6 ms·

I just helped someone remove the built-in Chinese malware from a US Government provided phone. It's insane. https://blog.malwarebytes.com/android/2020/07/we-f

I just helped someone remove the built-in Chinese malware from a US Government provided phone. It's insane. https://blog.malwarebytes.com/android/2020/07/we-found-yet-another-phone-with-pre-installed-malware-via-the-lifeline-assistance-program/ https://blog.malwarebytes.com/android/2020/07/we-found-yet-a...

deleted 5y ago
[deleted]
reginold 5y ago
Wow thanks for all that you do and blogging about this. HN discussion here: https://news.ycombinator.com/item?id=28499918 https://news.ycombinator.com/item?id=28499918
titzer 5y ago
This is what kinda terrifies me about today's digital landscape. Now it's so cheap to hide surveillance capabilities (spyware, hidden microphones or cameras) that bad actors can just embed surveillance into every cheap device, hoping just by sheer numbers to get one into a sensitive area (e.g. Pentagon, Langley), and then remotely activate surveillance. With the computational capabilities of today's data centers, they don't even have to be all that selective anymore. They could just be monitoring everyone, at some granularity, dumping logs into a massive database with just enough metadata to make it searchable/queryable. It's downright dystopian.
- EMM_386 5y ago
  > It's downright dystopian. It sure is. No stopping it now though. I'm old enough to remember being able to go to someone's place and expect privacy. These days literally anything can have an HD cam. Not great for paranoia but what can you do? > They could just be monitoring everyone, They are. Snowden already proved this, and we apparently got into that particular situation to keep pace with China. Not my job.
  - reginold 5y ago
    You are more powerful than you may realize. Work on supporting open source hardware and software options. 1. If you are a developer, consider buying a Pinephone [1] and contributing to the codebase. 2. If not a developer, you can submit bug reports and test fixes. Same for Purism Librem phone as well [2]. 3. If you are neither, or have no time to spare but do have money, you can always purchase one for kicks or donate to open source like Ubuntu. 4. Finally if you have no time or money, simply upvoting privacy related threads on HN and talking with your friends about it helps too. [1] https://pine64.com/product/pinephone-beta-edition-with-convergence-package/ https://pine64.com/product/pinephone-beta-edition-with-conve... [2] https://puri.sm/products/librem-5/ https://puri.sm/products/librem-5/ edit: added numbering
    - abakker 5y ago
      I hate to say this, but OSS anarchism is not going to work. Most people cannot really work or live with those devices. This is a problem that needs to be solved with legislation, lobbying, superPACs, and candidates who are not ethically flexible. The solution to bad government is not "no government" and the solution to bad company behavior is better rules.
      - reginold 5y ago
        Open to other ways of taking action. What are you doing to support the solutions you describe?
      - ignoramous 5y ago
        > I hate to say this, but OSS anarchism is not going to work. Most people cannot really work or live with those devices. Baby steps. Such changes start small. > This is a problem that needs to be solved with legislation, lobbying, superPACs, and candidates who are not ethically flexible. Yes, but regulations do also ring-in different challenges and over the long-term, the status-quo ends up being enshrined in them, thwarting the otherwise thriving diversity of the ecosystem. Though, it is inevitable Internet / Web gets regulated ala Finance / Telecommunications industries.
- systemvoltage 5y ago
  It’s underrated but DJI drones sold by millions is a great way to spy on what could not be gathered through satellite imagery. If not now then during war time, CCP has a million remote cameras in form of DJI drones and can turn it on in a snap. It would require nationwide firewall to stop. Of course, DJI drones require DJI flight app to even take off. Why isn’t US Gov putting together legislation for this sort of a thing is beyond me.
  - x86_64Ubuntu 5y ago
    In your scenario, is China leveraging it's own DJI drones? Or DJI drones already owned by hobbyists?
    - systemvoltage 5y ago
      Taking over drones owned by hobbyists. There seems to be a onslaught of positive DJI YouTube videos about how creating a user account is great and easy. Including fake comments praising DJI. Just search on YT DJI Mavic Pro setup. All this is too suspicious for me. I returned the drone for obvious reasons but millions of people are already buying into the ecosystem.
      - EMM_386 5y ago
        > All this is too suspicious for me. I returned the drone for obvious reasons but millions of people are already buying into the ecosystem. We're way past the point of no return with all of this. At some point you just have to accept the new normal. Some of this should be handled by national security teams but I am unsure where we stand (US). I'm surprised Lithuania of all places takes a firm stand on Chinese phones, meanwhile the US seems to be spinning its wheels. I am not sure what is going on behind closed doors.
        systemvoltage 5y ago
        I’m not sure if I agree with defeatist attitude. I’d do whatever I can. But, I do agree that this needs to be taken care of at the legislation / national security level and citizens shouldn’t have to.
umvi 5y ago
Is that even enough though? Couldn't china put in shadow processors or other hardware-level surveillance similar to Intel's management engine? And it would be extremely difficult to detect, let alone disable or mitigate.
- Aerroon 5y ago
  >Couldn't china put in shadow processors or other hardware-level surveillance similar to Intel's management engine? Do we know for certain that IME is not already doing this kind of spying though?
Dah00n 5y ago
Android 7? Then you don't need malware. It will be provided on first boot by multiple parties.

