kcorbitt 10y ago
    It seems very unlikely that you would be able to sense those frequencies, except indirectly through something like audible speaker interference. However, this would be pretty easy to test! Just have a friend call you at random times throughout a 2-hour interval or something, and record every time you think the phone is about to ring, and every time it actually does. If there's a close enough correlation between the two, that's fairly persuasive evidence.
    - sdkjfwiluf 10y ago
      please please do it!
    - michaelvoz 10y ago
      This is still anecdotal. You would need hundreds of people, also, the very fact that you are expecting calls pollutes that experiment already...
      - monocasa 10y ago
        A large sample size of people isn't necessary to verify the ability. Case in point, the woman who can smell Parkinson's disease, to some ridunculous p-value. http://www.scientificamerican.com/article/one-woman-s-ability-to-sniff-out-parkinson-s-offers-hope-to-sufferers/ http://www.scientificamerican.com/article/one-woman-s-abilit...
rosser 10y ago
How does this address masking "bad" transmissions behind "good" ones? Instead, the spooks will just make sure not to upload your chat logs until you start Tindering the next time, or something.
- mzs 10y ago
  Interestingly in the paper they address this somewhat for alternatives they discarded. Since they are proposing an introspection engine it should also drown-out the mic and cover the cameras. But then you still have the shock sensor that could record steps. I'm really inclined that a true power switch with introspection engine to verify things are really off is a better approach.
ISL 10y ago
Why go through test points rather than directly detecting RF emission? In addition to the required hardware modification, a sufficiently nefarious attacker might be able to spoof test points. RF power detection, on the other hand, can't lie. If it's going to communicate, the phone must transmit. An RF-detection tool would be as easy as a phone case (and could double as a backup battery for the phone). It'd be far simpler and easier to adopt than directly hacking on the hardware. Edit: My concerns are partially addressed in the actual paper: https://www.pubpub.org/pub/direct-radio-introspection https://www.pubpub.org/pub/direct-radio-introspection
- milesokeefe 10y ago
  One nefarious method malware could use to get data off the device without RF would be to play sub 20kHz audio through the speakers, assuming there was a device with a microphone near by that's able to receive the signal, and of course that the speakers can play a frequency that low. Along the same lines, but only successful if the user isn't looking, would be to use the flashlight LED. Or maybe very short low power vibrations, if the receiving microphone is on the same surface. All of these require somewhat particular situations, but fun to think about in any case :)
  - cobbzilla 10y ago
    yup, there are lots of non-EMF ways to get data off a device. iirc it's easier to transmit data with higher (inaudible) frequencies than lower ones.
  - brian-armstrong 10y ago
    If anyone would like to see this in action, try this out on your laptop https://quiet.github.io/quiet-js/ https://quiet.github.io/quiet-js/ </plug>
    - tripzilch 10y ago
      Cool! I always wondered what the accuracy/success rate of such a sidechannel would be, nice that your tool allows me to test this easily :) Interestingly enough, after some fiddling I could get it from my speakers to phone mic, and phone speakers to laptop mic, but only in the audible spectrum, not in the ultrasonic. Only response I got was one time, an error--probably one packet that failed the CRC check, but the rest of the time nothing. I didn't have time to mess with the code and try different modulation frequencies yet. But it's definitely a cool toy! :D
influx 10y ago
How does a Sharepoint administrator and high school drop out perform research on how to keep smartphones safe? Especially since he's under control of the FSB?
venomsnake 10y ago
Isn't that device a Faraday cage? And if you are in war zone - using a phone with removable battery is absolutely mandatory IMO.
- milesokeefe 10y ago
  As nfjstjstns notes, very often there is "a small second battery connected to the baseband for emergency purposes".
  - dmitrygr 10y ago
    This is entirely false for most modern phones
    - fhdhchffnfjc 10y ago
      Except it's not. https://security.stackexchange.com/questions/65382/is-it-possible-for-a-phone-to-be-transmitting-even-while-turned-off-and-the-batt https://security.stackexchange.com/questions/65382/is-it-pos... Do you have a vested interest in the matter?
