Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Your Android carrier can remotely turn settings on

news.ycombinator.com

Post reply on HN
Print view View original

271–280 of 299 posts

Re: Tell HN: Your Android carrier can remotely turn settings on

#271

Post by sweetbitter »

was_a_dev wrote: post #210
kornhole wrote: post #95

Earlier quoted context omitted.

I rotate burner SIM's. I never make calls with the SIM. Instead I use jmp.chat if I need to use OTA calls or SMS. I am in airplane mode 99% of the time and use WIFI instead of cellular. I never activate cellular near my home. I am always connected to VPN so that the traffic cannot be analyzed. My phone is anonymous without any identifiers. I think all this mitigates the baseband attacks, but tell me if I am missing s…

> if I am missing something It's the day you miss something that your effort was pointless. Even if your solution is always secure, it only takes one slip up to ruin everything Any threat as large as youre trying to protect against, if interested in you, can just wait for you to make a mistake.

> can just wait for you to make a mistake.

Anyhow, if one slip-up is enough, you're doing it wrong. Imagine you were a mad scientist testing out a jetpack- you are confident yes? But I imagine you would feel more confident with a bunch of nets, and a trampoline underneath that, and a lightning rod in case of a storm, and a requirement that you hold down multiple buttons at once to play with the controls, etc.

That is, if you are serious you will put in multiple safety nets at every layer of the stack so that "one slip" is not enough.

You like to talk to people, but you know that a long-term pseudonym is the gravest danger of them all.

You like virtualization, but you keep some crucial data and keys(treams) on a un-networked machine.

You like anonymizing networks, but you know the caveats of traffic tunneling and didn't connect from your home router.

You connect to a randomly-chosen wireless AP, but you know that just in case your MAC-spoofing fails or you get pwned or something, you are glad that you bought the device with cash and never tied its characteristics to your identity.

You are glad that the only transceiver connected to the device is an external wireless dongle so that when you are done, you don't accidentally connect with your device from home.

You are glad you waited for an overcast day so that you could thwart spy satellites that use visible/infrared light, and that you connected to the AP from afar to thwart cameras.

The list goes on. The guy whose face you see plastered in the news? Yeah, that guy thought his experimental jetpack was the shit. And it was- until it wasn't.

Re: Tell HN: Your Android carrier can remotely turn settings on

#272

Post by zzo38computer »

burntwater wrote: post #257
cvbrty wrote: post #115

Earlier quoted context omitted.

Airplane mode doesn't shut off your baseband. It just sends it a message saying "go into airplane mode". The firmware is still running. It could still be receiving and sending data for all you know.

I can verify they do in fact receive (if not transmit) data - I worked an immersive art project that had 100 Samsung cell phones that were in airplane mode, and we found out the hard and noisy way that they were still able to receive emergency and AMBER alerts (U.S. alerts that notify of potential child abductions).

They need to add possibility to disactivate the hardware components, in order to save battery power (in addition to disabling the features you mention).

Re: Tell HN: Your Android carrier can remotely turn settings on

#273

Post by themoonisachees »

brailsafe wrote: post #268
ActorNightly wrote: post #236

Earlier quoted context omitted.

Excluding ideological motivators, if you are technically competent to pull off a cybercrime and escape unseen, you are technically competent enough to work at a tech company making 300k+ a year while only doing about 10 hours of actual work per week. Treating this just like investments, over your lifetime, its a no brainer on which is the better path to take.

And a smart enough person would also know that there's a long chain of caveats to this specious claim, significant enough that being a criminal and getting away with it is much more compelling.

None of the caveats include hypothetically being thrown in prison though. Being a criminal and getting away with it is significantly harder than phoning in your job as part of a capitalist machine

Re: Tell HN: Your Android carrier can remotely turn settings on

#274

Post by MengerSponge »

aussieshibe wrote: post #161
cutler wrote: post #150

Earlier quoted context omitted.

What on earth does this have to do with the parent post? Please enlighten me.

It's a monologue from The Office which uses similarly extremely short sentence structure as seen in the GGP comment. It's also possible GP is referencing GGPs arguably paranoid position on phones, relating it to similar paranoias held by Dwight (the character who delivers the monologue). https://youtu.be/PlIzKaGBeHk

Nailed it :)

Re: Tell HN: Your Android carrier can remotely turn settings on

#275

Post by MengerSponge »

greggarious wrote: post #164
MengerSponge wrote: post #119

Earlier quoted context omitted.