deleted 5y ago

[deleted]

reginold 5y ago

Wow thanks for all that you do and blogging about this. HN discussion here: https://news.ycombinator.com/item?id=28499918 https://news.ycombinator.com/item?id=28499918

titzer 5y ago

This is what kinda terrifies me about today's digital landscape. Now it's so cheap to hide surveillance capabilities (spyware, hidden microphones or cameras) that bad actors can just embed surveillance into every cheap device, hoping just by sheer numbers to get one into a sensitive area (e.g. Pentagon, Langley), and then remotely activate surveillance. With the computational capabilities of today's data centers, they don't even have to be all that selective anymore. They could just be monitoring everyone, at some granularity, dumping logs into a massive database with just enough metadata to make it searchable/queryable. It's downright dystopian.

EMM_386 5y ago
> It's downright dystopian. It sure is. No stopping it now though. I'm old enough to remember being able to go to someone's place and expect privacy. These days literally anything can have an HD cam. Not great for paranoia but what can you do? > They could just be monitoring everyone, They are. Snowden already proved this, and we apparently got into that particular situation to keep pace with China. Not my job.
- reginold 5y ago
  You are more powerful than you may realize. Work on supporting open source hardware and software options. 1. If you are a developer, consider buying a Pinephone [1] and contributing to the codebase. 2. If not a developer, you can submit bug reports and test fixes. Same for Purism Librem phone as well [2]. 3. If you are neither, or have no time to spare but do have money, you can always purchase one for kicks or donate to open source like Ubuntu. 4. Finally if you have no time or money, simply upvoting privacy related threads on HN and talking with your friends about it helps too. [1] https://pine64.com/product/pinephone-beta-edition-with-convergence-package/ https://pine64.com/product/pinephone-beta-edition-with-conve... [2] https://puri.sm/products/librem-5/ https://puri.sm/products/librem-5/ edit: added numbering
  - abakker 5y ago
    I hate to say this, but OSS anarchism is not going to work. Most people cannot really work or live with those devices. This is a problem that needs to be solved with legislation, lobbying, superPACs, and candidates who are not ethically flexible. The solution to bad government is not "no government" and the solution to bad company behavior is better rules.
    - reginold 5y ago
      Open to other ways of taking action. What are you doing to support the solutions you describe?
    - ignoramous 5y ago
      > I hate to say this, but OSS anarchism is not going to work. Most people cannot really work or live with those devices. Baby steps. Such changes start small. > This is a problem that needs to be solved with legislation, lobbying, superPACs, and candidates who are not ethically flexible. Yes, but regulations do also ring-in different challenges and over the long-term, the status-quo ends up being enshrined in them, thwarting the otherwise thriving diversity of the ecosystem. Though, it is inevitable Internet / Web gets regulated ala Finance / Telecommunications industries.
systemvoltage 5y ago
It’s underrated but DJI drones sold by millions is a great way to spy on what could not be gathered through satellite imagery. If not now then during war time, CCP has a million remote cameras in form of DJI drones and can turn it on in a snap. It would require nationwide firewall to stop. Of course, DJI drones require DJI flight app to even take off. Why isn’t US Gov putting together legislation for this sort of a thing is beyond me.
- x86_64Ubuntu 5y ago
  In your scenario, is China leveraging it's own DJI drones? Or DJI drones already owned by hobbyists?
  - systemvoltage 5y ago
    Taking over drones owned by hobbyists. There seems to be a onslaught of positive DJI YouTube videos about how creating a user account is great and easy. Including fake comments praising DJI. Just search on YT DJI Mavic Pro setup. All this is too suspicious for me. I returned the drone for obvious reasons but millions of people are already buying into the ecosystem.
    - EMM_386 5y ago
      > All this is too suspicious for me. I returned the drone for obvious reasons but millions of people are already buying into the ecosystem. We're way past the point of no return with all of this. At some point you just have to accept the new normal. Some of this should be handled by national security teams but I am unsure where we stand (US). I'm surprised Lithuania of all places takes a firm stand on Chinese phones, meanwhile the US seems to be spinning its wheels. I am not sure what is going on behind closed doors.
      - systemvoltage 5y ago
        I’m not sure if I agree with defeatist attitude. I’d do whatever I can. But, I do agree that this needs to be taken care of at the legislation / national security level and citizens shouldn’t have to.

umvi 5y ago

Is that even enough though? Couldn't china put in shadow processors or other hardware-level surveillance similar to Intel's management engine? And it would be extremely difficult to detect, let alone disable or mitigate.

Aerroon 5y ago
>Couldn't china put in shadow processors or other hardware-level surveillance similar to Intel's management engine? Do we know for certain that IME is not already doing this kind of spying though?

Dah00n 5y ago

Android 7? Then you don't need malware. It will be provided on first boot by multiple parties.