8 ms·

> Also, one of the Snowden disclosures was that apparently the NSA can power on the cameras and mics of Android phones even when the phone is off. I don't know

> Also, one of the Snowden disclosures was that apparently the NSA can power on the cameras and mics of Android phones even when the phone is off. I don't know exactly how it works, but it does, probably based off the residual current drawn from the battery and the circuitry that handles the power button. Smartphones are basically never safe, although I've heard iPhones are significantly safer than Android. I mean, even if you could turn on the mic/camera, I would think you still need to possibly save it to storage for retrieval later which pretty much requires the OS to be running. Otherwise, maybe, you could somehow transmit the data but that would require the ability to communicate with the device via Bluetooth/WiFi and for the data from the camera to be passed to the wireless interface. Unless a device was designed with that sort of functionality, I'm not sure how the NSA could just turn that on.

amiga-workbench 7y ago
They would likely compromise the device via its baseband, and patch the operating system to give the illusion of a complete shutdown when the user attempts to power it off.
- Analemma_ 7y ago
  "The baseband has DMA access and so can get root at any time" is a myth that won't seem to go away no matter how many times security professionals refute it. On iPhones and all but maybe the cheapest Android phones, the baseband is exposed to the CPU as a USB device, with all the usual memory protections. You cannot patch the device over the baseband (unless there's an existing vulnerability in the USB stack or something).
  - wahern 7y ago
    USB device drivers are for sure bullet-proof, just like the baseband controllers are bullet-proof.... Jumping from one exploit target to another in a chain is pretty much how all modern exploits work. To say that because they would need to find an exploit in the USB driver (or some other hardware or software interface), not only states the obvious, but more importantly misses the point: it's far more plausible than most engineers intuitively believe. The depth of modern exploit chains is incredible, and while the conceptual difficulty has gone up the pace hasn't seemed to abate, which is clear evidence that our intuition about "too difficult" and about the elasticity of the exploit supply and demand curves is woefully inadequate to accurately gauge risk. Part of the problem is that the complexity of the systems grows at the same time as improvements in security and correctness. Sometimes it grows faster, sometimes slower, but it's dynamic.
  - ptx 7y ago
    Do you have links to any of the refutations? I recall hearing that the iPhone separates the baseband, but I thought it was otherwise usually on the same chip.
  - fulafel 7y ago
    Cursory web searches seem to point away from the USB device theory. Usually the modem is integrated on the main SoC. You can't find mentions of USB associated with the recent Qualcomm onchip modems, for example.

amiga-workbench 7y ago

They would likely compromise the device via its baseband, and patch the operating system to give the illusion of a complete shutdown when the user attempts to power it off.

Analemma_ 7y ago
"The baseband has DMA access and so can get root at any time" is a myth that won't seem to go away no matter how many times security professionals refute it. On iPhones and all but maybe the cheapest Android phones, the baseband is exposed to the CPU as a USB device, with all the usual memory protections. You cannot patch the device over the baseband (unless there's an existing vulnerability in the USB stack or something).
- wahern 7y ago
  USB device drivers are for sure bullet-proof, just like the baseband controllers are bullet-proof.... Jumping from one exploit target to another in a chain is pretty much how all modern exploits work. To say that because they would need to find an exploit in the USB driver (or some other hardware or software interface), not only states the obvious, but more importantly misses the point: it's far more plausible than most engineers intuitively believe. The depth of modern exploit chains is incredible, and while the conceptual difficulty has gone up the pace hasn't seemed to abate, which is clear evidence that our intuition about "too difficult" and about the elasticity of the exploit supply and demand curves is woefully inadequate to accurately gauge risk. Part of the problem is that the complexity of the systems grows at the same time as improvements in security and correctness. Sometimes it grows faster, sometimes slower, but it's dynamic.
- ptx 7y ago
  Do you have links to any of the refutations? I recall hearing that the iPhone separates the baseband, but I thought it was otherwise usually on the same chip.
- fulafel 7y ago
  Cursory web searches seem to point away from the USB device theory. Usually the modem is integrated on the main SoC. You can't find mentions of USB associated with the recent Qualcomm onchip modems, for example.