5 ms·

Android Anti-forensics: Modifying CyanogenMod

67 points by aburan28 12y ago

Htsthbjig 12y ago
In a world in which everything is monitored all the time, like the police State the government agencies dream about, lying is a necessity. We need more of this. Our messenger app sending false data along with the valid one, but is automatically discarded by the app. This way, anyone intercepting the data is not certain of what it means. Bandwidth is cheap.Just encrypting something does not make anything sure. It is one of the earliest tricks on existence. You know someone spies on you, you act like you don't know anything but supply false information to your spies.
- userbinator 12y ago
  Exactly, this strategy has been known for a long time: http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography
jimhefferon 12y ago
So the police have a tool. He writes a tool-fooler. No doubt they will return with a tool-fooler tool. Then he fools the tool-fooler tool. When will it ever halt? Time for a drink.
- RachelF 12y ago
  It never ends. Counter measures, counter-counter measures etc. Most of the time, though, the police will use another method, as the law has more than anti-forensics in their armoury.
sejje 12y ago
It's well-known that phones report our locations at all times, I'd like to see a phone that falsifies that data as well.
- pavel_lishin 12y ago
  Kind of hard to fool triangulation. Software doesn't beat the laws of physics.
  - chongli 12y ago
    But hardware definitely could. With a manually aimed antenna and proper tools exposed to the user, a phone could be made to communicate with only one cell tower at a time. This would make triangulation impossible.
    - im3w1l 12y ago
      You could look at which tower you connect to with which strength at which time. This would not give as exact results as triangulation for sure, but you could probably still infer a rough trajectory.
  - troymc 12y ago
    If the operating system provides an API for the actual/measured location, why can't that API just be changed to provide a fake location instead? It could be a user setting: location services - use fake location? yes/no
    - alexjeffrey 12y ago
      triangulation is performed by analysing response times from cell towers - the FBI doesn't just call yourphone.getLocation()
      - troymc 12y ago
        You're right, that's different, but it can also be foiled, at least in theory: you just have your cellphone add some time delay before responding. The delay could be different for each cell tower. I realize that's a big ask (and is probably something the operating system can't do), but it doesn't violate any laws of physics.
jamessb 12y ago
This is just blogspam. For actual details, see the arXiv paper "Android Anti-forensics: Modifying CyanogenMod": http://arxiv.org/abs/1401.6444 http://arxiv.org/abs/1401.6444
- dang 12y ago
  Thanks! Changed to that from http://www.scientificamerican.com/article/a-phone-that-lies-for-you-an-android-hack-allows-users-to-put-decoy-data-on-a-smartphone/ http://www.scientificamerican.com/article/a-phone-that-lies-....
rtpg 12y ago
This reminds me of a feature that was on some Japanese flip phones. You could set some contacts to be "secret", and any messages from them would not appear in the default app. The only notification you would get would be a small pixel embedded in the cell tower signal image in the corner of your screen. You would then go into some deeply hidden corner of your settings to get the "real" messaging app. If you know about it, its useless, but (like this lying phone) , it can be very easy to overlook in a casual analysis of the phone (by your wife in one case, or by the police in the other). We should never discount how effective really simple things like these can end up being.
- w1ntermute 12y ago
  Japan's Philanderers Stay Faithful to Their 'Infidelity Phones': Cads Attracted to How Outdated Device Hides Calls, Texts; Juggling Three Girlfriends: http://online.wsj.com/news/articles/SB10001424052970204755404578102581637364040 http://online.wsj.com/news/articles/SB1000142405297020475540...
- Ayaz 12y ago
  That reminded me of the secret SMS app I made once for Symbian S60: http://tiliman.wordpress.com/rei-secretsms/ http://tiliman.wordpress.com/rei-secretsms/ It even had a duress mode, in which you could type in a secondary pin to open the app under duress, but the app, detecting the secondary pin, would wipe everything inside and start afresh.
vaadu 12y ago
Wait for some prosecutor to determine that just having this capability on your phone makes you guilty.
davb 12y ago
I would install such a firmware in a heartbeat if I had confidence that there were a team of freedom-fighting hackers staying one step ahead of the authorities. I don't keep anything incriminating or illegal on my phone (hell, I don't do anything illegal) but I'm terrified of the day where I'm in the airport, embarking on a £4k holiday (not insignificant in my salary bracket) and am asked to hand my phone and laptop/tablet over to confirm I'm not a terrorist. I'll be faced with acquiescing and compromising my principles or disappointing my girlfriend (who I almost always travel with) and having both of us taking a financial hit (and probably being added to a "list" or having my threat value increased). It's not an unheard of situation in the UK, and is most often not intelligence-driven (more likely you are travelling through an airport where they are trialling some new counter-terrorist technology we've paid a small fortune to install). I think a device with limited state (ROM-only?) which can give me reasonable assurances that no-one could tamper with it or install any government sponsored malware may be the solution. Although the utility of such a device is questionable, and it certainly wouldn't be fun to use.
- davb 12y ago
  I would add that I'd be worried that if we weren't one step ahead, the discover of such digital forensics counter-measures would be used as evidence of wrong-doing. RIPA (Regulation of Investigatory Powers Act, 2000) has set a precedent where the unwillingness to acquiesce (for example, divulge encryption keys) is a crime in and of itself, effectively outlawing privacy.
- AJ007 12y ago
  I've mentioned this in NSA stories before, the US government, the UK, are hardly the only concerns. What happens at other borders? Your devices contain sensitive information -- logins, source code, server lists, archived email, customer data; perhaps not on the machine itself but accessible through it. Corrupt countries are one problem, but so are first world countries. There are a number of stories about American execs being spied on by first world countries. Failing to protect your physical data when you leave the country (assuming your devices have work information on them) is negligent.
  - 12y ago
ufmace 12y ago
This makes me wonder just how open everyday Android phones are to forensic examination. I'm not sure how you would get much out of the phone without either manually installing an app with a lot of permissions or doing some kind of device-specific firmware hack. And the manufacturers often seem to be making this kind of hacking harder and harder, going by what the Android rooting community has experienced.

