4 ms·

->There's a LOT that the phone OS and hardware manufacturers can do at the hardware and firmware level to make things better. Yeah, like not issuing phones wit

by mSparks 10y ago

->There's a LOT that the phone OS and hardware manufacturers can do at the hardware and firmware level to make things better. Yeah, like not issuing phones with intentionally compromised baseband processors. In fact, any phone that has a direct connection from the mic to the baseband processor is not just "hackable" - it's designed to hack your life (hint:all of them).

agentdrtran 10y ago
Any proof of this?
- mSparks 10y ago
  https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker They basically give external control to all the baseband processors functions (read mic, control signal, read gps chip etc.) It's why snowden made: https://www.wired.com/2016/07/snowden-designs-device-warn-iphones-radio-snitches/ https://www.wired.com/2016/07/snowden-designs-device-warn-ip... because if your phone is in airplane mode, it shouldn't be transmitting - and they can all be made to. (Oh, and I have friends who served in Afghanistan, so found out about all this around 2002)
nickpsecurity 10y ago
Part of this comes from long-standing partnerships between telecoms and intelligence agencies. Esp MI6. Ever wonder why there were protocol steps like answering without ringing ir notifying user available in user phones? Sure it was just for data collection systems in industry that happen to hack a solution out of a GSM phone. ;) Unfortunately, many schemes were baked into the standards you certify against. Good luck changing that while reaching mass market.
- deleted 10y ago
  [deleted]
- mSparks 10y ago
  Who now have nothing better to do than down vote comments like this. Like anyone important doesn't already have access to one of the thousands of black market stingray type devices that came out a couple of years ago. http://motherboard.vice.com/read/the-black-market-dealers-selling-state-surveillance-equipment-online http://motherboard.vice.com/read/the-black-market-dealers-se...
  - nickpsecurity 10y ago
    For example: http://www.zdnet.com/article/invasive-phone-tracking-new-ss7-research-blows-the-lid-off-personal-security/ http://www.zdnet.com/article/invasive-phone-tracking-new-ss7... The NSA and GHCQ, among others, were constantly reviewing the phone standards for use in secure products + SIGINT obviously. The were putting experienced breakers and security engineers on it, many with extensive COMSEC background. The phones their defense contractors produced had few to none of these weaknesses depending on security vs usability tradeoff. Many private suppliers, who sold to governments, did the same. The internal presentations whose details leaked in various papers around government programs and defense products also showed they consistently knew risks of transmission mediums. It's actually the only form of security they know through and through down to emissions of analog components. They mastered it decades ago with only real challenge being people wanted benefits of insecure phones. :) Then, they not only allowed these standards but endorsed them for the general public and businesses. They also made it illegal for us to buy their Type 1-secure phones or TEMPEST-certified devices. That last part is how you go from "were they just incompetent?" to "they're deliberately keeping us insecure to enable SIGINT!" If they say it's to stop reverse engineering, then ask why the recent devices are supposed to be field releasable where enemies might pick them up but citizens of Five Eyes still can't buy them. Excuses getting thinner and thinner even if we never get some contractor leaking the proof we need from somewhere in Hawaii. ;)
jrcii 10y ago
The Neo900 sandboxes the baseband, our best hope for a secure phone and last I checked they're busy arguing with PayPal to get their account back, very sad.
- walterbell 10y ago
  Looks like they are now accepting down payments via wire transfer, https://my.neo900.org https://my.neo900.org. The FAQ claims they will pay 2% monthly (!) interest on down-payments, http://neo900.org/faq http://neo900.org/faq. Even with reuse of a Nokia N900 case/LCD, the motherboard will cost about $1K USD. The FAQ mentions baseband isolation: "We're going to address privacy concerns of non-free modem firmware by ensuring that the modem has access to no more data than absolutely necessary, so it won't be able to spy on anything that's not already available on carrier side. On Neo900 one can be sure that the modem is actually turned off when requested, not just pretending to be. Users will be notified in case of the modem wanting to do something without their consent. Unlike some other smartphones do, Neo900 won't share system RAM with the modem and system CPU will always have full control over the microphone signal sent to the modem. You can think of it as a USB dongle connected to the PC, with you in full control over the drivers, with a virtual LED to show any modem activity." It might be possible to attack the phone from the USB connection to the baseband, https://news.ycombinator.com/item?id=12673735 https://news.ycombinator.com/item?id=12673735
  - Arch-TK 10y ago
    The proposal you linked would not work if the specific USB interface was set up correctly to only allow a specific device (identified by a specific whitelisted USB device descriptor) to operate only with a specific driver. This internal USB interface in the Neo900 will allow this sort of configuration which would prevent the attack you suggest. Sure if you plug in random USB devices via the OTG port or the pins under the battery you could attempt this attack (if security was once again loose on those ports) but hopefully your USB keyboard/mouse/flash drive or whatever you're plugging into there is less dangerous and black-box than a baseband modem. And heck, if you are still worried nothing stops you from applying the same security measures to those interfaces as well.