      - dmitrygr 10y ago
        I've opened many phones and have one open in front of me. I have schematics of a few open too. Some have supercaps for RTC. No extra batteries.
        dmitrygr 10y ago
        Show me a picture on a teardown on ifixit with this in a nexus phone? Or in an iPhone? No? Yeah...
walrus01 10y ago
The problem that got Colvin killed is at the RF/layer 1 layer in the OSI stack... Iridium and Inmarsat phones operate in the L and S bands (1.2 to 2.0 GHz) which is not difficult to do radio frequency direction finding on, if the Tx source remains active. Particularly easy if you have access to Russian military grade DF equipment. The protocol layers and crypto are moot if you are radiating and have a determined DF adversary.
- sievebrain 10y ago
  Yeah, I'm not sure if the article starting that way was meant to suggest this device would have saved Colvin or if it was just meant as a vague illustration. Because as it points out, journalists do actually use their phones for calling people and receiving calls quite a lot, so the utility of a phone that is forced offline - for a journalist - would seem to be very low. Why have it powered at all, in that case? Couldn't you just buy a tablet that doesn't have any long-range radios to begin with? WiFi signals don't travel far.
  - walrus01 10y ago
    A typical handheld satellite phone doesn't stay powered up and on net much, if it's in a backpack or being carried around... You need to be standing with a clear sky view to use one. But if you're a journalist in a war zone sleeping in the same location 3 or 4 days in a row and making one 5-minute phone call a day, or sending iridium SMS a few times daily from the same lat/long, that is enoigh to DF you.
dewster 10y ago
Probably just showing my ignorance, but there is a processor running in the phone, and it is connected to the various chips on the board, and you can run your own apps that could query the chips directly? If the OS disallows this, I'd be hacking the OS, rather than the hardware. How did we get to this point, where our personal computing devices are completely out of our basic control? We live in bizarro world.
- dcposch 10y ago
  They explain in the article: your phone may be compromised, and an app running on the main processor has no reliable way to tell. That's why they're using a completely separate piece of hardware.
  - dewster 10y ago
    OK, I agree, we should wash our technical hands and let some poor schmuck in exile clean up all of our technical security messes.
    - solipsism 10y ago
      Why are you reacting like this to someone who's just telling you facts? You want to do something that's not possible. If your hardware is compromised (well), you can't fix that with software.
      - dewster 10y ago
        My reaction is because no one here seems to have any sense of ownership for the products they design, which are a key part of the security issues and abuses we are currently experiencing. If you participate in the design of a phone that broadcasts its position in dangerous situations without the user knowing this, and subsequently gets them killed, maybe you're so far down the line and organizationally have so many people between you and them that you don't notice the small amount of blood on your hands. Just by existing we all cause trouble, but I'd like to see a bit more ethical sense among those who are directly enabling the current oppressive state.
calebm 10y ago
I wonder if the use of the word "betraying" in the title is a subtle jab at Snowden.
- akshayn 10y ago
  Unlikely - the founding editor of The Intercept is Glenn Greenwald, one of the journalists who published the original Snowden stories.
- pluma 10y ago
  Quite the opposite. The idea is obviously that security agencies are betraying the people.
phones 10y ago
Of interest perhaps, here is a full source code of an Android phone software and its baseband firmware: https://github.com/mtker/MT6735_Longcheer https://github.com/mtker/MT6735_Longcheer Actually there is some .o files in the baseband but easy to pull apart in IDA. Each one relates to a single .c and there are export symbols.
frockwearer 10y ago
This same sort of approach has been used by terrorists in the past.
- misnome 10y ago
  So?
zanny 10y ago
You know, if we had source access and hardware blueprints to these devices and actually owned them, this wouldn't be a problem. But trying to solve an obvious problem (proprietary basebands, phones, and hardware) with bandage solutions kicks the problem down the road. We need to liberate the hardware eventually for liberty's sake.
