Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Your Android carrier can remotely turn settings on

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 299 posts

Re: Tell HN: Your Android carrier can remotely turn settings on

#231

Post by torben-friis »

zer0x4d wrote: post #214
kornhole wrote: post #95

Earlier quoted context omitted.

I rotate burner SIM's. I never make calls with the SIM. Instead I use jmp.chat if I need to use OTA calls or SMS. I am in airplane mode 99% of the time and use WIFI instead of cellular. I never activate cellular near my home. I am always connected to VPN so that the traffic cannot be analyzed. My phone is anonymous without any identifiers. I think all this mitigates the baseband attacks, but tell me if I am missing s…

From my experience, people who do take this type of an exaggerated approach often end up exposing themselves more in ways that they don't even realize... How do you pay for jmp.chat? Do you trust their code to be bug-free and without possible exploits? Do they do regular security audits and code reviews? Do they have enough users and maintainers to be able to quickly detect and address security issues? Are you sure A…

All that plus the fact that, under general surveillance, behaving in a way that is consistent with avoiding tracking at great inconvenience is a great way to get flagged.

Re: Tell HN: Your Android carrier can remotely turn settings on

#232

Post by throwaway0x7E6 »

bjt2n3904 wrote: post #56
msingh_5 wrote: post #23

These are emergency broadcast alerts. Different countries have different laws on these - and in some countries you might not even be able to disable them. Just because its listed under "Apps & notifications"/"Wireless emergency alerts", it doesn't mean they are "user settings". Its not necessarily the local "carrier" that turned the settings on, its more that connecting to a cell tower in a particular jurisdiction ca…

Just because another country has a law does not mean my phone should disregard what I told it to do. This absolutely is a user setting. How far we've fallen from sharing the DeCSS flag, to arguing that users shouldn't have control over their devices, and governments and carriers should.

my brother in Christ, where do you think you are?

Re: Tell HN: Your Android carrier can remotely turn settings on

#233

Post by matheusmoreira »

withinboredom wrote: post #206
matheusmoreira wrote: post #170

Earlier quoted context omitted.

It doesn't really matter what the laws say. When I tell my computer to do something, I expect it to be done, no questions asked. If I tell it to violate a law, I expect that law to be violated. I have free will and the computer must obey that will, not impose somebody else's will on me.

You’re using a utility and you must accept the terms to use that utility. There’s probably some verbiage in your carrier agreement about it. You can’t disable 911/112 just because you don’t like it either.

I don't care what the carrier agreement says. If they want to send me the warnings, fine. My phone is perfectly equipped to receive them and will happily display them should I choose to allow it. What's unacceptable to me is forcing my phone to do anything. It doesn't matter to me if there's some piece of paper saying I can't turn them off, I will turn them off and I will resist them if they try to force it on.

Re: Tell HN: Your Android carrier can remotely turn settings on

#234

Post by ghostoftesla »

kornhole wrote: post #95
qbasic_forever wrote: post #51

Wait until your learn what a country or local government/police can do remotely to the baseband firmware of your phone with a court order... 10-20 years ago the FBI was regularly remotely programming firmware to listen in and record cell phone microphones to capture conversations of suspects. IIRC a mafia case hinged on data gathered in this way so it is not some abstract theoretical or crackpot theory ( https://www.…

I rotate burner SIM's. I never make calls with the SIM. Instead I use jmp.chat if I need to use OTA calls or SMS. I am in airplane mode 99% of the time and use WIFI instead of cellular. I never activate cellular near my home. I am always connected to VPN so that the traffic cannot be analyzed. My phone is anonymous without any identifiers. I think all this mitigates the baseband attacks, but tell me if I am missing s…

From my understanding, when installing an alternate OS (ie lineage) you can dive deeper into the partitioning of the device's os and see all components/folders. Under `vendor` you can choose not to install firmware for different kinds of stuff (wifi, baseband).

Re: Tell HN: Your Android carrier can remotely turn settings on

#235

Post by ActorNightly »

qbasic_forever wrote: post #168
abdullahkhalids wrote: post #137

Earlier quoted context omitted.

Are you saying that a phone manufactured in 2022 can have its firmware remotely changed to record microphones? Specifically can your whatsapp/signal audio calls be recorded by FBI remotely in this manner?

> Are you saying that a phone manufactured in 2022 can have its firmware remotely changed to record microphones? Yes, court records show the FBI has and continues to explicitly do this. Leaks from folks like Snowden show the NSA/CIA have done this too. > Specifically can your whatsapp/signal audio calls be recorded by FBI remotely in this manner? The baseband firmware is at a level 'below' the operating system of the…

No?

Baseband firmware is the firmware for the modem. It has no relation to the SoC that runs the phone, unless there is some sort of exploit that allows it direct hardware/memory access. To listen to the mic or capture video, it has to interface with the ADC chip which is not directly connected to it.

