5 ms·

Ask HN: How would French police locate suspects by tapping their devices?

103 points by ThalesX 3y ago

I just found a news article regarding a law that passed in France allowing police to remotely activate GPS, camera, microphone on a user's device [0]. This was posted before on HN [1], but without traction, but I am not all that much interested in the civil aspects of it, I am more interested in the technical aspects of it. I'm curious if there is someone with know how about how such a thing would be achieved. Would they base it on exploits? Would they have to require manufacturers to add police APIs on the devices? Would a remotely activated camera / microphone / location get the active camera / microphone / location indicator? 55 minute edit: It seems like for simple stuff, like coarse location they can get it through the carrier; I assumed as much and it's relatively easy to get it done. For other stuff, rootkits and exploits are developed by some intelligence agencies which require manufacturing consent or physical interception. Then there's also groups that sell OS levels exploits such as the NSO group. I'm guessing in the case of software exploits, the indicators would appear for camera / mic / gps. But maybe for hardware exploits they could bypass the circuitry? Seems like a lot of work for non-high-profile targets. Later edit: Keyword "baseband" seems to be the most likely attack vector [0] https://apnews.com/article/france-surveillance-digital-devices-suspects-6018bdb2aee36ef373209555f5ec0019 https://apnews.com/article/france-surveillance-digital-devic... [1] https://news.ycombinator.com/item?id=36779568 https://news.ycombinator.com/item?id=36779568