jmiserez 10y ago
If you can't trust your phone, how would you ensure that it doesn't just record everything (audio, etc.) when in airplane mode and uploads it somewhere later, once you disable airplane mode. Seems to me that removing the battery would be safer.
pigeons 10y ago
The Neo900 is designed to detect unauthorized radio transmission from the modem and power the modem down in a fraction of a second, and notify you. It seems to be the only device that will have that capability. https://neo900.org/ https://neo900.org/ http://neo900.org/stuff/cccamp15/ccc2015talk/neo900-wpwrak_CCC2015.webm http://neo900.org/stuff/cccamp15/ccc2015talk/neo900-wpwrak_C...
- 01Michael10 10y ago
  That's great and I want one... Oh wait, it's a phone that costs over $500 with ancient hardware that probably won't see the light of day anyway.
smartbit 10y ago
The poor mans way of stopping your iDevice from transmitting, is by putting it in DFU mode [0]. This regretfully will prevent you from using it for anything else too, unlike airplane mode. And some will probably argue that a nation state could mimic DFU on an active phone, but it is a viable option that anyone afraid of being under surveillance could chose. The timing of DFU mode can be quite difficult, this video [1] has been help to millions. Alternatively some use an iPod with only Signal installed. As stubborn Moxie requires access to the address book [2], the iPod address book is exclusively used for Signal addressees. [0] https://www.theiphonewiki.com/wiki/DFU_Mode#Entering_DFU_Mode_on_iPhone.2C_iPad_or_iPod_touch https://www.theiphonewiki.com/wiki/DFU_Mode#Entering_DFU_Mod... [1] https://youtu.be/bITIiGswjF https://youtu.be/bITIiGswjF [2] https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/
- mikeevans 10y ago
  I'm getting "This video does not exist." on the YouTube link.
  - smartbit 10y ago
    Sorry, link [1] is http://youtu.be/bITIiGswjFI http://youtu.be/bITIiGswjFI
- willstrafach 10y ago
  This advice does not make much sense, DFU Mode is for performing a full restore on a device. It is not a way you'd just carry a device around, I believe it actually reboots after a certain amount of time. At that point just walking around with a powered off device makes more sense than DFU.
  - smartbit 10y ago
    Maybe this is not an option for you and you prefer turning it off if you want to protect yourself against nation state attackers. I assume the DFU mode ROM is hardcoded and therefore more difficult to attack, but if you have heard of DFU mode attacks/simulations/circumventions, by all means let us know. Turning a device off can be easy simulated on a jailbroken device as Snowden argued by asking journalist to put their devices in the fridge. I wasn't aware that an iDevice comes out of DFU mode after some time, please enlighten us. According to the instructions [0] I understand you need a special set of actions to return to the normal firmware.
cowardlydragon 10y ago
Almost like you need a faraday cage for the phone, with an internal antenna, a "router" through the faraday cage that you have hardware/software control, and then an antenna to rebroadcast outside the cage. Basically, a radio firewall. So you can enforce absolute radio silence if needed. And log the signals.
cowardlydragon 10y ago
Almost like you need a faraday cage for the phone, with an internal antenna, a "router" through the faraday cage that you have hardware/software control, and then an antenna to rebroadcast outside the cage. Basically, a radio firewall. So you can enforce absolute radio silence if needed. And log the signals.
cowardlydragon 10y ago
Almost like you need a faraday cage for the phone, with an internal antenna, a "router" through the faraday cage that you have hardware/software control, and then an antenna to rebroadcast outside the cage. Basically, a radio firewall. So you can enforce absolute radio silence if needed. And log the signals.
sangnoir 10y ago
How hard would it be to make the following after-market modifications? 1. add a physical "off" switch that cuts battery power to everything 2. (Hard Mode) Cut power to all radio chips/subsystems (GSM, WIFI, bluetooth) while leaving the rest smartphone operational for taking pictures or recording audio?
contingencies 10y ago
If Freedom of the Press Foundation set up a supply chain of modified phones then the NSA and their ilk will likely intercept and compromise any mailed devices before they reach the intended recipients.