67 points by aburan28 12y ago

In a world in which everything is monitored all the time, like the police State the government agencies dream about, lying is a necessity. We need more of this. Our messenger app sending false data along with the valid one, but is automatically discarded by the app. This way, anyone intercepting the data is not certain of what it means. Bandwidth is cheap.Just encrypting something does not make anything sure. It is one of the earliest tricks on existence. You know someone spies on you, you act like you don't know anything but supply false information to your spies.

userbinator 12y ago
Exactly, this strategy has been known for a long time: http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography

jimhefferon 12y ago

So the police have a tool. He writes a tool-fooler. No doubt they will return with a tool-fooler tool. Then he fools the tool-fooler tool. When will it ever halt? Time for a drink.

RachelF 12y ago
It never ends. Counter measures, counter-counter measures etc. Most of the time, though, the police will use another method, as the law has more than anti-forensics in their armoury.

sejje 12y ago

It's well-known that phones report our locations at all times, I'd like to see a phone that falsifies that data as well.

pavel_lishin 12y ago
Kind of hard to fool triangulation. Software doesn't beat the laws of physics.
- chongli 12y ago
  But hardware definitely could. With a manually aimed antenna and proper tools exposed to the user, a phone could be made to communicate with only one cell tower at a time. This would make triangulation impossible.
  - im3w1l 12y ago
    You could look at which tower you connect to with which strength at which time. This would not give as exact results as triangulation for sure, but you could probably still infer a rough trajectory.
- troymc 12y ago
  If the operating system provides an API for the actual/measured location, why can't that API just be changed to provide a fake location instead? It could be a user setting: location services - use fake location? yes/no
  - alexjeffrey 12y ago
    triangulation is performed by analysing response times from cell towers - the FBI doesn't just call yourphone.getLocation()
    - troymc 12y ago
      You're right, that's different, but it can also be foiled, at least in theory: you just have your cellphone add some time delay before responding. The delay could be different for each cell tower. I realize that's a big ask (and is probably something the operating system can't do), but it doesn't violate any laws of physics.