khnov 3y ago
Oh waw, I'm really interested to know how's that even possible.
FrenchDevRemote 3y ago
They've been doing it for years. It's rootkits/RATs, just malware developed by intelligence services and/or some technical branches of police, although they sometime hire external contractors for this. They use exploits or physical access. AFAIK there is no manufacturer giving backdoors to the french government(but the US and China definitely have some, I wouldn't be surprised if the US shared some access for major cases)
sysadm1n 3y ago
For smartphones, assume an always-on wiretap situation. But for laptops, it may be harder depending on how hardened your setup is, and how tight your opsec is. There is the possibility that if you're a high value target and you bought your laptop online that it could be bugged, but you would have to be someone like a drug trafficker or a journalist or some other high profile person.
- musha68k 3y ago
  I remember when someone at CCC (I think) coined the synonymous “Ortungswanze” <> smartphone - and it got way worse since that. https://translate.google.com/?sl=auto&tl=en&text=ortungswanze&op=translate https://translate.google.com/?sl=auto&tl=en&text=ortungswanz...
runjake 3y ago
Software implants (“RATs” or “rootkits”) or baseband access (“backdoors”). The baseband is an embedded computer inside the phone that controls the device’s sensors and radios. It runs off of its own OS and is separate from the consumer-facing OS. The phone’s OS then talks to this embedded system. All phones do this, even the iPhone whose baseband OS was some variant of L4 Linux, IIRC. Various Intelligence Community people and documents have made statements that they can remotely activate the baseband to interact with a target device.
- FFP999 3y ago
  To expand on this, you should assume that basically any significant device or microprocessor you buy comes pre-compromised by one or more intelligence agencies, by the simple expedient of them asking manufacturers to put them in. Devices from US companies will be compromised by Five Eyes agencies, those from Chinese firms will have Ministry of State Security backdoors, etc.
  - musha68k 3y ago
    Open source / homebrew hardware will be the only way out of this.
    - FFP999 3y ago
      On a technical level, sure. In the bigger picture, I'm concerned that that is simply too esoteric an interest for it to have any significant impact.
      - fsflover 3y ago
        Almost any innovation starts like this.
        FFP999 3y ago
        I certainly would _like_ to believe that...I'm gonna have to think about this some.
dharmab 3y ago
Some capabilities are available through the carrier. For example, a cell carrier has access to subscribers' coarse location information, since they can tell which cell tower(s) the subscriber is connected to, and the physics involved provides coarse direction and distance. Other capabilities require access to the device, either through an exploit or spyware.
viktorcode 3y ago
They will have to install an exploit on the target device. The law merely allows that practice.
realusername 3y ago
It's most likely some contracts with NSO group or some other Israeli firm. Only for high value targets of course, otherwise they'll just go with a simpler and cheaper route.
- dieze 3y ago
  France recently had its own Pegasus scandal, a french firm sold a software called "Predator" to dubious countries (see https://www.amnesty.org/en/documents/act10/7245/2023/en/ https://www.amnesty.org/en/documents/act10/7245/2023/en/)
  - ruthie_cohen 3y ago
    There’s a recent Darknet Diaries episode about Predator for anyone interested: https://podcasts.apple.com/au/podcast/darknet-diaries/id1296350485?i=1000626646500 https://podcasts.apple.com/au/podcast/darknet-diaries/id1296...
- dylan604 3y ago
  There is always a $5 wrench solution to pretty much any problem. You either have to be willing to use it, or just creative enough to find it.
  - realusername 3y ago
    Yeah definitely, those expensive and rare exploits won't be used for the drug dealer around the street, that's for sure.
PM_me_your_math 3y ago
[dead]
rolph 3y ago
obscurity seems to be a major part of securing baseband. https://www.extremetech.com/computing/170874-the-secret-second-operating-system-that-could-make-every-mobile-phone-insecure https://www.extremetech.com/computing/170874-the-secret-seco... https://www.androidauthority.com/smartphones-have-a-second-os-317800/ https://www.androidauthority.com/smartphones-have-a-second-o... events.ccc.de/congress/2011/Fahrplan/attachments/2022_11-ccc-qcombbdbg.pdf[PDF]
JPLeRouzic 3y ago
USim toolkit. https://en.wikipedia.org/wiki/SIM_Application_Toolkit https://en.wikipedia.org/wiki/SIM_Application_Toolkit It's under the control of the mobile operator which knows the secrets keys to send commands to the phone OTA.
- ThalesX 3y ago
  Interesting! I'm assuming this should have limited access to what requests it sends to the phone. I'm also assuming this limited access would be implemented by the manufacturer. So my question, based on those assumptions, is: this application toolkit, as well as OS level calls would require an exploit by the intelligence agency to be able to give commands such as start the camera and stream it? I guess the barrier between the OS and the SIM holding hardware would have to be broken so that the camera could be made to stream to some random endpoint.
  - JPLeRouzic 3y ago
    About camera I don't know but controlling the browser and multimedia is possible: https://www.etsi.org/deliver/etsi_ts/131100_131199/131111/17.08.00_60/ts_131111v170800p.pdf https://www.etsi.org/deliver/etsi_ts/131100_131199/131111/17...
    - ale42 3y ago
      From the specification it looks it can open a browser... combine that with an exploit for the browser...
      - ThalesX 3y ago
        If I were some sort of criminal and my phone's browser would open up after which I'd see the video / audio / gps icons light up, I'd be very suspicious.
        ale42 3y ago
        Definitely. But I guess that it might be more subtle. The web page can show some benign message (let's say something related to your cell provider) and deliver an exploit to install a spyware like Pegasus. There would be no immediate sign of infection or suspicious activity besides the unexpected browser opening.
ethbr1 3y ago
Side note, France's approach to technology is so weird. Here's the DGSE (or not): https://www.google.com/maps/@48.8743323,2.4081584,16z/data=!3m1!1e3 https://www.google.com/maps/@48.8743323,2.4081584,16z/data=!... In contrast, here's the US CIA: https://www.google.com/maps/@38.952807,-77.1456773,16z/data=!3m1!1e3 https://www.google.com/maps/@38.952807,-77.1456773,16z/data=... Stumbled across that while traveling in Paris and thought "Who masks public satellite imagery in 2023?"
