> but what can be done to increase the recoverability of these expensive items? Don't buy or walk with expensive items around? Sounds like I am being snarky, but I am serious. In some cities or areas, it is not possible to have nice stuff around. Couldn't have a nice car in my old neighborhood. The old beater I had was scratched, hit and broken into multiple times. I didn't care too much, as it was already scratched…
> And since then realized that it didn't make any sense for me to buy these expensive toys if they can easily be lost, stolen, broken _if_ it causes me so much anguish when happens. So since then I've bought used, or lower end smart phones (last one is a Moto G for $170 from 3-4 years ago) so that if it gets, broken, stolen, lost I wouldn't be too upset about it, just inconvinienced some, and would just go and buy an…
I just use an old quality phone. I got a Nexus 5 in 2015 very cheap, and it works great to this day. Nexus 5X's price is on the way down, and there are plenty of other quality cheap phones to have, like the Chinese models. Some will need a new ROM, though, so one should check out CM devices page before buying.
In my experience, buying these phones offers a better experience than many of the flagship Samsungs which suffer from bloated, slow and unintuitive software.
Even if the answer is "nothing" it still makes sense they're selling on ebay—people don't know that they're buying a brick, and I'd bet that's extremely difficult to contest via ebay/paypal.
According to the link above, people know they are buying bricks.
I'm sure there are some folks trying to pass off locked iPhones as legit, but there are also people selling them "for parts" on Craigslist and I'm sure a load of other sites. I was just shopping for some test iPhones for work and there was one dude on Craigslist with a dozen or so new iPhones, all locked for like $80 "for parts".
As someone in a country with a serious mugging problem and having lost an iPhone already, one of the biggest security flaws I see is being able to power it off without providing any authentication. What is even the point of Find my Phone and all that if anyone can just instantly switch off all the tracking?? You can't even ring your own number after that, and even law enforcement cannot look up the cell tower logs to…
>and even law enforcement cannot look up the cell tower logs to see where it's been. I'm not so sure about that... I worked at a TV news station in a major city where police told us they could track cell phones that were turned off. IIRC, it came up during an interview after they apprehended a suspect in a big rape/murder case. The suspect's phone was off, but they were able to track him. They told us they didn't rea…
When the phone is off it is off. Same goes with flight mode. The NSA* or any other similar actor can load malware to your phone that would prevent it from being completely turned off, the police most likely cannot. The police does have a vested interest in making the public think that turning the phone off is pointless. *on older phones like late 90's very early 2000's there was enough power leaking from from the ant…
> When the phone is off it is off. Same goes with flight mode.
You're forgetting about the baseband. Modern phones have a secondary processor loaded with proprietary software that has a secondary battery soldered on. You can't turn that device off, and it has the ability to phone home. Even removing the battery won't help you.
When the phone is off it is off. Same goes with flight mode. The NSA* or any other similar actor can load malware to your phone that would prevent it from being completely turned off, the police most likely cannot. The police does have a vested interest in making the public think that turning the phone off is pointless. *on older phones like late 90's very early 2000's there was enough power leaking from from the ant…
> When the phone is off it is off. Same goes with flight mode. You're forgetting about the baseband. Modern phones have a secondary processor loaded with proprietary software that has a secondary battery soldered on. You can't turn that device off, and it has the ability to phone home. Even removing the battery won't help you.
No i didn't forget about the baseband, hence the NSA grade malware.
That said I haven't seen a single phone that when in airplane mode or off showed any signs of transmitting anything.
I've also done testing with RF fuzzing phones and nothing happened.
Other people did more analysis including power consumption monitoring etc. and there is no "on by default" home phone feature on basebands.
Can a base band be backdoored? sure, can the police do that most likely not, if anything the "quality" of commercial cellphone malware is fairly low most of it requires physical access to the phone or social engineering to install.
US Law enforcement relies mostly on cell provider and IMSI catcher based tracking, some departments might have access to commercial RAT products ala FinFisher but I have seen no evidence that anyone has access to baseband based exploits.
If anything it seems that even state actors do not have turn key solutions for remotely accessing the basebands of commercial mobile phones and often have to resort to compromising the supply chain to launch targeted attacks.
So yes the baseband is a CPU, it's probably considerably less secure than you would want, but saying that every baseband or even the top 10 most popular ones are or can be compromised at will doesn't pass the current smell test.
>and even law enforcement cannot look up the cell tower logs to see where it's been. I'm not so sure about that... I worked at a TV news station in a major city where police told us they could track cell phones that were turned off. IIRC, it came up during an interview after they apprehended a suspect in a big rape/murder case. The suspect's phone was off, but they were able to track him. They told us they didn't rea…
When you worked at that TV news station, were Blackberry phones prevalent? Blackberrys had two types of "off" -- one type periodically checks the network for texts and the other is an actual off. As far as I know phones today don't do this.
>and even law enforcement cannot look up the cell tower logs to see where it's been. I'm not so sure about that... I worked at a TV news station in a major city where police told us they could track cell phones that were turned off. IIRC, it came up during an interview after they apprehended a suspect in a big rape/murder case. The suspect's phone was off, but they were able to track him. They told us they didn't rea…
When the phone is off it is off. Same goes with flight mode. The NSA* or any other similar actor can load malware to your phone that would prevent it from being completely turned off, the police most likely cannot. The police does have a vested interest in making the public think that turning the phone off is pointless. *on older phones like late 90's very early 2000's there was enough power leaking from from the ant…
>The police does have a vested interest in making the public think that turning the phone off is pointless.
An interesting point, but...
If I were a criminal (I am not), and I were going to commit a crime (I am not), and I knew turning off my phone was pointless because the police can still track it, then I would just leave my phone at home, or give it to a friend.
Hey, author here. Happy to answer questions. There's also a big Twitter thread here https://twitter.com/FiloSottile/status/750273921568485377 To frame the post and the conversation, I am targeting a loose but not universal threat model. If threat of deadly force is higher up in your risk scale than shoulder-surfing, or Apple cooperation is a given, then you might want to make very different choices, but more importan…
I'd avoid using TouchID to unlock your phone for legal reasons. Once the phone is unlocked, you can use TouchID as the phone is already open and you would not gain/lose anything from using TouchID in that scenario. But until the courts rule that you cannot be compelled to TouchID unlock your phone like a PIN, I think that is the safer route to take for now.
I don't believe this. Those aftermarket lighty-uppy things work by sensing your phone's response burst, which is a much stronger signal, being driven by the phone's battery, and radiated from the very nearby antenna. I do believe that you can induce a signal in a powered-off phone that can be detected nearby (several feet), by virtue of the tuned antenna if nothing else. I'm skeptical of the claim that a normal arbit…
Believe what you want but at least read it through first. This isn't about powering a cell phone via wireless power and make it connect to a cell tower this is about inducing enough power into the cell phone's RF parts to make it modulate the signal sufficiently to be able to be picked up. Essentially this isn't that much different than the passive wifi or any other backscatter communication based system. I've seen t…
As I read it, that's a fine way to detect the presence of a cell phone. It might be able to discriminate between several models of cell phones. But it will not be able to identify a specific cell phone.