Live data from Hacker News

What happens when your phone is spying on you

today.ucsd.edu

131–140 of 169 posts

Re: What happens when your phone is spying on you

#131
post #76

Earlier quoted context omitted.

Apple has “Advanced Data Protection” that you can enable This was built after the NSO group hacks to lock down the device to be resilient to nation state attacks. It limits some of the attack vectors you’re taking about (with a tradeoff of also limiting some features). Apple also enabled true e2ee in the cloud where only you retain the keys.

> Apple also enabled true e2ee in the cloud where only you retain the keys. Is there a procedure to realistically verify that your communications are e2e and not e2mitm2e ?

Canary content for your threat-modeled attacker, then monitor for the data being acted upon, e.g. traffic to non-public URL.

Re: What happens when your phone is spying on you

#132
post #88

Earlier quoted context omitted.

You should not buy him anything. You should cut him out of your life entirely. This is an egregious trust violation. I’d forgive a teenager of such thoughtlessness but if they’re an adult then they’re going to abuse you in other ways. They don’t care about you.

Good points. Maybe time to say goodbye.

I had something like this happen. My friend is a massive prankster, and I let it escalate to the point, where they weren't just pranks.

One day he came in with a bunch of goons and they seized every piece of IT equipment I had, including the fridge with the large screen. On the way in they shot the dog and tossed a smoke grenade into the crib, which was fortunately empty since baby was at my baby mama's house. Since my child support was based on my IT salary, I owed her $12500 monthly in child support. Court does not care that I'm unemployed now, and they're seizing custody.

Lesson learned, do not let these pranks escalate unanswered. It can make you lose your dog, your kid, and/or make you a deadbeat dad.

Be courageous, and say goodbye to your potentially horrendous friend while you can.

Re: What happens when your phone is spying on you

#133
post #54

Earlier quoted context omitted.

because they could be viewing all their private communication/media on their device and that causes a lot of anxiety cause they won't confirm or deny if they have access.

Ugh, yeah, if this was not someone I know, the pictures, yikes !

what pictures?

Re: What happens when your phone is spying on you

#134
post #92

Ctrl-F "Graphene". Nobody has mentioned GrapheneOS. GrapheneOS and a Pixel phone are about as private and secure as you can get whilst maintaining good usability of a smartphone in 2023. Highly recommended, no affiliation.

Why Pixel phone, given it's Google

Re: What happens when your phone is spying on you

#135

Earlier quoted context omitted.

Yes, there is no API on iOS that allows most of the things listed in the article that apps can use even it tried to use non documented APIs. > After installation, they covertly record the victim’s device activities — including any text messages, emails, photos, or voice calls — and allow abusers to remotely review this information through a web portal And the “malware” that was installed was because people were using…

That's not really sandboxing, just a limitation of what apps can do on iPhone. And I belive it has changed recently. Doesn't really matter how the malware get there. The important part is that it waltzed right past Apples quality control.

Didn’t I just say that? Both App Store review processes are far from perfect. But even when app developers were inadvertently delivering malware to the App Store because of third party download of XCode, the blast radius was much more limited because Apple had sense enough to know that it might be a bad idea to let random third party apps intercept your text messages and phone calls

Re: What happens when your phone is spying on you

#136

Earlier quoted context omitted.

What feudal tax? The SaaS system that provides servicing and support for the point of sales system, merchant accounts, online ordering, designs web pages, and optional apps, optional hardware for pagers when someone’s table is ready or a text messaging notification system? Or are you referring to the app in the Apple Store that optionally supports Apple Pay (not in app purchasing) where the merchant is charged the st…

Hopefully white label SaaS will grow their marketshare - any estimates on annual revenue for that sector? Revenue for the major US delivery apps is currently in the billions, with feudal taxes.

The difference is that GrubHub has high fixed costs and high variable costs for drivers. A SaaS model has fixed costs for developers, sales, support etc. But marginal costs to add new customers is minimal.

Revenue may be in the billions. But they are all losing money. The smaller companies can easily be “lifestyle businesses” that hire in low cost of living areas and go after “enterprise devs” who are very happy to make $135k - $165K and don’t expect “equity”.

I spent most of my entire career as an “enterprise dev” working with SaaS companies in the bill payment space, field services, and health care.

I’m in $BigTech now working in the cloud consulting department working with a lot of the same types of companies.

Re: What happens when your phone is spying on you

#137
post #120
post #108

TLDR; purchase an device that pairs with your phone, follow a hunch that it's doing a lot more then what it advertises it does. A week ago I purchased a bluetooth device that takes some measurements. You require an Android or iOS application. The first thing the iOS app did was request permission for your location. Immediate fired up MITMproxy [1] running in transparent `--mode wireguard` and installed it's certifica…

Wow amazing write up, start a consultancy and start charging to audit the privacy of apps, imagine getting paid to do this on every App Store update of Tik Tok and the like for agencies or companies auditing their apps, etc. You are really talented, now get paid for it or open source some automated tools for getting the trail to see behind the curtain for these apps that force you to enable permissions to use them.