- ThalesX 3y ago
  Interesting! It's like the difference between security through obscurity and security by design.
- _visgean 3y ago
  Thje CIA building needs 3 times the space for parking as for the building.
  - WirelessGigabit 3y ago
    Safer than underground parking.
- amenhotep 3y ago
  I was reading about the arsenal at Toulon earlier today and looked it up on Google maps to see if it was obvious where the old Darse Vauban was - only to be faced with chunky pixels across the entire port! Yandex maps, of course, no such compulsion. Ridiculous stuff.
  - SushiHippie 3y ago
    Mhm yandex has the only satelitte imagery I've found that does not pixelate this https://yandex.com/maps/10502/paris/house/ZlcCdgBpTkUbWFZ0a3tyeHpr/?l=sat&ll=2.407091%2C48.874249&mode=search&sctx=ZAAAAAgAEAAaKAoSCcxh9x3DSyFAEcnk1M4w70hAEhIJBr03hgDgsD8RB%2FAWSFD8oD8iBgABAgMEBSgKOABA5KoGSAFqAmRlnQHNzEw9oAEAqAEAvQE1A4tKwgEBAOoBAPIBAPgBAIICFTE0MSBib3VsZXZhcmQgbW9ydGllcooCAJICAJoCCnRvdWNoLW1hcHM%3D&sll=2.407970%2C48.873968&sspn=0.008240%2C0.009384&text=141%20boulevard%20mortier&z=16.93 https://yandex.com/maps/10502/paris/house/ZlcCdgBpTkUbWFZ0a3...
pseudo0 3y ago
Baseband attacks are possible, but the French government would have to compel the (likely foreign) producer of baseband equipment to insert a backdoor, or do significant vulnerability research on closed source hardware/software to find vulnerabilities across common baseband processors. OS level attacks seem more likely. The lazy option for a police agency would just be to purchase or develop a couple mobile browser exploits, and then serve warrants to French telcos requiring them to MitM targeted traffic. When the target tries to load something via http, redirect them to the exploit server, deliver the payload, and dump everything from their device and collect location, camera, and audio going forward. Edit: Most people also seem to be overlooking the low-tech solution - get a warrant to break into the target's house or seize their phone during a "random" traffic stop, and use physical access to the device to do whatever.
- ThalesX 3y ago
  > [...] The lazy option for a police agency would just be to purchase or develop a couple mobile browser exploits, and then serve warrants to French telcos requiring them to MitM targeted traffic. [...] This seems highly unlikely to not alert someone as the camera / video / GPS icons would show up as being in use. > Most people also seem to be overlooking the low-tech solution - get a warrant to break into the target's house or seize their phone during a "random" traffic stop, and use physical access to the device to do whatever. I think people are not really overlooking, but the question is related to the remote enabling of GPS / Video / Audio interception. This kinda excludes random traffic stops or breaking into someone's house. As such, "do significant vulnerability research on closed source hardware/software to find vulnerabilities across common baseband processors" seems like a way to achieve this.
  - pseudo0 3y ago
    > This seems highly unlikely to not alert someone as the camera / video / GPS icons would show up as being in use. You would need a privesc to dump the data from other apps due to app sandboxing anyways. And once you have root, you can disable the GPS/video/camera indicators, since they are controlled by the OS. > I think people are not really overlooking, but the question is related to the remote enabling of GPS / Video / Audio interception. This kinda excludes random traffic stops or breaking into someone's house. Initial physical access is the poor man's way of enabling long-term remote access. > As such, "do significant vulnerability research on closed source hardware/software to find vulnerabilities across common baseband processors" seems like a way to achieve this. Go present a set of options to a government bureaucrat, and tell them: A. you can build a vulnerability research program for 7-8 figures, pray that your best researchers don't get poached by Google after you train them, and maybe get something useful in five years. B. you can buy a couple of existing browser exploits and privescs for 6-7 figures, enabling remote access. C. you can use your legal powers to break into the suspect's home/office and load monitoring software on their phone with physical access. They are going to pick B or C.
megous 3y ago
OMA DM, or something like that. https://en.wikipedia.org/wiki/OMA_Device_Management https://en.wikipedia.org/wiki/OMA_Device_Management Send special SMS, which makes the phone contact download instructions on what to do from a given URL. All in the background. Even Pinephone's modem has a few FOTA binaries that handle remote instructions from different operators. I guess the binaries of the OMA DM processing programs are provided by the mobile operators, or co-developed with the modem manufacturer. It can't turn on the camera or whatever, and is disabled by default, but that's just because the modem is not integrated into the main SoC. https://megous.com/dl/tmp/f498105e651c5935.png https://megous.com/dl/tmp/f498105e651c5935.png
BrandoElFollito 3y ago
A few months ago, France did emergency broadcast tests on some users. I was one of them and my phone (Android, Samsung, operator is Orange) suddenly was taken over. It started to root a sound I never heard (loudly), vibrate like crazy and the screen was locked to an emergency message that covered everything else. I had to click on the message to make it go. This test shows that the administration already has some level of control, through the network provider's OS layer.
- Someone 3y ago
  > This test shows that the administration already has some level of control, through the network provider's OS layer. I don’t hink it shows that. This likely is cell broadcast (https://en.wikipedia.org/wiki/Cell_Broadcast https://en.wikipedia.org/wiki/Cell_Broadcast) Many phones allow you to disable it (according to that Apple page not always: “In some countries or regions, you may not be able to disable Government Alerts”). See https://support.apple.com/en-us/102516 https://support.apple.com/en-us/102516, https://www.quora.com/How-can-you-block-or-disable-cell-broadcast-messages-on-Android-phones-without-rooting-them https://www.quora.com/How-can-you-block-or-disable-cell-broa...)
  - BrandoElFollito 3y ago
    Ah, you must be right then. I think it indeed looked very much like Alert-FR (https://fr.wikipedia.org/wiki/FR-Alert https://fr.wikipedia.org/wiki/FR-Alert)
deleted 3y ago
[deleted]

