3 ms·

> Can't companies already be compelled to push updates to select devices Nope. Can you link to an example?

pengaru 6y ago
Lavabit shut its doors to not comply with such requests.
LinuxBender 6y ago
I do not have a current link because the software was acquired bty AT&T and intentionally does not have a public name any more, but all phones used to have CarrierIQ. In debug mode, it could intercept any facet of code execution, network communication (pre-tls), log all finger movements, log phone movement and velocity. To put into debug mode, the phone just needs to receive a http header when it checks in for updates. It will log all the data, upload it and disable debug on a follow up header. The software can be installed over the air with no user interaction or notification. This was supposed to move to the firmware module to avoid users rooting the phone and removing it, but I honestly have no idea if or how that progressed.
dane-pgp 6y ago
That may be the case in Australia at least. From [0]: "if an agency were undertaking an investigation into an act of terrorism and a provider was capable of removing encryption from the device of a terrorism suspect without weakening other devices in the market then the provider could be compelled under a technical assistance notice to provide help to the agency by removing the electronic protection" As for the US, I wouldn't be surprised if the government has sought to achieve something like this using the All Writs Act[1]. However, in the recent case of Facebook helping the FBI with a targeted use of a vulnerability[2], it seems that they cooperated voluntarily, even paying a third party contractor to help. [0] https://www.computerworld.com/article/3460071/encryption-has-the-government-stuck-to-its-no-backdoors-pledge.html https://www.computerworld.com/article/3460071/encryption-has... [1] https://en.wikipedia.org/wiki/All_Writs_Act#Application_to_electronic_devices https://en.wikipedia.org/wiki/All_Writs_Act#Application_to_e... [2] https://gizmodo.com/report-facebook-helped-the-fbi-exploit-vulnerability-i-1843988377 https://gizmodo.com/report-facebook-helped-the-fbi-exploit-v...

Lavabit shut its doors to not comply with such requests.

I do not have a current link because the software was acquired bty AT&T and intentionally does not have a public name any more, but all phones used to have CarrierIQ. In debug mode, it could intercept any facet of code execution, network communication (pre-tls), log all finger movements, log phone movement and velocity. To put into debug mode, the phone just needs to receive a http header when it checks in for updates. It will log all the data, upload it and disable debug on a follow up header. The software can be installed over the air with no user interaction or notification. This was supposed to move to the firmware module to avoid users rooting the phone and removing it, but I honestly have no idea if or how that progressed.

dane-pgp 6y ago

That may be the case in Australia at least. From [0]: "if an agency were undertaking an investigation into an act of terrorism and a provider was capable of removing encryption from the device of a terrorism suspect without weakening other devices in the market then the provider could be compelled under a technical assistance notice to provide help to the agency by removing the electronic protection" As for the US, I wouldn't be surprised if the government has sought to achieve something like this using the All Writs Act[1]. However, in the recent case of Facebook helping the FBI with a targeted use of a vulnerability[2], it seems that they cooperated voluntarily, even paying a third party contractor to help. [0] https://www.computerworld.com/article/3460071/encryption-has-the-government-stuck-to-its-no-backdoors-pledge.html https://www.computerworld.com/article/3460071/encryption-has... [1] https://en.wikipedia.org/wiki/All_Writs_Act#Application_to_electronic_devices https://en.wikipedia.org/wiki/All_Writs_Act#Application_to_e... [2] https://gizmodo.com/report-facebook-helped-the-fbi-exploit-vulnerability-i-1843988377 https://gizmodo.com/report-facebook-helped-the-fbi-exploit-v...