Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is your smartphone listening to you?

bbc.co.uk

Post reply on HN
Print view View original

111–120 of 120 posts

Re: Is your smartphone listening to you?

#111

Post by nickpsecurity »

Exras wrote: post #87
nickpsecurity wrote: post #56

Earlier quoted context omitted.

You mean it's a soft-switch that tells you it does that. You have no idea if the radio is actually running at any time or not. That plus their reliability issues are why I don't like soft-switches.

If your are equip like me with a EMF meter, then its easy to confirm what your phone is doing when in airplane mode, with normally is nothing. A mobile phone is after all just a computer with a radio modem. It can't do shit without sending out RF. I would recommend something like the 'Cornet ED78S RF Meter' to every technician with the tiniest amount of AU in circulation. The reason I got it was because I have become…

What frequencies can an EMF meter pick up? One of my own designs of the past was to hide something in a cable to amplify a signal along 10GHz optionally with a beam hitting it. None of the WiFi security monitors looked for 10GHz. Neither did most cheap, spectrum kits.

The dedicated chips in phones with the radios could have extra functionality for other spectrum activated by a trigger, possibly received wireless signal. So, it's a concern to me.

Re: Is your smartphone listening to you?

#112

Post by nickpsecurity »

edwintorok wrote: post #76
nickpsecurity wrote: post #12

Earlier quoted context omitted.

That's in my proposal for a secure or private phone that I drop on people trying to build one. Hopefully it will get in a successful product at some point. Need one for mic, front camera, rear camera, and radios. Might compromise to have a physical switch for mic and radios with something inside phone (eg a jumper) to turn off others. I want to be sure I can cut actual power to mic and wireless, though.

See slide 30 on this Neo900 presentation: http://neo900.org/stuff/ohsw2014/ohsw2014.pdf Also see the various kill switches on the block diagram (GPS kill, modem monitor, mic not directly attached to modem (so you could probably send fake audio/silence),etc: http://neo900.org/stuff/block-diagrams/neo900/neo900.html See slides 16 through 23 here for some details on the modem/audio monitoring/separation: http://neo900.o…

It meets some of my criteria. They're doing good work. Gotta ditch that TI processor when possible. Need some hardware and software modifications. However, actual switches for power and audio coming through Linux part are positives. Removes some low-hanging fruit.

Re: Is your smartphone listening to you?

#113

Post by nickpsecurity »

Bromskloss wrote: post #91
nickpsecurity wrote: post #12

Earlier quoted context omitted.

That's in my proposal for a secure or private phone that I drop on people trying to build one. Hopefully it will get in a successful product at some point. Need one for mic, front camera, rear camera, and radios. Might compromise to have a physical switch for mic and radios with something inside phone (eg a jumper) to turn off others. I want to be sure I can cut actual power to mic and wireless, though.

> my proposal for a secure or private phone that I drop on people trying to build one Can we see it?

Here's my write-up on securing Tor that shows issues and mitigations from high-assurance security in action with my own style:

https://www.schneier.com/blog/archives/2014/09/identifying_d...

Here's one write-up of similar methods applied to mobile:

https://www.schneier.com/blog/archives/2014/06/blackphone.ht...

Here's some links to HW and SW techniques that might be used in SOC to knock out the 0-days:

https://news.ycombinator.com/item?id=11848132

Note: You can see difference between few in real security on HW side. Mainstream, faux security immediately says IOMMU, stateless, whatever. High-assurance, real security is concerned with segmentation, pointer protection, making memory untrusted, TCB effects, optionally timing of ISA operations, and so on. Apps + their CPUs get hit all over. Securing one takes more than a mere IOMMU or something. ;)

Re: Is your smartphone listening to you?

#114

Post by Exras »

nickpsecurity wrote: post #111
Exras wrote: post #87

Earlier quoted context omitted.

If your are equip like me with a EMF meter, then its easy to confirm what your phone is doing when in airplane mode, with normally is nothing. A mobile phone is after all just a computer with a radio modem. It can't do shit without sending out RF. I would recommend something like the 'Cornet ED78S RF Meter' to every technician with the tiniest amount of AU in circulation. The reason I got it was because I have become…

What frequencies can an EMF meter pick up? One of my own designs of the past was to hide something in a cable to amplify a signal along 10GHz optionally with a beam hitting it. None of the WiFi security monitors looked for 10GHz. Neither did most cheap, spectrum kits. The dedicated chips in phones with the radios could have extra functionality for other spectrum activated by a trigger, possibly received wireless sign…

The one I suggest goes to 6 Ghz

I can't imagine that pulsed digital transmission on 10Ghz would not create noise in the lower harmonics bands at all. The meter also have a sound mode where you eg. can hear the ~8-10Khz modulation of the mobile ~700/900/1900/2100Mhz signal.

You can clearly hear the difference between different transmission types as DECT phones, Wifi, GSM/LTE, and EM noise in general(PC's/HDMI cables/USB3 HD docks)

My central room heater has a small CR battry powered computer (that I had forgot all about) that calculate the bill and transmit the results every 2 minutes on 2.4Ghz

it makes a tiny ~0.5 sec pulse on the display/audio, and I thought for an hour that I had a hidden transmitter in my apartment, since turning the mains fuse off had no effect.

