5 ms·

The difference is that a smartphone or tablet is an always on device and are also usually personal devices. In addition they are carried round in pockets or bag

by Pick-A-Hill2019 6y ago

The difference is that a smartphone or tablet is an always on device and are also usually personal devices. In addition they are carried round in pockets or bags. Taking over a mobile device remotely and activating the camera and microphone is a real thing (citations available but https://www.wired.com/story/whatsapp-hack-phone-call-voip-buffer-overflow/ https://www.wired.com/story/whatsapp-hack-phone-call-voip-bu... from 2019 provides a solid 'is possible to do' example). I have worked in more than a few sites where all cell-phones needed to be placed in to faraday cage lockers located outside the highly secure areas prior to entering but laptops were ok to take in and use (subject to high contrast stickers over cameras, dummy jacks placed in mic sockets and wi-fi switched off). Given that these were a mixture of national infrastructure, military and embassy type sites and was a thing ten+ years ago I think the various governments are well aware of their own abilities and assume that the opposition have equal capabilities. I take your point regarding “Unless this is advice for state-level institutions discussing state secrets” but knowledge leaks and filters down in to the corporate world. Those same C-Suits that have to attend meetings discussing restricted information projects go away thinking – Huh, I wonder if it could be done to us by a competitor. When you consider the difficulties of verifying the supply chain of a random mobile device (from the chipset through to all installed apps) it leaves so many security holes that it is best to assume that anything a nation state can do so can a well skilled hacker (or group).

dahfizz 6y ago
> I think the various governments are well aware of their own abilities and assume that the opposition have equal capabilities. Exactly. From most people, "smartphones are spying on us" sounds a little tinfoil hat. Coming from the Director of Military Intelligence, however, gives the message some credence.
- XorNot 6y ago
  Which still needs to be read with nuance though: militaries and governments are worried about targeted, specific efforts directed at specific individuals, and the general difficulty of securing random electronic devices which exist outside of high-security environments sometimes (close to impossible). This is probably a reasonable threat for executives to worry about, but it's still ultimately an expression of "we're concerned about a threat where breaking into a home and bugging the device or swapping it with a compromised one is a real concern".
  - deleted 6y ago
    [deleted]
  - kube-system 6y ago
    Execs are definitely subjected to targeted attacks on a regular basis, but they don’t need to be exploits on physical devices to be effective. For a high profile example: see the Bezos hack. There’s enough money in this space that zero-days are within budget.
  - TeMPOraL 6y ago
    Considering the lengths to which people go to get an edge on the stock market (like using satellite feeds to observe parking lots, factories and tracking executives), I think the concern should be real for executives of large multinationals. On top of that, industrial espionage is a thing.
    - XorNot 6y ago
      I mean absolutely. What I'm cautioning against is reading too much into the overall security posture of mass market devices (or intelligence agency intercept capabilities) from this advice. This is closer to "if you can pay a team to go and find a way into that specific person there" then they're going to succeed. But you're already close to "infiltrate the window washing company, and stick solar powered listening bugs to every window on the upper floor suites".
      - Pick-A-Hill2019 6y ago
        Fun Fact. I've been in to places where it was an almost impossible feat to achieve without substantial background clearance checks. Chatting to the cleaners around the coffee machine during down times showed a shocking disparity between the checks run on 'obvious people' vs. the 'invisible people'. (My personal viewpoint on life is that we are all just people doing equally important jobs, i.e. Cogs in the Machine, regardless of pay rates). Pen-Testers use the 'cloned cleaners' pass' thing all the time and it works surprisingly well.
  - lenkite 6y ago
- tsimionescu 6y ago
  True, but somewhat irrelevant to most people. There are so many lower-hanging and juicier fruit than recording audio from your phone that I just don't understand why this would be a relevant case. Most people have their email, personal photos, medical records, financial records, chats etc. on their phones. If you believe your phone is likely compromised, you should first move all of those off your phone before being concerned about realtime audio recording.
  - Pick-A-Hill2019 6y ago
    I'm debating about whether or not to post this but if it makes it this far then I opted to do so. A year or so back I stayed over with some extended family, one of which was 'In to IT and earns a living from it. During that time (using the I.T guy's network) I noticed that one of my phones was eating through the battery at a crazy-stupid-mad rate. A quick check showed that this particular phone had begun uploading a metric shit-ton of data on an otherwise normally asymetric data profile (in other words Data Uploaded vs Data Downloaded Ratio). A check with the 'family IT guy' confirmed that he had Remoted In to a high value clients' system to trouble shoot something at around the same time that one of my phones began to furiously upload any and every thing on its' memory card. Sounds like one of those "Cool Story Bro" types stories right? All I will say is that because one of my 'Low Hanging Fruit' thangs got p0wned I was able to alert the $corp of the problem (since the probe originated on their end not mine). As with all things in Life, YMMV.
op03 6y ago
They wonder sure. But tells us also what happens after you give them a budget of what its going to cost the org.
jjones2 6y ago
This is very sound advice for anyone who wants to feel more secure about their surroundings and mobile devices. People underestimate the spying potentially of mobile phones very often. They are always on, have a data connection, and run software that is abysmal for security.
- tsimionescu 6y ago
  I would bet that at least an iPhone is much safer than a regular company laptop in 90% of companies. It is quite likely safer than the internal network. Security is often a second rate citizen in most companies. Also, strict security practices that affect productivity often get worked around - for example, if I want to examine a diagnostics archive I got by mail on my phone, but the IT policy won't let me, I may well forward it to my personal mail, open that though Firefox, and get the archive this way. It's much worse for overall security, but pretty hard to prevent, and less important to me when I get a call about blocked builds at 10 o'clock.
tsimionescu 6y ago
I absolutely believe that such attacks are possible - no doubt about that. But most corporate networks likely have much more likely vulnerabilities that are worth much more thought than this, in my opinion. If your phone has been taken over to the extent that an audio/video stream can be recorded without your permission, I would bet also that much more valuable information than that audio/video stream can usually be obtained as well, for most people who are not used to high security.

