4 ms·

Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? As far as the geost

Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? As far as the geostrategic component of telecommunications choice, when was it not like this? Postal letter: address logging, letter opening; telegram: logging, transcription; land telephone: call logs and wiretapping; wireless telephone: call logs and wiretapping; email (without STARTTLS): metadata logging and interception; social network: government search order. The modern encrypted methods of communication (iMessage, PGP, Signal) are the first methods where one could feel comfortable about the local government having extreme difficulty intercepting your communication. I think it is essential to consider geography when deciding telecommunications hardware, software, and service. There may have been a local maximum in the early-mid 2000s, but this is only part of a long-term trend of improving privacy in telecommunications.

secfirstmd 10y ago
True, I always try to open a training about surveillance by mentioning Western Union etc to give it historical perspective.
tomp 10y ago
Wasn't Apple's "goto fail" bug a partial backdoor into iOS? Considering how long it took for it to be discovered, is it really so improbably that there are similar, or more serious, backdoors in other software, even if open source?
- huxley 10y ago
  "goto fail" certainly could be used as a way of subverting iOS security but it provided indiscriminate access in a way that seems more like a vulnerability caused by a bug. Maybe some actor did add the goto fail for nefarious reasons, but it can quite easily be explained by a merge error. It's not easy to explain this particular backdoor as anything but a backdoor. From the article: "The binary responsible for the firmware OTA update operations also includes code to hide its presence from the Android OS, along with two other binaries and their processes. A developer looking at active Android processes won't be able to tell when there's an update coming to his phone."
SEJeff 10y ago
They honestly won't have to if they have a backdoor in the baseband modem, which even in the most OSS friendly phones is still controlled by a large binary blob from the manufacturer. Who's to say state agencies (NSA/GHCQ/etc) haven't found bugs in it just like they have in hard drive firmwares to persist APTs indefinitely?
sangnoir 10y ago
> Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? Didn't they backdoor a crypto standard on the said OSes?
hvidgaard 10y ago
> Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? They don't need to, if they can put malicious code into the hardware, and bypass the software stack entirely.

secfirstmd 10y ago

True, I always try to open a training about surveillance by mentioning Western Union etc to give it historical perspective.

tomp 10y ago

Wasn't Apple's "goto fail" bug a partial backdoor into iOS? Considering how long it took for it to be discovered, is it really so improbably that there are similar, or more serious, backdoors in other software, even if open source?

huxley 10y ago
"goto fail" certainly could be used as a way of subverting iOS security but it provided indiscriminate access in a way that seems more like a vulnerability caused by a bug. Maybe some actor did add the goto fail for nefarious reasons, but it can quite easily be explained by a merge error. It's not easy to explain this particular backdoor as anything but a backdoor. From the article: "The binary responsible for the firmware OTA update operations also includes code to hide its presence from the Android OS, along with two other binaries and their processes. A developer looking at active Android processes won't be able to tell when there's an update coming to his phone."

SEJeff 10y ago

They honestly won't have to if they have a backdoor in the baseband modem, which even in the most OSS friendly phones is still controlled by a large binary blob from the manufacturer. Who's to say state agencies (NSA/GHCQ/etc) haven't found bugs in it just like they have in hard drive firmwares to persist APTs indefinitely?

sangnoir 10y ago

> Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? Didn't they backdoor a crypto standard on the said OSes?

hvidgaard 10y ago

> Is there any evidence for a government having a backdoor in Cyanogen or another Android OS fork? Or, for that matter, a backdoor into iOS? They don't need to, if they can put malicious code into the hardware, and bypass the software stack entirely.