7 ms·
The Problem with Mobile Phones
- nextos 11y agoThis is why we need more devices like Pyra [1], which was in the frontpage today [2]. Or its sister project, the Neo900 [3]. To me, current mobile phones seem like a step backwards in many fronts, as highlighted by the EFF or the Neo900 developers [4]: - It should be possible to install your preferred OS, pretty much like you do on a PC. - Hardware components should be more open. When not possible, they should be isolated like the Neo900 will do [4]. These two things would lead to much better privacy, and less planned obsolescence. It's atrocious that many cell phones don't get software updates past the 24 months mark. We should get much more serious about this. The current mobile landscape is depressing. [1] http://pyra-handheld.com/ http://pyra-handheld.com/ [2] https://news.ycombinator.com/item?id=9463032 https://news.ycombinator.com/item?id=9463032 [3] http://neo900.org/ http://neo900.org/ [4] http://neo900.org/stuff/ohsw2014/ohsw2014.pdf http://neo900.org/stuff/ohsw2014/ohsw2014.pdf
- sliverstorm 11y agoCan't you already install arbitrary OS to most Android phones? See Cyanogenmod & company.
- nextos 11y agoNot really. Cyanogen is OK, but it's just Android. The hardware problems are still there: i) no drivers so GNU/Linux can't be ported ii) the baseband processor is usually badly isolated so it's easy to attack the device.
- gizmo686 11y agoIf you can port Cyanogenmod, then don't you have a functioning Linux kernel that you can use to run any Linux based OS?
- nextos 11y agoYou do, this is Ubuntu Mobile strategy at the moment AFAIK. However, drivers in ARM platforms are very opaque. You rely upon the goodwill of the manufacturer to update them, and most of the time they don't. See how most devices get unsupported in Cyanogenmod after a while. And in any case, all the privacy concerns remain. It's a hardware issue. Android would be fine.
- mirimir 11y agoBest practice here is using a WiFi-only device with a separate cell modem. So you have hardware baseband isolation. See <https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy> https://blog.torproject.org/blog/mission-impossible-hardenin....
- j_s 11y agoworking link: https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy https://blog.torproject.org/blog/mission-impossible-hardenin...
- pakled_engineer 11y agoThen you run into problems with WiFi such as it broadcasting all your preferred networks/tracking, and the sad state of proprietary WiFi drivers. Blackphone uses Kismet WiFi Manager to prevent MAC broadcasting and other issues https://play.google.com/store/apps/details?id=net.kismetwireless.android.smarterwifimanager&hl=en https://play.google.com/store/apps/details?id=net.kismetwire...
- mirimir 11y agoThat's true. But at least it's legal to spoof MAC.
- olalonde 11y agoNot unless you use a popular phone model since each phone needs to be individually ported. I just bought a Mi Note (http://s1.mi.com/m/product/minote/index.html http://s1.mi.com/m/product/minote/index.html) and am out of luck.
- pakled_engineer 11y agoFor now you can install arbitrary custom Android builds on a few commercial devices until all the device bootloaders have Trusted Execution Environment (TEE) signing schemes preventing any user changes. Mobile devices are becoming increasingly more tightly sealed blackboxes not more open.
- chriswarbo 11y agoThanks for the neo900 links; looks really interesting! My FreeRunner's still using the GTA02 motherboard, as I'm too much of a wimp to do the upgrade to GTA04 ;)
- xellisx 11y agoThe Neo900 look neat, then I see the specs. I want a 5-6" phone with a slide-out keyboard with the specs of a modern phone of the same size.
- contentrifi 11y agoThe Problem with Mobile phones is that the service is so unreliable and carrier fees are insane..especially if you're running a mobile office. I opt for VoIP services like Line2. www.line2.com
- jf 11y agoThis is part of the reason why I've been considering getting a one-way pager and leaving my mobile phone off or in airplane mode. This way I would only need to take my phone out of airplane mode if I happen to be in a location where I can't use another phone to return pages.
- simoncion 11y agoA pager would have the same triangulation-via-cell-tower and social-network-analysis-via-page-history vulnerabilities, right?
- jf 11y agoNot a one-way pager? My understanding is that one-way pagers (POCSAG, etc) pagers are "receive only".
- richardwhiuk 11y agoThey still need to communicate two way to the cell tower to receive pages. Pages don't get flooded to every cell all over the world!
- upofadown 11y agoOne way pagers only work in a particular area of the world. In that area all the transmitters send all the pages. Such systems do not scale all that well and as a result getting pager service over a wide area can be fairly expensive.
- doctorshady 11y agoThere's a few nationwide pager networks out there; they're quite easy to build without the task of making communication two way. Just set up a hundred or so watt UHF transmitter at an antenna farm, feed it with PSK or FSK from a satellite receiver, and boom! You just covered most of a large city.