swader999 3y ago

Airplane mode does work. I can put an emf meter up to my Android phone and nothing comes out of it. Same with the device off. But is it still recording for later transmission? Perhaps!

dylan604 3y ago
If you're willing to believe anything can be put in passive mode, you'll absolutely drive yourself mad. There's no way to proove that a device is not listening passively, so of course people will say it is.
- mrcode007 3y ago
  Anything with an integrated circuit can be proven to be not operating based on power consumption or switching noise of the transistors in the device.
- theamk 3y ago
  Modern microphones need input clock to operate, and are physically incapable of listening when the clock is absent. This gives a trivial way to detect of the device is listening passively, at least on the workbench.
  - dylan604 3y ago
    I don't even know what the "mic needs a clock" means. I've never used a microphone that needed a clock. Making a mic that needs a clock just seems like a "WTF were they thinking" kind of thing. Can you elaborate on this concept of requiring a clock for a mic?
    - theamk 3y ago
      The keyword to search for is "digital mems", and of course we are talking individual parts to place on PCB, not the consumer device. Here is one random example: [0]. Somewhat expensive at $1 ea, but that's what you pay for US manufacturer. This microphones take 2.4 MHz clock and return PDM (pulse density modulation) signal. Does not seem very convinient for old-school analog electronic circuits, but it's pretty trivial to interface with any micro with pulse counter hardware. And presumably the audio won't have any hum or interference from nearby radio transmitters, which is especially useful in cell phones. [0] https://www.digikey.com/en/products/detail/cui-devices/CMM-4030DB-26354-TR/9748836 https://www.digikey.com/en/products/detail/cui-devices/CMM-4...
- fsflover 3y ago
  My phone has hardware kill switches for modem, wifi/Bluetooth and mic/camera.
solardev 3y ago
Do those meters work across all frequencies?

Wowfunhappy 3y ago

The thing people always say about mandated backdoors is that they make devices less secure for everyone. Ie, if the government can get in, so can other bad actors. If this is true (and I generally believe this is is), and if basebands do indeed have backdoors for the government, why hasn't anyone found them? Why haven't we seen CVEs on this? Can anyone point to a published baseband CVE that smells like a government plant, rather than a well-intentioned accident?