4 ms·

> I think the various governments are well aware of their own abilities and assume that the opposition have equal capabilities. Exactly. From most people, "sma

> I think the various governments are well aware of their own abilities and assume that the opposition have equal capabilities. Exactly. From most people, "smartphones are spying on us" sounds a little tinfoil hat. Coming from the Director of Military Intelligence, however, gives the message some credence.

XorNot 6y ago
Which still needs to be read with nuance though: militaries and governments are worried about targeted, specific efforts directed at specific individuals, and the general difficulty of securing random electronic devices which exist outside of high-security environments sometimes (close to impossible). This is probably a reasonable threat for executives to worry about, but it's still ultimately an expression of "we're concerned about a threat where breaking into a home and bugging the device or swapping it with a compromised one is a real concern".
- deleted 6y ago
  [deleted]
- kube-system 6y ago
  Execs are definitely subjected to targeted attacks on a regular basis, but they don’t need to be exploits on physical devices to be effective. For a high profile example: see the Bezos hack. There’s enough money in this space that zero-days are within budget.
- TeMPOraL 6y ago
  Considering the lengths to which people go to get an edge on the stock market (like using satellite feeds to observe parking lots, factories and tracking executives), I think the concern should be real for executives of large multinationals. On top of that, industrial espionage is a thing.
  - XorNot 6y ago
    I mean absolutely. What I'm cautioning against is reading too much into the overall security posture of mass market devices (or intelligence agency intercept capabilities) from this advice. This is closer to "if you can pay a team to go and find a way into that specific person there" then they're going to succeed. But you're already close to "infiltrate the window washing company, and stick solar powered listening bugs to every window on the upper floor suites".
    - Pick-A-Hill2019 6y ago
      Fun Fact. I've been in to places where it was an almost impossible feat to achieve without substantial background clearance checks. Chatting to the cleaners around the coffee machine during down times showed a shocking disparity between the checks run on 'obvious people' vs. the 'invisible people'. (My personal viewpoint on life is that we are all just people doing equally important jobs, i.e. Cogs in the Machine, regardless of pay rates). Pen-Testers use the 'cloned cleaners' pass' thing all the time and it works surprisingly well.
- lenkite 6y ago
  We were told by our IT department that its now SOP by both nation states and hacker groups to target all executives of MNCs. Even those in "visible" technical roles are targeted as a standard matter of procedure.
tsimionescu 6y ago
True, but somewhat irrelevant to most people. There are so many lower-hanging and juicier fruit than recording audio from your phone that I just don't understand why this would be a relevant case. Most people have their email, personal photos, medical records, financial records, chats etc. on their phones. If you believe your phone is likely compromised, you should first move all of those off your phone before being concerned about realtime audio recording.
- Pick-A-Hill2019 6y ago
  I'm debating about whether or not to post this but if it makes it this far then I opted to do so. A year or so back I stayed over with some extended family, one of which was 'In to IT and earns a living from it. During that time (using the I.T guy's network) I noticed that one of my phones was eating through the battery at a crazy-stupid-mad rate. A quick check showed that this particular phone had begun uploading a metric shit-ton of data on an otherwise normally asymetric data profile (in other words Data Uploaded vs Data Downloaded Ratio). A check with the 'family IT guy' confirmed that he had Remoted In to a high value clients' system to trouble shoot something at around the same time that one of my phones began to furiously upload any and every thing on its' memory card. Sounds like one of those "Cool Story Bro" types stories right? All I will say is that because one of my 'Low Hanging Fruit' thangs got p0wned I was able to alert the $corp of the problem (since the probe originated on their end not mine). As with all things in Life, YMMV.

XorNot 6y ago

Which still needs to be read with nuance though: militaries and governments are worried about targeted, specific efforts directed at specific individuals, and the general difficulty of securing random electronic devices which exist outside of high-security environments sometimes (close to impossible). This is probably a reasonable threat for executives to worry about, but it's still ultimately an expression of "we're concerned about a threat where breaking into a home and bugging the device or swapping it with a compromised one is a real concern".

deleted 6y ago
[deleted]
kube-system 6y ago
Execs are definitely subjected to targeted attacks on a regular basis, but they don’t need to be exploits on physical devices to be effective. For a high profile example: see the Bezos hack. There’s enough money in this space that zero-days are within budget.
TeMPOraL 6y ago
Considering the lengths to which people go to get an edge on the stock market (like using satellite feeds to observe parking lots, factories and tracking executives), I think the concern should be real for executives of large multinationals. On top of that, industrial espionage is a thing.
- XorNot 6y ago
  I mean absolutely. What I'm cautioning against is reading too much into the overall security posture of mass market devices (or intelligence agency intercept capabilities) from this advice. This is closer to "if you can pay a team to go and find a way into that specific person there" then they're going to succeed. But you're already close to "infiltrate the window washing company, and stick solar powered listening bugs to every window on the upper floor suites".
  - Pick-A-Hill2019 6y ago
    Fun Fact. I've been in to places where it was an almost impossible feat to achieve without substantial background clearance checks. Chatting to the cleaners around the coffee machine during down times showed a shocking disparity between the checks run on 'obvious people' vs. the 'invisible people'. (My personal viewpoint on life is that we are all just people doing equally important jobs, i.e. Cogs in the Machine, regardless of pay rates). Pen-Testers use the 'cloned cleaners' pass' thing all the time and it works surprisingly well.
lenkite 6y ago
We were told by our IT department that its now SOP by both nation states and hacker groups to target all executives of MNCs. Even those in "visible" technical roles are targeted as a standard matter of procedure.

tsimionescu 6y ago

True, but somewhat irrelevant to most people. There are so many lower-hanging and juicier fruit than recording audio from your phone that I just don't understand why this would be a relevant case. Most people have their email, personal photos, medical records, financial records, chats etc. on their phones. If you believe your phone is likely compromised, you should first move all of those off your phone before being concerned about realtime audio recording.

Pick-A-Hill2019 6y ago
I'm debating about whether or not to post this but if it makes it this far then I opted to do so. A year or so back I stayed over with some extended family, one of which was 'In to IT and earns a living from it. During that time (using the I.T guy's network) I noticed that one of my phones was eating through the battery at a crazy-stupid-mad rate. A quick check showed that this particular phone had begun uploading a metric shit-ton of data on an otherwise normally asymetric data profile (in other words Data Uploaded vs Data Downloaded Ratio). A check with the 'family IT guy' confirmed that he had Remoted In to a high value clients' system to trouble shoot something at around the same time that one of my phones began to furiously upload any and every thing on its' memory card. Sounds like one of those "Cool Story Bro" types stories right? All I will say is that because one of my 'Low Hanging Fruit' thangs got p0wned I was able to alert the $corp of the problem (since the probe originated on their end not mine). As with all things in Life, YMMV.