296 points by secfirstmd 10y ago

This does seem feasible for the specific use case of a protected phone for "clandestine" meetings. My initial thought was they'd have to redesign it for every phone, but that's not necessarily the case. If eaves dropping is such a concern for you, I would think you would be okay with not having the latest gen phone. Or having an old one just for these sorts cases. I suppose the concern then shifts to whether this device is easily subverted, or whether it's easy to determine if it has been subverted.

DamnYuppie 10y ago
Why does not wanting to have someone eaves drop on me mean I have to use inferior technology? I find that to be offense in the extreme. Everyone should be concerned about or more ideally not have to worry about people accessing their phone without their knowledge.

semi-extrinsic 10y ago

No disrespect to Snowden and Bunnie, but it seems to me that a much simpler solution giving you a much higher OPSEC is to buy a smartphone with a removable battery. No battery, no radios are on. And if you are truly paranoid, it's simple to disassemble the phone and look for/remove any backup batteries. I know, I had to pull the backup battery from my wife's Moto G after it fell in the sink.

ashitlerferad 10y ago
No battery leads to a useless mobile computer.
- pyre 10y ago
  Depends on your use-case. If you only want to stop communications during a specified period of time (e.g.) during a "secret" conversation, then this is useful. If you have any apps installed that might be polling the 'net for information (e.g. checking the weather), then this is useless in the general case of "the phone is on my desk next to me while I'm working."
  - semi-extrinsic 10y ago
    What is described in the article does not do traffic inspection, it only verifies that all radios are off. I see the argument that there is a use case for the smartphone for taking pictures while operating without radios. But wouldn't a better solution then be a compact digital camera and a notebook? You can invent your own code for note taking that becomes arbitrarily hard to break. You can disguise a compact camera as a smartphone using just a case and a hot glue gun.
- panax 10y ago
  There is also the convenience factor. I do remove my battery frequently from my phone but it is too easy to just leave it on. People will generally not want to hassle with it if they don't have to.If security is easier and requires less effort then it lowers the cost and will be favored more often and it will protect more people. There are also many times that people have been unhappy because I have my phone off and unable to reach me. There are also other times you want to be available. Unfortunately, if your phone is owned then they can just exfiltrate the data when normal data transfer occurs. The data will still need to be stored for transmission later though. With the iphone, you also need to monitor Bluetooth and WiFi in addition to cellular activity. Hopefully they will also monitor these.
vhdjdjvhdhd 10y ago
Actually smartphones, even with a removable battery, have a very small second cell hooked up to the baseband hardware for emergency purposes. I've taken a few apart and confirmed this firsthand.
nfjstjstns 10y ago
Actually, regardless of whether or not smartphones have a removable battery, there's always a small second battery connected to the baseband for emergency purposes. I've confirmed this firsthand by taking apart several models, and you make out small coin cells on most online disassembly documentation as well. The one in my old Atrix was a good 250mAh.
- walterbell 10y ago
  What would the baseband transmit in an emergency and how would it know that there was an emergency, if the phone itself had lost power? When a phone is off or out of power, is the baseband periodically pinging cell towers?
  - sliverstorm 10y ago
    I could see coordinates, e.g. of a lost party, or someone who called 911 but got disconnected by a low battery, that kind of thing. Cell phone pings can be extremely handy for SAR.
  - yardie 10y ago
    If it has a 250mAh battery then that is good for a continuous 1/4W transmission for 1 hour. But I imagine the batter is mainly there for the watchdog and RTC. Which is why you never have to set the clock every time you turn the phone on.
    - jeffbush 10y ago
      You don't need to set the clock when you turn on the phone because it gets the time from the network when it registers.
      - yardie 10y ago
        Pull your sim and battery. Reinsert the battery and turn the phone on. The time is still there, network or not.
- 10y ago
awqrre 10y ago
Wouldn't it be easier to use some kind of case or pocket [0] that acts as a Faraday cage? 0: http://www.popsci.com/sites/popsci.com/files/styles/large_1x_/public/import/2013/images/2013/08/Off%20Pocket.jpg http://www.popsci.com/sites/popsci.com/files/styles/large_1x...
- milesokeefe 10y ago
  That seems safer, with Snowden's device it has to detect transmission after it begins to occur in order to trigger shutdown or alert the user, so it's going to leak some amount of RF even if little. A properly constructed Faraday cage shouldn't though.
  - awqrre 10y ago
    I think that Snowden's device would play a different role, I was comparing it to removing the main and backup batteries.
- misnome 10y ago
  So it records and transmits later, at opportunity.
  - awqrre 10y ago
    Good point. I guess it depends on the use case.
rl3 10y ago
Better yet, install a small custom switch that enables you to physically disconnect power from the battery without actually having to remove it from the phone. Much less conspicuous if you're in public under physical surveillance, and provides options for phones with non-removable batteries assuming the right modifications are made.
superuser2 10y ago
+1. If you are trying to detect surveillance by considering RF emissions but only some of the time, a sane attacker will simply have the bug record what it needs and transmit it in a burst later when you will not find RF activity suspicious. You need to prevent the thing from recording you in the first place.
Iv 10y ago
A metal case will block any unwanted RF emission. That said, the article states that the goal is to make it possible for users to still use their smartphones as camera, GPS, or whatever tool you need on it, while being safe. As someone who knows a bit about computer security I find it mindblowing that journalists would go into war zones and expect to be stealthy with their smartphones in their pockets but they apparently are willing to risk their lives for their iPhones, so the best we can do is offer tools to mitigate the risks.
jokoon 10y ago
Snowden explained that the CMOS button battery is enough to send a transponder signal that can be heard by a drone. He said the only way to shut it down is to put it in a freezer. I mean, I'm a programmer, I am not an expert on sigint stuff, but I don't think it's very hard to innovate in intelligence gathering technologies.