There may have been phones in the past that allowed DMA to the SoC from the baseband chip which hypothetically would have allowed a properly crafted exploit on a per app basis, but its not longer the case, as pretty evident by the FBI asking Apple to unlock the phones (if they could access the memory from baseband, they would not need to)

Re: Tell HN: Your Android carrier can remotely turn settings on

#236

Post by ActorNightly »

RussianCow wrote: post #191
EVa5I7bHFq9mnYK wrote: post #188

Earlier quoted context omitted.

Criminals the security services are looking for are not that smart. If they were, they wouldn't have been criminals in the first place.

> If they were, they wouldn't have been criminals in the first place. What does intelligence have to do with whether someone is a criminal? There are dumb criminals and smart criminals; I'm not sure what the correlation here is.

Excluding ideological motivators, if you are technically competent to pull off a cybercrime and escape unseen, you are technically competent enough to work at a tech company making 300k+ a year while only doing about 10 hours of actual work per week.

Treating this just like investments, over your lifetime, its a no brainer on which is the better path to take.

Re: Tell HN: Your Android carrier can remotely turn settings on

#237

Post by ActorNightly »

matheusmoreira wrote: post #174
qbasic_forever wrote: post #51

Wait until your learn what a country or local government/police can do remotely to the baseband firmware of your phone with a court order... 10-20 years ago the FBI was regularly remotely programming firmware to listen in and record cell phone microphones to capture conversations of suspects. IIRC a mafia case hinged on data gathered in this way so it is not some abstract theoretical or crackpot theory ( https://www.…

Are attacks like these still possible? I've read here on HN that hardware makers are isolating the baseband processor as much as possible to prevent attacks like these. Surely there are countermeasures?

Most modern phones have signed firmware for everything, so the FBI would have to go to the manufacturer and court order them to hand over the signing key. Or take advantage of a leaked key.

Re: Tell HN: Your Android carrier can remotely turn settings on

#238

Post by kornhole »

zer0x4d wrote: post #214
kornhole wrote: post #95

Earlier quoted context omitted.

I rotate burner SIM's. I never make calls with the SIM. Instead I use jmp.chat if I need to use OTA calls or SMS. I am in airplane mode 99% of the time and use WIFI instead of cellular. I never activate cellular near my home. I am always connected to VPN so that the traffic cannot be analyzed. My phone is anonymous without any identifiers. I think all this mitigates the baseband attacks, but tell me if I am missing s…

From my experience, people who do take this type of an exaggerated approach often end up exposing themselves more in ways that they don't even realize... How do you pay for jmp.chat? Do you trust their code to be bug-free and without possible exploits? Do they do regular security audits and code reviews? Do they have enough users and maintainers to be able to quickly detect and address security issues? Are you sure A…

jmp.chat can be paid for with a virtual card and not tied to any ID. However I have it associated to my real ID in this case as it is the number everybody knows.

I use the word 'mitigate' not 'solve' since closed source baseband modems are a problem. Cellular traffic is off in airplane mode, but the baseband could be exploited if someone wanted to find me AND knew which IMEI to target. Because the IMEI has never been associated to me, that is a challenge.

I run my own VPN and share it with a few other people.

Re: Tell HN: Your Android carrier can remotely turn settings on

#239

Post by matheusmoreira »

ActorNightly wrote: post #237
matheusmoreira wrote: post #174

Earlier quoted context omitted.

Are attacks like these still possible? I've read here on HN that hardware makers are isolating the baseband processor as much as possible to prevent attacks like these. Surely there are countermeasures?

Most modern phones have signed firmware for everything, so the FBI would have to go to the manufacturer and court order them to hand over the signing key. Or take advantage of a leaked key.

What I meant was chips are increasingly being isolated at the hardware level so that they cannot access other peripherals directly. This would make them resistant to compromised firmware attacks.

People are discussing that in this thread:

https://news.ycombinator.com/item?id=33958252

It looks like the implementation isn't perfect yet but it's a start.

Re: Tell HN: Your Android carrier can remotely turn settings on

#240

Post by [deleted] »

Sirened wrote: post #203
kelnos wrote: post #98

Earlier quoted context omitted.

I don't believe this is entirely true anymore. Yes, years ago, the baseband processor (and firmware) had full DMA capabilities to the RAM ostensibly managed by the OS, and could do nefarious things if it wanted to. But I believe nowadays the baseband is a bit more isolated, and communication with it is mediated by the CPU and OS. Some manufacturers likely still implement the "old" architecture, though.

You would hope but to a large extent SMMUs are still not meaningfully deployed in consumer smartphones. Even when they do exist, the bounding enforced upon them are so expansive that it's essentially pointless. For example, one device I found had an SMMU in front of its BT/WiFi chip but, unfortunately, the driver on the AP side configured the SMMU to have access to all of system memory. Baffling.

[deleted]
Post reply on HN