14 ms·
Black market Blackphones get sent a kill message that bricks them
- criddell 10y agoThe implication in the story is that the contract manufacturer made extras and sold them on the black market. How common is that? Does anybody know who made the phones?
- rbcgerard 10y agoI don't know how common it is when it comes to electronics, but it's quite common for many counterfeit goods, especially clothing/fashion
- tqkxzugoaupvwqr 10y agoIt is a common strategy of manufacturers in China. You, as the designer, get ripped of by the very people that you pay to produce your product. The quality can match the original because they use the same factory, same tools, same processes that are used to produce the original product. The manufacturers simply work another shift, e.g. night shift, or do a few more runs. In some cases, manufacturers clone the whole factory that is used to produce the original product so they can increase output of counterfeit goods.
- jessaustin 10y agoHow could one prevent this? Would it be possible to only program a microcontroller after taking delivery, without which the circuit wouldn't be useful? Or could different components be sourced from different manufacturers, and then assembled in yet another factory? How much collusion between manufacturers should we expect?
- pavel_lishin 10y agoYou could push an OS update that bricks illegitimate phones :)
- kabdib 10y agoThis is why devices like game consoles and at least a few models of cell phones have a "geneology" database maintained by the official manufacturer, with originating key material in the hardware, and additional activating key material provided to the device at certain well-controlled manufacturing stations. You simply can't make a working device without going through that process. [Just bricking Blackphones is a terrible move; letting the users know their phones were counterfeit and leaving them on would have been a far better move, IMHO]
- criddell 10y agoSo if this is a known problem with known solutions, then the fact that Blackphone didn't do any of this makes them look like amateurs. Maybe one shouldn't rely on them for security...
- drewg123 10y agoI'm pretty sure that an android wear watch I bought on Ebay was grey market. I bought it for ~65% of the suggested retail price. When it died ~9 months later, its SN was not recognized by Motorola, so there was no warranty.
- Tepix 10y agoThese phones are on sale for less than 100 euros, a very good price given the hardware specs. The genuine phones sell for 662€ with a one-year subscription.
- tokenizerrr 10y agoSo does this achieve anything other than fuck the people over who (probably unknowingly) wound up buying such a Blackphone? I can just imagine waking up, looking at my phone which has been working perfectly well up until that point, and being told it now has been bricked for some licensing issue. This seems really scummy and would drive me away from their products forever.
- Tepix 10y agoI suppose it stops people from buying these dirt cheap phones and consider buying the original (if they want the SilentOS benefits).
- brainfire 10y agoWhy would they care about driving away the one set of people who have already demonstrated they aren't interested in buying the phone from them?
- tokenizerrr 10y agoMost of these people probably just bought the phone from a store somewhere thinking it was legit.
- brainfire 10y agoSo you expect them in the future to seek out the higher priced legitimate product?
- tokenizerrr 10y agoI expect they will avoid the brand that turned their hardware into a brick.
- brainfire 10y agoI'm saying it doesn't matter if they avoid a brand if the alternative is that they will buy a knock-off. Neither option represents any value to the actual manufacturer- avoiding negative PR from people with knock-offs might actually be preferable.
- timthelion 10y agoSeems a bit funny, that a device that is meant for privacy allows remote control by its masters.
- ahoka 10y agoIt's funnier to buy a security focused phone from a random ebay seller.
- eganist 10y agoIn conclusion: the firm has no control over its supply chain and embeds remote control into its devices. Sounds like two critical flaws to me.
- bsder 10y agoI have no issue with them disabling SilentOS if you can install something else. That's very different from "bricking" the phone. > In conclusion: the firm has no control over its supply chain and embeds remote control into its devices. Dirty secret: Nobody has control of their supply chain anymore. There have been Samsung and Apple phones being sold on the black market before the real ones. If you assemble in China, you can be cloned tomorrow.
- sqldba 10y agoWhat are they meant to do? They build a secure phone. It gets ripped off by the manufacturer and resold by anonymous eBay people who can install whatever backdoors on the phone. Then the people using them are being snooped on - exactly what they don't want in the first place. Bricking the phones is the right thing to do.
- pavel_lishin 10y agoYou can notify the user that their phone is not a legitimate product and is likely insecure without completely crippling it in the process.
- quickConclusion 10y agoIf this is not their phone, made by them, how can they brick them? How is that legal?
- jacobush 10y agoPlaying the devils advocate here, the phones were accessing their servers without permission. They made the phones stop.
- Tepix 10y agoIf they install SilentOS on their unlicensed devices, SilentOS can refuse to run. The question is: Is there an alternative OS that can be used with these devices? If not then they are unusable without the OS. Is that the same as bricked?
- bunderbunder 10y agoIn all but the most pedantic of senses, yes, it is bricked. Even if there were an alternative OS, I'd say it's still pretty well bricked, since installing alternative OSes is outside the skill level and/or comfort zone of most consumers.
- maxerickson 10y agoBricked used to mean impossible to get working, not hard. I mean, I recall discussions of whether something was really bricked if you could rescue it by hooking up to a JTAG header.
- squarefoot 10y agoSlightly off topic but related to the product: how can a device using Android be considered safe and trustworthy privacy wise? The maker can surely choose FOSS only Android and encrypt communications, but the moment they add a binary only device driver it can do whatever it wants since it runs with kernel privileges (ie, sniff virtual keyboard, listen to conversations, access messages, contacts, photos, documents etc). If I'm not mistaken (please correct me in case I am) there's still no phone out there with open device drivers, which IMO translates into giving only a false sense of security to the user. Moreover, if I buy a security oriented device and it has a remote kill switch, I would expect at least to be the one and only entity in control of it.
