Is your smartphone listening to you?

Post by sametmax » Sun, Jun 05, 2016, 5:19 PM UTC

drdaeman wrote: post #21

nickpsecurity wrote: post #12

Earlier quoted context omitted.

That's in my proposal for a secure or private phone that I drop on people trying to build one. Hopefully it will get in a successful product at some point. Need one for mic, front camera, rear camera, and radios. Might compromise to have a physical switch for mic and radios with something inside phone (eg a jumper) to turn off others. I want to be sure I can cut actual power to mic and wireless, though.

If your threat model concerns with hardware/firmware exploits, then you can't trust the physical switches unless they cut all the wires - and unless you can validate that this is what they do. Theoretically speaking, a malicious (or threatened/persuaded/forced) manufacturer may implement a non-standard way to power the supposedly disconnected component using still-connected wiring, to be used for a special occasions.…

Post by dave2000 » Sun, Jun 05, 2016, 5:21 PM UTC

cle wrote: post #15

jameslk wrote: post #10

This is why I use an app called DVasive which tells me when my mic or camera is in use. It's pretty good at figuring this out it seems, although I haven't found any nefarious apps yet that use my mic or camera unexpectedly (I've been using the app for a couple of years). It probably wouldn't work for vendors or other rogue ways to get access to my phones devices however.

How can you trust DVasive isn't itself malicious?

Post by dave2000 » Sun, Jun 05, 2016, 5:23 PM UTC

digi_owl wrote: post #32

voidz wrote: post #9

The article takes it into a boring direction, and they didn't mention Samsung who is most active in this field. Vendors bypass appstores with their proprietary apps. Once upon a time I had a Samsung phone, and when I configured its email app, I saw Samsung's own servers, and not my phone, logging in to my email server. Which means they stole my password. That's when I tossed out Samsung devices once and for all. But…

> Once upon a time I had a Samsung phone, and when I configured its email app, I saw Samsung's own servers, and not my phone, logging in to my email server. Which means they stole my password. Would love to see some traffic logs regarding this.

Post by jonknee » Sun, Jun 05, 2016, 5:32 PM UTC

willholloway wrote: post #27

The only real answer to this with current consumer devices is to have a soundproof case for your phone. Radio connection can be kept alive, and if the case were smart it could have its own internal mic, wired to an led or speaker on the outside of the case to alert the user that the phone is ringing. It's a product I've been kicking around producing for a while now. Is there demand? Would you purchase for peace of mi…

Post by markokrajnc » Sun, Jun 05, 2016, 5:44 PM UTC

sametmax wrote: post #41

drdaeman wrote: post #21

Earlier quoted context omitted.

If your threat model concerns with hardware/firmware exploits, then you can't trust the physical switches unless they cut all the wires - and unless you can validate that this is what they do. Theoretically speaking, a malicious (or threatened/persuaded/forced) manufacturer may implement a non-standard way to power the supposedly disconnected component using still-connected wiring, to be used for a special occasions.…

This is why I got a shutter on m laptop camera. It's mechanicl, and I can see it's on or off. It should be a legal obligation to provide those, for camera and mic.