Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Your Android carrier can remotely turn settings on

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 299 posts

Re: Tell HN: Your Android carrier can remotely turn settings on

#51

Post by qbasic_forever »

Wait until your learn what a country or local government/police can do remotely to the baseband firmware of your phone with a court order...

10-20 years ago the FBI was regularly remotely programming firmware to listen in and record cell phone microphones to capture conversations of suspects. IIRC a mafia case hinged on data gathered in this way so it is not some abstract theoretical or crackpot theory (https://www.cnet.com/news/privacy/fbi-taps-cell-phone-mic-as...).

It's only gotten worse as phones have gotten more capable. You don't own squat about the device in your pocket at all times.

Re: Tell HN: Your Android carrier can remotely turn settings on

#52

Post by cameronh90 »

nicholasjarnold wrote: post #33

> I must say I strongly dislike losing control over my own device. It feels dystopian to me. Even with a rooted device where perhaps you personally coded up the ROM you are still missing a piece which is the binary blob that runs the baseband radio. That firmware is, afaik, not something which exists in any sort of open-source or rootable manner. It's a closed blob running proprietary software on your phone, and it r…

Moreover, some of these settings restrictions are encouraged or mandatory for the FCC/Ofcom/your-local-radio-regulator to certify your device. This is to prevent people from doing naughty things with the spectrum.

Re: Tell HN: Your Android carrier can remotely turn settings on

#54

Post by orhmeh09 »

michaelt wrote: post #39
unilynx wrote: post #32

Earlier quoted context omitted.

I don't know if this happens in The Netherlands, but if they forced your phone to receive NL Alerts it would seem very reasonable to me. Only the government issues those. I've understood cell broadcasts are also used for advertisements/otherwise spammy stuff in eg. the US? Then I could understand you considering cell broadcast being turned on being unreasonable

The fact the government issues the alerts doesn't mean the government won't get pressured into sending spammy messages. For example, what politician could turn down the grieving parents of a kidnapped child, when they call for using the emergency alert system for missing children? But if I work from home, and there aren't any kidnapped children in my home, then waking me up at 5am with a missing child alert just inco…

You can turn it off. Shouldn’t be too inconvenient if it’s important to you.

Re: Tell HN: Your Android carrier can remotely turn settings on

#56

Post by bjt2n3904 »

msingh_5 wrote: post #23

These are emergency broadcast alerts. Different countries have different laws on these - and in some countries you might not even be able to disable them. Just because its listed under "Apps & notifications"/"Wireless emergency alerts", it doesn't mean they are "user settings". Its not necessarily the local "carrier" that turned the settings on, its more that connecting to a cell tower in a particular jurisdiction ca…

Just because another country has a law does not mean my phone should disregard what I told it to do.

This absolutely is a user setting.

How far we've fallen from sharing the DeCSS flag, to arguing that users shouldn't have control over their devices, and governments and carriers should.

Re: Tell HN: Your Android carrier can remotely turn settings on

#57

Post by ppcdeveloper »

counttheforks wrote: post #36
ppcdeveloper wrote: post #27

Absolutely they can. Carriers have access to the system partition aka We do what we want (hopefully they do what makes sense). This is how bloatware is installed (the things you can't get ride of).

Your thinking is tainted by the american model where you buy carrier locked phones. But no, that is not usually how it works. The system partition can be modified by the party who issues system updates. Normally this would be the company making the phone, such as Samsung. But in the US, some carriers sell modified phones locked to their network, and in that case the carrier is also the one shipping updates.

Worked at Sprint back in the day and we (I) had to do this. Special certificates to produce a special OS build with the right privileges (carrier specific). The carriers and builders (Samsung etc) work together to get this in place. That on top of zero rating data being sent out for tracking allow the carrier (or builder) to do what they want.

Re: Tell HN: Your Android carrier can remotely turn settings on

#58

Post by Kiboneu »

Absolutely, they can change this setting, in lots of different ways. Originally emergency services were set up by fields offered by the SIM. Occasionally these settings change, so an update mechanism had to be established.

  - Android comes with a list of carriers and their required configurations; when the MNC and MMC provided by the SIM match a carrier on that list, Android uses the configuration from that list. This list updates with Android updates, and so SIM don't have to be reprogrammed. 

  - Modern SIMs just Java cards with a SIM app (especially if they offer IMS). The Java cards also have a secure storage element to hold subscriber keys and mitigate tampering to change these keys. They also contain signing public keys which is queried by Android whenever /Carrier Privileges/ are requested. That way, an app signed by a carrier can very against the carrier's SIM in order to get access to this configuration.

  - There are remote configuration protocols, so Android will have a bare configuration for carriers just to fetch the latest configuration from them (to then use it).
This has been happening for quite a while. If you use(d) a carrier app for voicemail or setting up the service for the first time, you've used this. Except nowadays it seems Android actually /informs/ you about it.

https://source.android.com/docs/core/connect/uicc

https://source.android.com/docs/core/connect/carrier

One could probably write a rooted Android ROM that filters / requests user permission / logs changes to carrier settings, and there's utility in that since it may be a vector for espionage / traffic redirection (provided stolen keys or an exploit of the SIM's certificate storage machinery). SIM cards are usually directly connected to the CPU, not to the baseband.

Re: Tell HN: Your Android carrier can remotely turn settings on

#59

Post by ddalex »

brainchild-adam wrote: post #14
ddalex wrote: post #8

It's part of the mandated law in certain countries so it's normal to be implemented there.

I was not aware this could be done remotely explicitly going against settings the user himself has set.

Phone (call, data) interception is mandated in a lot of countries (i.e. operators have to do it is presented with a judicial mandate) against the wishes of user too. This setting is in the same vein, in order to allow authority controlled public broadcasts.

Re: Tell HN: Your Android carrier can remotely turn settings on

#60

Post by anigbrowl »

orhmeh09 wrote: post #54
michaelt wrote: post #39

Earlier quoted context omitted.

The fact the government issues the alerts doesn't mean the government won't get pressured into sending spammy messages. For example, what politician could turn down the grieving parents of a kidnapped child, when they call for using the emergency alert system for missing children? But if I work from home, and there aren't any kidnapped children in my home, then waking me up at 5am with a missing child alert just inco…

You can turn it off. Shouldn’t be too inconvenient if it’s important to you.

This entire thread is about the fact that in some case the carrier can override your decision and turn it back on.
Post reply on HN