jakobdabo 10y ago

When I place my smartphone on the desk near the computer speakers any time it is going to ring the speakers start making a funny noise a second or two before the ringing starts. So I presume it must be possible to DIY a cheap sensor for GSM signal detection based on a little speaker.

retox 10y ago
This is a silly question but I'd like to understand if it's possible for a human to sense those same signals. So many times I have had a sensation that my phone will ring and then moments later it does. Probably confirmation bias or maybe I'm subconsciously hearing the interference in speakers and taking the hint from there. It doesn't happen every time and I don't receive a lot of calls. HN seems a decent place to settle it once and for all.
- kcorbitt 10y ago
  It seems very unlikely that you would be able to sense those frequencies, except indirectly through something like audible speaker interference. However, this would be pretty easy to test! Just have a friend call you at random times throughout a 2-hour interval or something, and record every time you think the phone is about to ring, and every time it actually does. If there's a close enough correlation between the two, that's fairly persuasive evidence.
  - sdkjfwiluf 10y ago
    please please do it!
  - michaelvoz 10y ago
    This is still anecdotal. You would need hundreds of people, also, the very fact that you are expecting calls pollutes that experiment already...
    - monocasa 10y ago
      A large sample size of people isn't necessary to verify the ability. Case in point, the woman who can smell Parkinson's disease, to some ridunculous p-value. http://www.scientificamerican.com/article/one-woman-s-ability-to-sniff-out-parkinson-s-offers-hope-to-sufferers/ http://www.scientificamerican.com/article/one-woman-s-abilit...

rosser 10y ago

How does this address masking "bad" transmissions behind "good" ones? Instead, the spooks will just make sure not to upload your chat logs until you start Tindering the next time, or something.

mzs 10y ago
Interestingly in the paper they address this somewhat for alternatives they discarded. Since they are proposing an introspection engine it should also drown-out the mic and cover the cameras. But then you still have the shock sensor that could record steps. I'm really inclined that a true power switch with introspection engine to verify things are really off is a better approach.

ISL 10y ago

Why go through test points rather than directly detecting RF emission? In addition to the required hardware modification, a sufficiently nefarious attacker might be able to spoof test points. RF power detection, on the other hand, can't lie. If it's going to communicate, the phone must transmit. An RF-detection tool would be as easy as a phone case (and could double as a backup battery for the phone). It'd be far simpler and easier to adopt than directly hacking on the hardware. Edit: My concerns are partially addressed in the actual paper: https://www.pubpub.org/pub/direct-radio-introspection https://www.pubpub.org/pub/direct-radio-introspection

milesokeefe 10y ago
One nefarious method malware could use to get data off the device without RF would be to play sub 20kHz audio through the speakers, assuming there was a device with a microphone near by that's able to receive the signal, and of course that the speakers can play a frequency that low. Along the same lines, but only successful if the user isn't looking, would be to use the flashlight LED. Or maybe very short low power vibrations, if the receiving microphone is on the same surface. All of these require somewhat particular situations, but fun to think about in any case :)
- cobbzilla 10y ago
  yup, there are lots of non-EMF ways to get data off a device. iirc it's easier to transmit data with higher (inaudible) frequencies than lower ones.
- brian-armstrong 10y ago
  If anyone would like to see this in action, try this out on your laptop https://quiet.github.io/quiet-js/ https://quiet.github.io/quiet-js/ </plug>
  - tripzilch 10y ago
    Cool! I always wondered what the accuracy/success rate of such a sidechannel would be, nice that your tool allows me to test this easily :) Interestingly enough, after some fiddling I could get it from my speakers to phone mic, and phone speakers to laptop mic, but only in the audible spectrum, not in the ultrasonic. Only response I got was one time, an error--probably one packet that failed the CRC check, but the rest of the time nothing. I didn't have time to mess with the code and try different modulation frequencies yet. But it's definitely a cool toy! :D

influx 10y ago

How does a Sharepoint administrator and high school drop out perform research on how to keep smartphones safe? Especially since he's under control of the FSB?