by mSparks 10y ago

agentdrtran 10y ago

Any proof of this?

mSparks 10y ago
https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker They basically give external control to all the baseband processors functions (read mic, control signal, read gps chip etc.) It's why snowden made: https://www.wired.com/2016/07/snowden-designs-device-warn-iphones-radio-snitches/ https://www.wired.com/2016/07/snowden-designs-device-warn-ip... because if your phone is in airplane mode, it shouldn't be transmitting - and they can all be made to. (Oh, and I have friends who served in Afghanistan, so found out about all this around 2002)

nickpsecurity 10y ago

Part of this comes from long-standing partnerships between telecoms and intelligence agencies. Esp MI6. Ever wonder why there were protocol steps like answering without ringing ir notifying user available in user phones? Sure it was just for data collection systems in industry that happen to hack a solution out of a GSM phone. ;) Unfortunately, many schemes were baked into the standards you certify against. Good luck changing that while reaching mass market.

deleted 10y ago
[deleted]
mSparks 10y ago
Who now have nothing better to do than down vote comments like this. Like anyone important doesn't already have access to one of the thousands of black market stingray type devices that came out a couple of years ago. http://motherboard.vice.com/read/the-black-market-dealers-selling-state-surveillance-equipment-online http://motherboard.vice.com/read/the-black-market-dealers-se...
- nickpsecurity 10y ago
  For example: http://www.zdnet.com/article/invasive-phone-tracking-new-ss7-research-blows-the-lid-off-personal-security/ http://www.zdnet.com/article/invasive-phone-tracking-new-ss7... The NSA and GHCQ, among others, were constantly reviewing the phone standards for use in secure products + SIGINT obviously. The were putting experienced breakers and security engineers on it, many with extensive COMSEC background. The phones their defense contractors produced had few to none of these weaknesses depending on security vs usability tradeoff. Many private suppliers, who sold to governments, did the same. The internal presentations whose details leaked in various papers around government programs and defense products also showed they consistently knew risks of transmission mediums. It's actually the only form of security they know through and through down to emissions of analog components. They mastered it decades ago with only real challenge being people wanted benefits of insecure phones. :) Then, they not only allowed these standards but endorsed them for the general public and businesses. They also made it illegal for us to buy their Type 1-secure phones or TEMPEST-certified devices. That last part is how you go from "were they just incompetent?" to "they're deliberately keeping us insecure to enable SIGINT!" If they say it's to stop reverse engineering, then ask why the recent devices are supposed to be field releasable where enemies might pick them up but citizens of Five Eyes still can't buy them. Excuses getting thinner and thinner even if we never get some contractor leaking the proof we need from somewhere in Hawaii. ;)

jrcii 10y ago

The Neo900 sandboxes the baseband, our best hope for a secure phone and last I checked they're busy arguing with PayPal to get their account back, very sad.

walterbell 10y ago
Looks like they are now accepting down payments via wire transfer, https://my.neo900.org https://my.neo900.org. The FAQ claims they will pay 2% monthly (!) interest on down-payments, http://neo900.org/faq http://neo900.org/faq. Even with reuse of a Nokia N900 case/LCD, the motherboard will cost about $1K USD. The FAQ mentions baseband isolation: "We're going to address privacy concerns of non-free modem firmware by ensuring that the modem has access to no more data than absolutely necessary, so it won't be able to spy on anything that's not already available on carrier side. On Neo900 one can be sure that the modem is actually turned off when requested, not just pretending to be. Users will be notified in case of the modem wanting to do something without their consent. Unlike some other smartphones do, Neo900 won't share system RAM with the modem and system CPU will always have full control over the microphone signal sent to the modem. You can think of it as a USB dongle connected to the PC, with you in full control over the drivers, with a virtual LED to show any modem activity." It might be possible to attack the phone from the USB connection to the baseband, https://news.ycombinator.com/item?id=12673735 https://news.ycombinator.com/item?id=12673735
- Arch-TK 10y ago
  The proposal you linked would not work if the specific USB interface was set up correctly to only allow a specific device (identified by a specific whitelisted USB device descriptor) to operate only with a specific driver. This internal USB interface in the Neo900 will allow this sort of configuration which would prevent the attack you suggest. Sure if you plug in random USB devices via the OTG port or the pins under the battery you could attempt this attack (if security was once again loose on those ports) but hopefully your USB keyboard/mouse/flash drive or whatever you're plugging into there is less dangerous and black-box than a baseband modem. And heck, if you are still worried nothing stops you from applying the same security measures to those interfaces as well.