I break into Tiffany's at midnight. Do I go for the vault? No, I go for the chandelier. It's priceless. As I'm taking it down, a woman catches me. She tells me to stop. It's her father's business. She's Tiffany. I say no. We make love all night. In the morning, the cops come and I escape in one of their uniforms. I tell her to meet me in Mexico, but I go to Canada. I don't trust her. Besides, I like the cold. Thirty…

[flagged]

But your essay isn't funny. Fortunately, as they say, practice makes perfect!

Re: Tell HN: Your Android carrier can remotely turn settings on

#276

Post by zer0x4d »

kornhole wrote: post #238
zer0x4d wrote: post #214

Earlier quoted context omitted.

From my experience, people who do take this type of an exaggerated approach often end up exposing themselves more in ways that they don't even realize... How do you pay for jmp.chat? Do you trust their code to be bug-free and without possible exploits? Do they do regular security audits and code reviews? Do they have enough users and maintainers to be able to quickly detect and address security issues? Are you sure A…

jmp.chat can be paid for with a virtual card and not tied to any ID. However I have it associated to my real ID in this case as it is the number everybody knows. I use the word 'mitigate' not 'solve' since closed source baseband modems are a problem. Cellular traffic is off in airplane mode, but the baseband could be exploited if someone wanted to find me AND knew which IMEI to target. Because the IMEI has never been…

>I run my own VPN and share it with a few other people.

How confident are you in your VPN server configuration skills? Gaining access through mis-configured self-hosted boxes is the easiest attack vector usually as most people who self-host aren't experts in the software they are using leading to leaks. Besides that, do you keep a list of packages installed on your box, open ports, etc? How about security patches and regular updates as well as auditing access logs to ensure no one gained access to your box?

Re: Tell HN: Your Android carrier can remotely turn settings on

#277

Post by petodo »

blep_ wrote: post #247
petodo wrote: post #20

Earlier quoted context omitted.

It doesn't really matter under what setting it's placed in the OS, but "emergency alerts" or CB is clearly network setting/service, so it's not surprising carrier can control status of this setting/service and override what you set in the phone.

Not... really? It's not the setting for whether the phone receives alerts; it's the setting for what the UI does in response (make a bunch of noise vs accept silently). The UI is very much on the user-controlled side of the phone.

they try to avoid people accidentally switching it off, it's much less harm if you hear it than vice versa

Re: Tell HN: Your Android carrier can remotely turn settings on

#278

Post by lgats »

kornhole wrote: post #246
Retric wrote: post #226

Earlier quoted context omitted.

It’s all about your threat model. Suppose you wanted to find someone that aways turned on their phone on at ~8:15 AM and found someone that always turned their phone off at ~8:10 AM within 15 miles. How difficult would you say it was to make this connection?

Nobody is looking for me. I don't have any regular commute either. I just make sure not to use cellular at my house since that would narrow the owner of the SIM down to one of the people living in this house.

Do you own a car with OnStar or SeriusXm ?

Re: Tell HN: Your Android carrier can remotely turn settings on

#279

Post by n3dm »

lgats wrote: post #278
kornhole wrote: post #246

Earlier quoted context omitted.

Nobody is looking for me. I don't have any regular commute either. I just make sure not to use cellular at my house since that would narrow the owner of the SIM down to one of the people living in this house.

Do you own a car with OnStar or SeriusXm ?

I have O*. How do I disable it?

Re: Tell HN: Your Android carrier can remotely turn settings on

#280

Post by ratg13 »

TreeRingCounter wrote: post #84
ddalex wrote: post #59

Earlier quoted context omitted.

Phone (call, data) interception is mandated in a lot of countries (i.e. operators have to do it is presented with a judicial mandate) against the wishes of user too. This setting is in the same vein, in order to allow authority controlled public broadcasts.

Governments hijacking infrastructure is not remotely the same as governments hijacking personal devices.

They are not hijacking your personal device.

Your personal device is letting you know your carrier does not provide an option for this setting.

Post reply on HN