venomsnake 10y ago

Isn't that device a Faraday cage? And if you are in war zone - using a phone with removable battery is absolutely mandatory IMO.

milesokeefe 10y ago
As nfjstjstns notes, very often there is "a small second battery connected to the baseband for emergency purposes".
- dmitrygr 10y ago
  This is entirely false for most modern phones
  - fhdhchffnfjc 10y ago
    Except it's not. https://security.stackexchange.com/questions/65382/is-it-possible-for-a-phone-to-be-transmitting-even-while-turned-off-and-the-batt https://security.stackexchange.com/questions/65382/is-it-pos... Do you have a vested interest in the matter?
    - dmitrygr 10y ago
      I've opened many phones and have one open in front of me. I have schematics of a few open too. Some have supercaps for RTC. No extra batteries.
      - dmitrygr 10y ago
        Show me a picture on a teardown on ifixit with this in a nexus phone? Or in an iPhone? No? Yeah...

walrus01 10y ago

The problem that got Colvin killed is at the RF/layer 1 layer in the OSI stack... Iridium and Inmarsat phones operate in the L and S bands (1.2 to 2.0 GHz) which is not difficult to do radio frequency direction finding on, if the Tx source remains active. Particularly easy if you have access to Russian military grade DF equipment. The protocol layers and crypto are moot if you are radiating and have a determined DF adversary.

sievebrain 10y ago
Yeah, I'm not sure if the article starting that way was meant to suggest this device would have saved Colvin or if it was just meant as a vague illustration. Because as it points out, journalists do actually use their phones for calling people and receiving calls quite a lot, so the utility of a phone that is forced offline - for a journalist - would seem to be very low. Why have it powered at all, in that case? Couldn't you just buy a tablet that doesn't have any long-range radios to begin with? WiFi signals don't travel far.
- walrus01 10y ago
  A typical handheld satellite phone doesn't stay powered up and on net much, if it's in a backpack or being carried around... You need to be standing with a clear sky view to use one. But if you're a journalist in a war zone sleeping in the same location 3 or 4 days in a row and making one 5-minute phone call a day, or sending iridium SMS a few times daily from the same lat/long, that is enoigh to DF you.

dewster 10y ago

Probably just showing my ignorance, but there is a processor running in the phone, and it is connected to the various chips on the board, and you can run your own apps that could query the chips directly? If the OS disallows this, I'd be hacking the OS, rather than the hardware. How did we get to this point, where our personal computing devices are completely out of our basic control? We live in bizarro world.

dcposch 10y ago
They explain in the article: your phone may be compromised, and an app running on the main processor has no reliable way to tell. That's why they're using a completely separate piece of hardware.
- dewster 10y ago
  OK, I agree, we should wash our technical hands and let some poor schmuck in exile clean up all of our technical security messes.
  - solipsism 10y ago
    Why are you reacting like this to someone who's just telling you facts? You want to do something that's not possible. If your hardware is compromised (well), you can't fix that with software.
    - dewster 10y ago
      My reaction is because no one here seems to have any sense of ownership for the products they design, which are a key part of the security issues and abuses we are currently experiencing. If you participate in the design of a phone that broadcasts its position in dangerous situations without the user knowing this, and subsequently gets them killed, maybe you're so far down the line and organizationally have so many people between you and them that you don't notice the small amount of blood on your hands. Just by existing we all cause trouble, but I'd like to see a bit more ethical sense among those who are directly enabling the current oppressive state.

calebm 10y ago

I wonder if the use of the word "betraying" in the title is a subtle jab at Snowden.

akshayn 10y ago
Unlikely - the founding editor of The Intercept is Glenn Greenwald, one of the journalists who published the original Snowden stories.
pluma 10y ago
Quite the opposite. The idea is obviously that security agencies are betraying the people.