I had to clear the room of all tech to track down the source, felt a bit stupid when I finally found it.

So going down this road has some up's and down's vs staying totally oblivious of ones electromagnetic environment.

Re: Is your smartphone listening to you?

#115

Post by nickpsecurity »

Exras wrote: post #114
nickpsecurity wrote: post #111

Earlier quoted context omitted.

What frequencies can an EMF meter pick up? One of my own designs of the past was to hide something in a cable to amplify a signal along 10GHz optionally with a beam hitting it. None of the WiFi security monitors looked for 10GHz. Neither did most cheap, spectrum kits. The dedicated chips in phones with the radios could have extra functionality for other spectrum activated by a trigger, possibly received wireless sign…

The one I suggest goes to 6 Ghz I can't imagine that pulsed digital transmission on 10Ghz would not create noise in the lower harmonics bands at all. The meter also have a sound mode where you eg. can hear the ~8-10Khz modulation of the mobile ~700/900/1900/2100Mhz signal. You can clearly hear the difference between different transmission types as DECT phones, Wifi, GSM/LTE, and EM noise in general(PC's/HDMI cables/U…

Appreciate the extra info. Might look into getting one. Lmao on the mystery of spying heater.

Re: Is your smartphone listening to you?

#116

Post by f_allwein »

lukeschlather wrote: post #60
jimhefferon wrote: post #57

Earlier quoted context omitted.

I'm not seeing that. Certainly I'd expect their basic phone to come with a mic. I want a way to physically disconnect an existing mic, not to connect a new one. Am I off here (probably ..)?

The Ara is a modular smartphone system. Since there's a clear benefit to being able to remove the audio/video/wireless modules, I would hope that they are fully replaceable and separate from the screen and CPU modules.

I figured they could even make a phone without any microphone and then let users plug in a headset when they want to make calls.

Re: Is your smartphone listening to you?

#117

Post by Exras »

awqrre wrote: post #90
mahyarm wrote: post #83

Earlier quoted context omitted.

Very very shitty microphones, so the statistical risk is significantly reduced! And the hardware might not support doing that switch in software.

Actually, you can get pretty good quality (You could easily do speech-to-text on the produced audio)... If you want to do a simple test, plug-in your headphones into your microphone jack and start recording away. I just did it why my current cheap Amazon basics headphones and I can clearly hear my speech back. Also take a look at https://www.youtube.com/watch?v=GqNrLfbwAH8 , I think that this shows you how to record…

True.

The video: No, it shows how to 'record what you hear' (windows mixer) nothing to do with the speakers.

I would claim that it is impossible to record from speakers that are connected to low impedance running output amps and record from them at the same time.

So if the speakers are playing music they are not recording your sing-a-long also.

Re: Is your smartphone listening to you?

#118

Post by yrro »

razakel wrote: post #109
yrro wrote: post #82

Earlier quoted context omitted.

That doesn't stop it communicating with the mobile network. At least in the UK, you can still call emergency numbers (999, Childline, Samaritans(?)) without a SIM.

>That doesn't stop it communicating with the mobile network. At least in the UK, you can still call emergency numbers (999, Childline, Samaritans(?)) without a SIM. You haven't been able to do this since 2009. It was changed due to the high volume of hoax calls.

Huh. Someone should tell my phone; it still displays 'emergency calls only' when it is unable to connect to my own provider's towers.

Re: Is your smartphone listening to you?

#119

Post by razakel »

yrro wrote: post #118
razakel wrote: post #109

Earlier quoted context omitted.

>That doesn't stop it communicating with the mobile network. At least in the UK, you can still call emergency numbers (999, Childline, Samaritans(?)) without a SIM. You haven't been able to do this since 2009. It was changed due to the high volume of hoax calls.

Huh. Someone should tell my phone; it still displays 'emergency calls only' when it is unable to connect to my own provider's towers.

>Huh. Someone should tell my phone; it still displays 'emergency calls only' when it is unable to connect to my own provider's towers.

That's emergency roaming. You can call emergency numbers provided there's signal from any network and you have a SIM installed.

Re: Is your smartphone listening to you?

#120

Post by voidz »

walrus01 wrote: post #66
voidz wrote: post #9

The article takes it into a boring direction, and they didn't mention Samsung who is most active in this field. Vendors bypass appstores with their proprietary apps. Once upon a time I had a Samsung phone, and when I configured its email app, I saw Samsung's own servers, and not my phone, logging in to my email server. Which means they stole my password. That's when I tossed out Samsung devices once and for all. But…

You set it up with your own IMAP(TLS) and smtpd for email, and in your server logs the logins were coming from Samsung IPs, not the wifi or cellular network your phone was connected to? Where were these Samsung IPs in terms of physical location and netblock? If they're doing MITM on their customers' traffic I'm really curious where it's going through.

Correct. The logins came from Samsung IPs. I wrote up a fat warning on xda but am unable to find it. Sadly it was too long ago for me to find it back.
Post reply on HN