dahfizz 6y ago

> I think the various governments are well aware of their own abilities and assume that the opposition have equal capabilities. Exactly. From most people, "smartphones are spying on us" sounds a little tinfoil hat. Coming from the Director of Military Intelligence, however, gives the message some credence.

XorNot 6y ago
Which still needs to be read with nuance though: militaries and governments are worried about targeted, specific efforts directed at specific individuals, and the general difficulty of securing random electronic devices which exist outside of high-security environments sometimes (close to impossible). This is probably a reasonable threat for executives to worry about, but it's still ultimately an expression of "we're concerned about a threat where breaking into a home and bugging the device or swapping it with a compromised one is a real concern".
- deleted 6y ago
  [deleted]
- kube-system 6y ago
  Execs are definitely subjected to targeted attacks on a regular basis, but they don’t need to be exploits on physical devices to be effective. For a high profile example: see the Bezos hack. There’s enough money in this space that zero-days are within budget.
- TeMPOraL 6y ago
  Considering the lengths to which people go to get an edge on the stock market (like using satellite feeds to observe parking lots, factories and tracking executives), I think the concern should be real for executives of large multinationals. On top of that, industrial espionage is a thing.
  - XorNot 6y ago
    I mean absolutely. What I'm cautioning against is reading too much into the overall security posture of mass market devices (or intelligence agency intercept capabilities) from this advice. This is closer to "if you can pay a team to go and find a way into that specific person there" then they're going to succeed. But you're already close to "infiltrate the window washing company, and stick solar powered listening bugs to every window on the upper floor suites".
    - Pick-A-Hill2019 6y ago
      Fun Fact. I've been in to places where it was an almost impossible feat to achieve without substantial background clearance checks. Chatting to the cleaners around the coffee machine during down times showed a shocking disparity between the checks run on 'obvious people' vs. the 'invisible people'. (My personal viewpoint on life is that we are all just people doing equally important jobs, i.e. Cogs in the Machine, regardless of pay rates). Pen-Testers use the 'cloned cleaners' pass' thing all the time and it works surprisingly well.
- lenkite 6y ago
tsimionescu 6y ago
True, but somewhat irrelevant to most people. There are so many lower-hanging and juicier fruit than recording audio from your phone that I just don't understand why this would be a relevant case. Most people have their email, personal photos, medical records, financial records, chats etc. on their phones. If you believe your phone is likely compromised, you should first move all of those off your phone before being concerned about realtime audio recording.
- Pick-A-Hill2019 6y ago
  I'm debating about whether or not to post this but if it makes it this far then I opted to do so. A year or so back I stayed over with some extended family, one of which was 'In to IT and earns a living from it. During that time (using the I.T guy's network) I noticed that one of my phones was eating through the battery at a crazy-stupid-mad rate. A quick check showed that this particular phone had begun uploading a metric shit-ton of data on an otherwise normally asymetric data profile (in other words Data Uploaded vs Data Downloaded Ratio). A check with the 'family IT guy' confirmed that he had Remoted In to a high value clients' system to trouble shoot something at around the same time that one of my phones began to furiously upload any and every thing on its' memory card. Sounds like one of those "Cool Story Bro" types stories right? All I will say is that because one of my 'Low Hanging Fruit' thangs got p0wned I was able to alert the $corp of the problem (since the probe originated on their end not mine). As with all things in Life, YMMV.

op03 6y ago

They wonder sure. But tells us also what happens after you give them a budget of what its going to cost the org.

jjones2 6y ago

This is very sound advice for anyone who wants to feel more secure about their surroundings and mobile devices. People underestimate the spying potentially of mobile phones very often. They are always on, have a data connection, and run software that is abysmal for security.

tsimionescu 6y ago
I would bet that at least an iPhone is much safer than a regular company laptop in 90% of companies. It is quite likely safer than the internal network. Security is often a second rate citizen in most companies. Also, strict security practices that affect productivity often get worked around - for example, if I want to examine a diagnostics archive I got by mail on my phone, but the IT policy won't let me, I may well forward it to my personal mail, open that though Firefox, and get the archive this way. It's much worse for overall security, but pretty hard to prevent, and less important to me when I get a call about blocked builds at 10 o'clock.

tsimionescu 6y ago

I absolutely believe that such attacks are possible - no doubt about that. But most corporate networks likely have much more likely vulnerabilities that are worth much more thought than this, in my opinion. If your phone has been taken over to the extent that an audio/video stream can be recorded without your permission, I would bet also that much more valuable information than that audio/video stream can usually be obtained as well, for most people who are not used to high security.