phones 10y ago

Of interest perhaps, here is a full source code of an Android phone software and its baseband firmware: https://github.com/mtker/MT6735_Longcheer https://github.com/mtker/MT6735_Longcheer Actually there is some .o files in the baseband but easy to pull apart in IDA. Each one relates to a single .c and there are export symbols.

frockwearer 10y ago

This same sort of approach has been used by terrorists in the past.

misnome 10y ago
So?

zanny 10y ago

You know, if we had source access and hardware blueprints to these devices and actually owned them, this wouldn't be a problem. But trying to solve an obvious problem (proprietary basebands, phones, and hardware) with bandage solutions kicks the problem down the road. We need to liberate the hardware eventually for liberty's sake.

jmiserez 10y ago

If you can't trust your phone, how would you ensure that it doesn't just record everything (audio, etc.) when in airplane mode and uploads it somewhere later, once you disable airplane mode. Seems to me that removing the battery would be safer.

pigeons 10y ago

The Neo900 is designed to detect unauthorized radio transmission from the modem and power the modem down in a fraction of a second, and notify you. It seems to be the only device that will have that capability. https://neo900.org/ https://neo900.org/ http://neo900.org/stuff/cccamp15/ccc2015talk/neo900-wpwrak_CCC2015.webm http://neo900.org/stuff/cccamp15/ccc2015talk/neo900-wpwrak_C...

01Michael10 10y ago
That's great and I want one... Oh wait, it's a phone that costs over $500 with ancient hardware that probably won't see the light of day anyway.

smartbit 10y ago

The poor mans way of stopping your iDevice from transmitting, is by putting it in DFU mode [0]. This regretfully will prevent you from using it for anything else too, unlike airplane mode. And some will probably argue that a nation state could mimic DFU on an active phone, but it is a viable option that anyone afraid of being under surveillance could chose. The timing of DFU mode can be quite difficult, this video [1] has been help to millions. Alternatively some use an iPod with only Signal installed. As stubborn Moxie requires access to the address book [2], the iPod address book is exclusively used for Signal addressees. [0] https://www.theiphonewiki.com/wiki/DFU_Mode#Entering_DFU_Mode_on_iPhone.2C_iPad_or_iPod_touch https://www.theiphonewiki.com/wiki/DFU_Mode#Entering_DFU_Mod... [1] https://youtu.be/bITIiGswjF https://youtu.be/bITIiGswjF [2] https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/

mikeevans 10y ago
I'm getting "This video does not exist." on the YouTube link.
- smartbit 10y ago
  Sorry, link [1] is http://youtu.be/bITIiGswjFI http://youtu.be/bITIiGswjFI
willstrafach 10y ago
This advice does not make much sense, DFU Mode is for performing a full restore on a device. It is not a way you'd just carry a device around, I believe it actually reboots after a certain amount of time. At that point just walking around with a powered off device makes more sense than DFU.
- smartbit 10y ago
  Maybe this is not an option for you and you prefer turning it off if you want to protect yourself against nation state attackers. I assume the DFU mode ROM is hardcoded and therefore more difficult to attack, but if you have heard of DFU mode attacks/simulations/circumventions, by all means let us know. Turning a device off can be easy simulated on a jailbroken device as Snowden argued by asking journalist to put their devices in the fridge. I wasn't aware that an iDevice comes out of DFU mode after some time, please enlighten us. According to the instructions [0] I understand you need a special set of actions to return to the normal firmware.

cowardlydragon 10y ago

Almost like you need a faraday cage for the phone, with an internal antenna, a "router" through the faraday cage that you have hardware/software control, and then an antenna to rebroadcast outside the cage. Basically, a radio firewall. So you can enforce absolute radio silence if needed. And log the signals.

cowardlydragon 10y ago

sangnoir 10y ago

How hard would it be to make the following after-market modifications? 1. add a physical "off" switch that cuts battery power to everything 2. (Hard Mode) Cut power to all radio chips/subsystems (GSM, WIFI, bluetooth) while leaving the rest smartphone operational for taking pictures or recording audio?

contingencies 10y ago

If Freedom of the Press Foundation set up a supply chain of modified phones then the NSA and their ilk will likely intercept and compromise any mailed devices before they reach the intended recipients.