- Tepix 10y agoYou're right in that a binary blob may just contain a backdoor and analyzing it is very hard. There is Replicant ( http://www.replicant.us/ http://www.replicant.us/ ), a version of Android that aims to get rid of all binary blobs. There is also CopperheadOS ( https://copperhead.co/android/ https://copperhead.co/android/ ). Related reading: https://blog.torproject.org/blog/mission-improbable-hardening-android-security-and-privacy https://blog.torproject.org/blog/mission-improbable-hardenin...
- timonovici 10y agoReplicant got rid of all the binary blobs (for the main OS, that is), is not just aiming. The effects are of course that you can't use wifi, unless you're using a USB dongle. Not only that, but Replicant is only ported to devices where the GSM chip can be securely turned off (in other words, it's a separate chip, under the control of the main proccesor); Also, the GSM and GPS chips should be separate. The baseband OS if ofcourse still proprietary, but it can be considered an acceptable tradeof, given that it's only connected to the main processor via a USB-like connection (HSIC). Shameless plug: we sell preinstalled Replicant phones at https://tehnoetic.com/ https://tehnoetic.com/
- raesene9 10y agoHaving a FOSS phone would only be considered trustworthy if it had been reviewed by an entity you trust. I'm not aware of any mainstream OS that has been fully reviewed for security, so realistically the concept of a "trustworthy" device in that sense doesn't exist. Even if such an audit was done perfectly (a very serious and difficult undertaking), it would be a point in time assessment, so would become less relevant as new code was committed. Basically you have to trust some group of people to run a modern computing device/environment, it's just a question of who and how much...
- uber1geek 10y agoSomeone will make a patch for this, just wait.
- tehwebguy 10y agoHow can someone trust a "real" Blackphone if they source production out to a factory that they have no control over?
- ddito 10y agoDo all sellers of security devices manufacture them in house? Now that you mentioned this it really does sound like a serious problem for providing any kind of guarantee..
- Analemma_ 10y agoMost of them do, yes. IronKey and Yubico both actually extensively document their manufacturing process, which is in-house.
- wildchild 10y agoBlackPhone is scam and snake-oil. Cloud "privacy" with remote control. Need privacy? Use burners.
- raesene9 10y agoI don't think it's fair to call Blackphone "Scam and snake-oil" just because it uses cloud features and has remote control. What's fair to say is that you're implicitly trusting Silent Circle to be both competent and benign. But then running pretty much any modern computing device requires you to trust various groups of people in that regard, so this isn't that different really.
- throwaway91111 10y agoTrusting third parties is, in general, not a great approach to privacy.
- sjwright 10y agoTrust is the only way security works in practice. Have you personally audited all the software and silicon in your secure device?
- throwaway91111 10y agoThat's an entirely different type of trust than trusting someone who says "I swear that I won't look at your data".
- sjwright 10y agoIt's a bit easier for a cloud provider to look at your data surreptitiously, but you apply that very same "I swear that I won't look at your data" trust upon every software and hardware vendor from your USB keyboard to your internet router.
- 10y ago
- macspoofing 10y agoI stopped buying high-priced electronics on eBay or through Amazon resellers. Number of counterfeit products is staggering and superficial quality is high (exterior is usually close to perfect)
- digler999 10y agoseems like this is a perfect case to use ebays/paypal's refund policy that (apparently) always favors the buyer. The policy that people were using to steal from sellers by pocketing the product and mailing back junk.
- tptacek 10y agoI'm honestly surprised that enough people buy Silent Circle phones that these countermeasures would be worth it to anyone.
- prdonahue 10y agoEspecially with their public claims of openness/open source vs. actual steps taken to provide source: https://www.quora.com/Will-Silent-Circle-silence-critics-who-demand-they-uphold-their-promise-to-release-their-source-code-If-not-can-they-be-trusted https://www.quora.com/Will-Silent-Circle-silence-critics-who....
- joecool1029 10y agoThese don't sound like counterfeits. This sounds like Blackphone doesn't have control of its supply chain. Oh well, more reason to never consider purchase of one of their devices. Shame because they actually are doing some decent software development.
- phire 10y agoIt sounds like they have a problem with ghost shifts. The factory they contracted to assemble their phones is running extra shifts off the books and selling the extra phones for extra cash on the side. This happens all the time in China.
- ComodoHacker 10y agoCan't IMEI also be cloned though?
- DanBC 10y agoIn England tampering with IMEI is serious business, and carries a potential 6 month prison sentence. http://www.legislation.gov.uk/ukpga/2002/31/section/1 http://www.legislation.gov.uk/ukpga/2002/31/section/1 I'm a bit surprised that isn't the case in the US.
- mschuster91 10y agoGood grace, this is an overreaching bill. This also affects Bluetooth and WiFi MAC addresses, even of laptop computers (!), if going by the letter of the law. Trivially changed by userspace tools, and IIRC Apple randomizes the MAC addresses to prevent people tracking other people's devices. Edit: It gets even worse, in theory anyone distributing software capable of changing MACs or writing tutorials on how to do this commits an offence. Just look at http://www.legislation.gov.uk/ukpga/2002/31/section/2 http://www.legislation.gov.uk/ukpga/2002/31/section/2, it's madness.
- DanBC 10y agoIt's poorly drafted, but it's only ever used for people who change IMEI. I think it's only used if they change the IMEI on stolen phones. But yes, it's yet another bad English law passed as a kneejerk response to something or other.
- rongway 10y agoebay isn't a black market...
- mastazi 10y agoSo there is this company that markets an "enhanced privacy" device and the marketing material shows a home screen with Chrome, Play Store and Google App. Thank you for the laughs!
- Markoff 10y agoplus they can remotely disable your device without your approval, very safe...
- Markoff 10y agoTLDR privacy oriented phone can be disabled remotely by someone else than you or in other words how to ruin your reputation in 5 minutes