jamessb 12y ago

This is just blogspam. For actual details, see the arXiv paper "Android Anti-forensics: Modifying CyanogenMod": http://arxiv.org/abs/1401.6444 http://arxiv.org/abs/1401.6444

dang 12y ago
Thanks! Changed to that from http://www.scientificamerican.com/article/a-phone-that-lies-for-you-an-android-hack-allows-users-to-put-decoy-data-on-a-smartphone/ http://www.scientificamerican.com/article/a-phone-that-lies-....

rtpg 12y ago

This reminds me of a feature that was on some Japanese flip phones. You could set some contacts to be "secret", and any messages from them would not appear in the default app. The only notification you would get would be a small pixel embedded in the cell tower signal image in the corner of your screen. You would then go into some deeply hidden corner of your settings to get the "real" messaging app. If you know about it, its useless, but (like this lying phone) , it can be very easy to overlook in a casual analysis of the phone (by your wife in one case, or by the police in the other). We should never discount how effective really simple things like these can end up being.

w1ntermute 12y ago
Japan's Philanderers Stay Faithful to Their 'Infidelity Phones': Cads Attracted to How Outdated Device Hides Calls, Texts; Juggling Three Girlfriends: http://online.wsj.com/news/articles/SB10001424052970204755404578102581637364040 http://online.wsj.com/news/articles/SB1000142405297020475540...
Ayaz 12y ago
That reminded me of the secret SMS app I made once for Symbian S60: http://tiliman.wordpress.com/rei-secretsms/ http://tiliman.wordpress.com/rei-secretsms/ It even had a duress mode, in which you could type in a secondary pin to open the app under duress, but the app, detecting the secondary pin, would wipe everything inside and start afresh.

vaadu 12y ago

Wait for some prosecutor to determine that just having this capability on your phone makes you guilty.

davb 12y ago

I would install such a firmware in a heartbeat if I had confidence that there were a team of freedom-fighting hackers staying one step ahead of the authorities. I don't keep anything incriminating or illegal on my phone (hell, I don't do anything illegal) but I'm terrified of the day where I'm in the airport, embarking on a £4k holiday (not insignificant in my salary bracket) and am asked to hand my phone and laptop/tablet over to confirm I'm not a terrorist. I'll be faced with acquiescing and compromising my principles or disappointing my girlfriend (who I almost always travel with) and having both of us taking a financial hit (and probably being added to a "list" or having my threat value increased). It's not an unheard of situation in the UK, and is most often not intelligence-driven (more likely you are travelling through an airport where they are trialling some new counter-terrorist technology we've paid a small fortune to install). I think a device with limited state (ROM-only?) which can give me reasonable assurances that no-one could tamper with it or install any government sponsored malware may be the solution. Although the utility of such a device is questionable, and it certainly wouldn't be fun to use.

davb 12y ago
I would add that I'd be worried that if we weren't one step ahead, the discover of such digital forensics counter-measures would be used as evidence of wrong-doing. RIPA (Regulation of Investigatory Powers Act, 2000) has set a precedent where the unwillingness to acquiesce (for example, divulge encryption keys) is a crime in and of itself, effectively outlawing privacy.
AJ007 12y ago
I've mentioned this in NSA stories before, the US government, the UK, are hardly the only concerns. What happens at other borders? Your devices contain sensitive information -- logins, source code, server lists, archived email, customer data; perhaps not on the machine itself but accessible through it. Corrupt countries are one problem, but so are first world countries. There are a number of stories about American execs being spied on by first world countries. Failing to protect your physical data when you leave the country (assuming your devices have work information on them) is negligent.
- 12y ago

ufmace 12y ago

This makes me wonder just how open everyday Android phones are to forensic examination. I'm not sure how you would get much out of the phone without either manually installing an app with a lot of permissions or doing some kind of device-specific firmware hack. And the manufacturers often seem to be making this kind of hacking harder and harder, going by what the Android rooting community has experienced.