Hey thanks! There are quite a few static based automated tools that can help as a first run such as https://sisik.eu/apk-tool

Perhaps there are opportunities for developing easy to use dynamic analysis tools for the general population.

Re: What happens when your phone is spying on you

#138

Earlier quoted context omitted.

The GDPR goes a little farther than that though, because it makes consent revokable even after the fact, and disallows consent as a requirement to access a service, and some privacy advocates seem to think that's still not enough.

The ability to revoke consent is an essential part of consent, in my view. > some privacy advocates seem to think that's still not enough. I am one of them. I think the GDPR is inadequate in many ways, but it's certainly a huge improvement over the nothing that existed prior, and it's much better than anything we have here in the US. But the things I think are inadequate about the GDPR still revolve around consent. I…

I guess it depends on how you view personal data.

To me, it's just like any other data, licensing it to someone is no different than licensing the source code to something you wrote, if it's revokable the whole concept doesn't make sense, and you don't really own it so much as it's held in trust by the state.

But it seems like some people see it as something really personal and special that inherently shouldn't be treated like any other commercial asset, (Possibly because they've got more interesting lives than mine!) and there doesn't seem to be any compromise that doesn't make someone unhappy.

Revocability does make a lot of sense and I can think of a lot of very good use cases for that right, but also some ways it impairs P2P.

I think the only real solution is for private tech to achieve real parity with nonprivate tech, at least as much as is possible (Tech is almost never private compared to no tech at all, it can always be hacked), but I have no idea how that would be possible.

Technically it could happen, socially FOSS devs would rather work on minimalist stuff.

Re: What happens when your phone is spying on you

#139
A recent, peculiar experience:

After replacing a damaged Moto with a (presumably) identical one, several months later, before leaving for work, I invoke my trusty old VPN for its maiden journey on my new device. But it won't connect. Because 'Why?', I'm not certain, but the permission dialogue for initial use wasn't appearing, while the VPN was requesting that I grant it permission... but I couldn't manually do so, because...

I then examine my network settings, and a queer surprise rears its absence -- The VPN setting/option is simply missing. Not there. AWOL.

I tuck in to hasty research (what's watching?) and find that I'm not alone. But I've insufficient time to troubleshoot. I go to work.

After work I resume, though find that the VPN now works and the options under network settings now includes 'VPN'.

Automagically fixed. Although I had rebooted the device several times that morning, it had not rebooted since - I know this do to examining Running Services, some of which I manually stop after every reboot, and were still inactive.

I connect to ADB and peruse the logs. Not knowing exactly where to look, I find nothing relevant.

I

Re: What happens when your phone is spying on you

#140
post #5

The title needs to be updated to say “Android”

There are surreptitious ways to achieving covert monitoring on iOS. To say this applies to Android only is simply untrue. You can do things via MDM on iOS for example and install spyware “monitoring” apps/set OS level permissions that are invisible to non tech saavy users. Also if you have access to the device and the iCloud password/device pin (e.g. abusive partner scenario, etc.) then non tech saavy people don’t st…

Thank you for saying this. I agree with OP concerning the article. I work in finance and if people knew just how clueless even we are when it comes to devices being compromised they would never use an app or website for banking again. Even if we can tell it wasn’t the account holder it’s extremely hard to do much more than that. No one knows what to tell the poor person either. I take a hit and get in trouble for my hour call giving instructions but rather that than see someone suffer.

Also bad for people with stalkers/abusive partners. I don’t know why everyone says it’s so hard to compromise a device/number (either platform) when it’s not. Or maybe I’m just in a position where I see it more often and overall it is hard? My day job minimum of 2 a day, confirmed not counting otherwise. Volunteer work, its not as frequent but also don’t deal with same volume of people. It is creepier though and no one knows what to do. One case working w a big agency as it involves a high dollar amount and is ongoing and THEY can’t seem to give advice that works either. Person at this point went to a flip phone.

Reset the phone? Didn’t work. Abandon all accounts, reset phone, cool. Didn’t work. K now all of the above and dump the number, and/or replace entire phone, latter usually works but not always. Sorry this is long here is my point in commenting. I wish someone with knowledge would take the time to do a solid write up for people with zero tech knowledge not just how to protect themselves but how to determine if/how they are compromised, log proof if possible (court etc) get rid of it and move forward safely, or as safe as possible for both android and IOS, a comprehensive write up. They would be a super hero. Literally help countless.

It would help people like the 83 y/o grandma who got cleaned out THREE TIMES and cried to me begging for help on how to stop it, the women whose abusive exes show up at shelters because they have accessed sms or location despite the women using precautions given to them as the precautions are not up to date with what’s possible. Forgive me, it gets to me some of the most vulnerable people are dealing with this at an alarming rate and the people they are told to get help from genuinely don’t know what to do, while I know some it’s not enough to truly be of help say if someone has a well versed ex determined to hunt them down. These people could care less about the Gov knowing all, they just want to be safe.

Post reply on HN