- 11y ago
- christianbryant 11y agoThe Electronic Frontier Foundation (EFF) notes in their report "mobile phones were not designed for privacy and security". While the report is mostly focused on the wide varieties of mobile phone tracking (from GPS to wireless access), it illuminates perhaps the root of the issue noted in many mobile security articles: Mobile phones now mimic personal computers, and it begs the question: Why? For such a ubiquitous device that holds so much personal data and is portable in ways laptops will never be, one wonders why we are designing mobiles to be just like tiny laptops with all the same protocols, applications and OS APIs. First, sure, it's easy, but who ever heard of an old-school phone dying from a DDoS attack (which now is the current major mobile threat)? Or, being taken over by malware and every contact, password and account login sent to the Maldives for quick smash-and-grab sessions against bank accounts and so forth? Maybe the intrinsic issue is really that we are still doing the "make it smaller" thing with tech and calling that innovation instead of "make it different" which out of the box often comes with intrinsic security of its own for actually being different.
- MichaelGG 11y agoFirst, citation needed on DDoS being a major mobile threat to actual phones. If you mean the iOS wifi bug, that's not major or a DDoS. Second, OK, we ditch IP and flip to OSI protocols. Now apart from decreased security due to all this new software that'd have to be made, how would that make things more secure, at all? Everyone will still want to use the Internet, so it's not airgapping. This argument makes no sense.
- christianbryant 11y ago1) Haha, well the "current major mobile threat" jab was more tongue in cheek, and you're right - it's the "No iOS Zone" vulnerability. The citation is the following: RSA conference presenter SkyCure discussed the possible vulnerability [0] in iOS 8 that _could_ allow iPhone users with iOS 8 to be victimized by the equivalent of a DoS attack. And, the org has worked with Apple and iOS 8.3 likely fixes the issue. 2) However, while I wasn't making an argument per se, more just thinking out loud about architecture choices, especially when they "mimic" systems that are not for the same purpose, I do believe that is a small part of the problem when it comes to mobile security as pertains to phones. And, maybe I'm also thinking that with that in mind, there might be room for a whole separate set of protocols and methods for interacting with the Internet (or a reasonable facsimile of it) from your phone, which is not a PC :-) [0] https://www.skycure.com/blog/ios-shield-allows-dos-attacks-on-ios-devices/ https://www.skycure.com/blog/ios-shield-allows-dos-attacks-o...
- deleted 11y ago[deleted]
- bootload 11y ago"Turn phones off" The only truly "off phone", is one without batteries or in a microwave, sans the power cord.
- stephengillie 11y agoI thought Faraday cages had to be powered to block EM waves...
- msftie 11y agoYou just need a conductive metal container. http://en.wikipedia.org/wiki/Faraday_cage http://en.wikipedia.org/wiki/Faraday_cage
- rsync 11y agoThat's why a modular mobile phone is so interesting. The important aspect of a modular mobile phone is not what you can add to it (silly little consumer modules) but what you ca subtract from it. With a modular mobile phone, you could physically isolate the GPS/GSM/LTE/bluetooth components at will. My prediction is that the google modular phone, whatever it's called, will have the cellular components on the base system and not removable, which is a pity.
- yohui 11y agoProject Ara? All reports have stated that the basic device will be wifi-only.
- wiggumz 11y agoTry putting your phone in a metal box like this: http://www.containerstore.com/shop?productId=10031018&N=&Ntt=Stainless+steel http://www.containerstore.com/shop?productId=10031018&N=&Ntt...
- mirimir 11y agoSee <https://www.paraben.com/stronghold-bags.html> https://www.paraben.com/stronghold-bags.html>. > Paraben's StrongHold bags block out wireless signals from cell towers, wireless networks, and other signal sources to protect evidence. Works both ways :)
- wiggumz 11y agoSome phones have baseband processors that can remain powered up even when the phone is officially off. No malware is required.
- mrtimuk 11y agoI'm surprised A-GPS didn't get a mention. There must be data leaked when your phone uses MSA to obtain higher resolution for the rough GPS location that it has. (less so with MSB)
- jacquesm 11y agoEven the ubuntu phone comes with software you 'can't install' (unless you go beyond the normal interface) and has software of dubious origin on it ('here'). Missed chance on many fronts. The problem isn't so much 'mobile phones' the problem is smart mobile phones and the suppliers of software for them, and for all mobile phones the big black box that is the baseband processor and whatever goes on in there. Little snitches does not cover it.
- pareidolia 11y agoI'm surprised that addon cards for laptops such as the Gobi3000 aren't mentioned yet. Are these a security risk? Is "off" really off to such a card? Is isolation sufficient?