5 ms·

Phones, like antiviruses, modems, cloud provider etc increasing feel like a case of "pick which nation state's backdoor you feel more comfortable with." I find

Phones, like antiviruses, modems, cloud provider etc increasing feel like a case of "pick which nation state's backdoor you feel more comfortable with." I find myself occasionally thinking (we work on human rights topics), well I don't really piss off the USA or EU so I will buy say an antivirus from there but I do piss off XYZ so I won't buy a product from there. What a mad world we live in that software/hardware purchasing has a geostrategic component. It always has done for government etc but now it does for the consumer.

Roritharr 10y ago
I do that too, but I wonder if it really matters. Does China care about what I as a citizen of Germany say about their five year Plan? Maybe. Enough for them to take Action? Doubtful.
- tropo 10y ago
  They care about what you do for work. Do you use your phone to discuss proprietary information? Might that be of value to a Chinese competitor, supplier, or customer? Do you take your phone places where the camera or microphone might pick up something of value, even if left in your pocket or on your desk? Do you take your phone near wireless networks that might be hackable? If so, China does care about you.
  - powerapple 10y ago
    definitely, a low-end android phone user might be important for China because his job is very important.
linkregister 10y ago
Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? As far as the geostrategic component of telecommunications choice, when was it not like this? Postal letter: address logging, letter opening; telegram: logging, transcription; land telephone: call logs and wiretapping; wireless telephone: call logs and wiretapping; email (without STARTTLS): metadata logging and interception; social network: government search order. The modern encrypted methods of communication (iMessage, PGP, Signal) are the first methods where one could feel comfortable about the local government having extreme difficulty intercepting your communication. I think it is essential to consider geography when deciding telecommunications hardware, software, and service. There may have been a local maximum in the early-mid 2000s, but this is only part of a long-term trend of improving privacy in telecommunications.
- secfirstmd 10y ago
  True, I always try to open a training about surveillance by mentioning Western Union etc to give it historical perspective.
- tomp 10y ago
  Wasn't Apple's "goto fail" bug a partial backdoor into iOS? Considering how long it took for it to be discovered, is it really so improbably that there are similar, or more serious, backdoors in other software, even if open source?
  - huxley 10y ago
    "goto fail" certainly could be used as a way of subverting iOS security but it provided indiscriminate access in a way that seems more like a vulnerability caused by a bug. Maybe some actor did add the goto fail for nefarious reasons, but it can quite easily be explained by a merge error. It's not easy to explain this particular backdoor as anything but a backdoor. From the article: "The binary responsible for the firmware OTA update operations also includes code to hide its presence from the Android OS, along with two other binaries and their processes. A developer looking at active Android processes won't be able to tell when there's an update coming to his phone."
- SEJeff 10y ago
  They honestly won't have to if they have a backdoor in the baseband modem, which even in the most OSS friendly phones is still controlled by a large binary blob from the manufacturer. Who's to say state agencies (NSA/GHCQ/etc) haven't found bugs in it just like they have in hard drive firmwares to persist APTs indefinitely?
- sangnoir 10y ago
  > Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? Didn't they backdoor a crypto standard on the said OSes?
- hvidgaard 10y ago
  > Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? They don't need to, if they can put malicious code into the hardware, and bypass the software stack entirely.
mtgx 10y ago
Wait until people start buying self-driving cars from China in droves. That ought to be "fun". Even if nobody from China intends to kill you, those backdoors will be used by other spy agencies/drug cartels/criminals, too, whether China intends for it to happen or not. At the very least they may be used for ransomware that asks for $1,000 to unlock your car - or not drive you off a cliff.
deleted 10y ago
[deleted]

Roritharr 10y ago

I do that too, but I wonder if it really matters. Does China care about what I as a citizen of Germany say about their five year Plan? Maybe. Enough for them to take Action? Doubtful.

tropo 10y ago
They care about what you do for work. Do you use your phone to discuss proprietary information? Might that be of value to a Chinese competitor, supplier, or customer? Do you take your phone places where the camera or microphone might pick up something of value, even if left in your pocket or on your desk? Do you take your phone near wireless networks that might be hackable? If so, China does care about you.
- powerapple 10y ago
  definitely, a low-end android phone user might be important for China because his job is very important.

linkregister 10y ago

Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? As far as the geostrategic component of telecommunications choice, when was it not like this? Postal letter: address logging, letter opening; telegram: logging, transcription; land telephone: call logs and wiretapping; wireless telephone: call logs and wiretapping; email (without STARTTLS): metadata logging and interception; social network: government search order. The modern encrypted methods of communication (iMessage, PGP, Signal) are the first methods where one could feel comfortable about the local government having extreme difficulty intercepting your communication. I think it is essential to consider geography when deciding telecommunications hardware, software, and service. There may have been a local maximum in the early-mid 2000s, but this is only part of a long-term trend of improving privacy in telecommunications.

secfirstmd 10y ago
True, I always try to open a training about surveillance by mentioning Western Union etc to give it historical perspective.
tomp 10y ago
Wasn't Apple's "goto fail" bug a partial backdoor into iOS? Considering how long it took for it to be discovered, is it really so improbably that there are similar, or more serious, backdoors in other software, even if open source?
- huxley 10y ago
  "goto fail" certainly could be used as a way of subverting iOS security but it provided indiscriminate access in a way that seems more like a vulnerability caused by a bug. Maybe some actor did add the goto fail for nefarious reasons, but it can quite easily be explained by a merge error. It's not easy to explain this particular backdoor as anything but a backdoor. From the article: "The binary responsible for the firmware OTA update operations also includes code to hide its presence from the Android OS, along with two other binaries and their processes. A developer looking at active Android processes won't be able to tell when there's an update coming to his phone."
SEJeff 10y ago
They honestly won't have to if they have a backdoor in the baseband modem, which even in the most OSS friendly phones is still controlled by a large binary blob from the manufacturer. Who's to say state agencies (NSA/GHCQ/etc) haven't found bugs in it just like they have in hard drive firmwares to persist APTs indefinitely?
sangnoir 10y ago
> Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? Didn't they backdoor a crypto standard on the said OSes?
hvidgaard 10y ago
> Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? They don't need to, if they can put malicious code into the hardware, and bypass the software stack entirely.

mtgx 10y ago

Wait until people start buying self-driving cars from China in droves. That ought to be "fun". Even if nobody from China intends to kill you, those backdoors will be used by other spy agencies/drug cartels/criminals, too, whether China intends for it to happen or not. At the very least they may be used for ransomware that asks for $1,000 to unlock your car - or not drive you off a cliff.

deleted 10y ago

[deleted]