Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Your Android carrier can remotely turn settings on

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 299 posts

Re: Tell HN: Your Android carrier can remotely turn settings on

#251

Post by siftrics »

kevin_thibedeau wrote: post #213
siftrics wrote: post #172

Earlier quoted context omitted.

Doesn't matter. As long as one is compromised, you're screwed. VPNs cannot break TLS, (unless you're dealing with the intelligence apparatus of a major power, which probably can break TLS) so they cannot introspect most of the content you send and receive anyways. What they can do, however, is see the domain name of the HTTP requests you send when setting up TLS. Chaining VPNs doesn't add security by any metric.

They don't have to break TLS. They just use an exploit to get access to one of the unencrypted sides of the link.

Good point.

Re: Tell HN: Your Android carrier can remotely turn settings on

#252

Post by qbasic_forever »

ActorNightly wrote: post #235
qbasic_forever wrote: post #168

Earlier quoted context omitted.

> Are you saying that a phone manufactured in 2022 can have its firmware remotely changed to record microphones? Yes, court records show the FBI has and continues to explicitly do this. Leaks from folks like Snowden show the NSA/CIA have done this too. > Specifically can your whatsapp/signal audio calls be recorded by FBI remotely in this manner? The baseband firmware is at a level 'below' the operating system of the…

No? Baseband firmware is the firmware for the modem. It has no relation to the SoC that runs the phone, unless there is some sort of exploit that allows it direct hardware/memory access. To listen to the mic or capture video, it has to interface with the ADC chip which is not directly connected to it. There may have been phones in the past that allowed DMA to the SoC from the baseband chip which hypothetically would…

Many phones have the peripherals including microphone connected or accessible to the baseband.

Re: Tell HN: Your Android carrier can remotely turn settings on

#253

Post by BizarroLand »

zer0x4d wrote: post #214
kornhole wrote: post #95

Earlier quoted context omitted.

I rotate burner SIM's. I never make calls with the SIM. Instead I use jmp.chat if I need to use OTA calls or SMS. I am in airplane mode 99% of the time and use WIFI instead of cellular. I never activate cellular near my home. I am always connected to VPN so that the traffic cannot be analyzed. My phone is anonymous without any identifiers. I think all this mitigates the baseband attacks, but tell me if I am missing s…

From my experience, people who do take this type of an exaggerated approach often end up exposing themselves more in ways that they don't even realize... How do you pay for jmp.chat? Do you trust their code to be bug-free and without possible exploits? Do they do regular security audits and code reviews? Do they have enough users and maintainers to be able to quickly detect and address security issues? Are you sure A…

I'm willing to bet that if you generate roughly the same data as your peers, you're invisible, but if you generate NO data at all, you become worthy of checking into, as either the algorithm has no ability to correctly record your data or you are working very hard to hide yourself from the system, possibly for nefarious reasons, and therefore need to be monitored just in case.

Squeaky wheels get the grease and squeaky nails get the hammer, but silence in a noisy forest is alarming.

Re: Tell HN: Your Android carrier can remotely turn settings on

#254

Post by intelVISA »

qbasic_forever wrote: post #51

Wait until your learn what a country or local government/police can do remotely to the baseband firmware of your phone with a court order... 10-20 years ago the FBI was regularly remotely programming firmware to listen in and record cell phone microphones to capture conversations of suspects. IIRC a mafia case hinged on data gathered in this way so it is not some abstract theoretical or crackpot theory ( https://www.…

Ridiculous, when has a blackbox co-processor with DMA to your entire device caused problems..?

Re: Tell HN: Your Android carrier can remotely turn settings on

#255

Post by plausibility »

blep_ wrote: post #242
RektBoy wrote: post #166

Earlier quoted context omitted.

So you're detected just by Wifi. Ok. Your phone is transmitting every network you saved. As OSINT you can pretty much fingerprint everybody with just that. And even since phones are using randomized MACs, there are methods to leak true MAC.

> Your phone is transmitting every network you saved. That's not how saved networks work, as far as I know. If you have a source saying otherwise, I would like to read it.

The WiFi spec has something called "active scanning" [0] for clients (as opposed to passive scanning, where the client listens for the periodic AP beacons). There's something called a "directed probe request" [1] that a client can send during active scanning which will contain the AP's SSID it's directed towards. Whether or not your particular device sends these direct probe requests is probably configurable and different per client. According to this [2] post, Android devices will sometimes send SSIDs in a scan, but not all of them and not always. Might be possible to find the logic here in the Android source code, I assume it's there somewhere.

[0]: https://www.wi-fi.org/knowledge-center/faq/what-are-passive-... [1]: https://dot11ap.wordpress.com/active-scanning-probes/ [2]: https://stackoverflow.com/questions/36264440/phone-doesnt-se...

Re: Tell HN: Your Android carrier can remotely turn settings on

#256

Post by Am4TIfIsER0ppos »

withinboredom wrote: post #249
Scoundreller wrote: post #222

Earlier quoted context omitted.

9-1-1 doesn’t usually call me at odd hours though.

Is that a thing? At least in this part of the EU, they never ever sound unless it’s a genuine emergency or the monthly test. I’m pretty sure the only reason they would go off is for a tsunami because they don’t even go off for tornados.

Apparently government alerts come though to americans at all times at full volume whenever a parent doesn't return a kid to the other one on time.

Re: Tell HN: Your Android carrier can remotely turn settings on

#257

Post by burntwater »

cvbrty wrote: post #115
kornhole wrote: post #95

Earlier quoted context omitted.

I rotate burner SIM's. I never make calls with the SIM. Instead I use jmp.chat if I need to use OTA calls or SMS. I am in airplane mode 99% of the time and use WIFI instead of cellular. I never activate cellular near my home. I am always connected to VPN so that the traffic cannot be analyzed. My phone is anonymous without any identifiers. I think all this mitigates the baseband attacks, but tell me if I am missing s…

Airplane mode doesn't shut off your baseband. It just sends it a message saying "go into airplane mode". The firmware is still running. It could still be receiving and sending data for all you know.

I can verify they do in fact receive (if not transmit) data - I worked an immersive art project that had 100 Samsung cell phones that were in airplane mode, and we found out the hard and noisy way that they were still able to receive emergency and AMBER alerts (U.S. alerts that notify of potential child abductions).

Re: Tell HN: Your Android carrier can remotely turn settings on

#258

Post by burntwater »

kornhole wrote: post #184
jvanderbot wrote: post #105

Earlier quoted context omitted.

Your location data. Tower associations can still happen with data "off", since there's plenty of "listen" components. All your home wifi connections are well Geo-located, thanks to other Android users picking up the ESSID as they walk / ride / drive past your house. Your shopping / outings? Forget it, fully known. VPNs hide the content of connections, at least from MITM / eavesdroppers, but server-side data scrapes a…

From https://grapheneos.org/faq : "Connecting to your carrier's network inherently depends on you identifying yourself to it and anyone able to obtain administrative access. Activating airplane mode will fully disable the cellular radio transmit and receive capabilities, which will prevent your phone from being reached from the cellular network and stop your carrier (and anyone impersonating them to you) from trackin…

I can promise that airplane mode does not fully disable the cellular radio, at least not on Samsung phones. Repeating a comment above: I can verify they do in fact receive data - I worked an immersive art project that had 100 Samsung cell phones that were in airplane mode, and we found out the hard and noisy way that they were still able to receive emergency and AMBER alerts (U.S. alerts that notify of potential child abductions).

Re: Tell HN: Your Android carrier can remotely turn settings on

#259

Post by TheHappyOddish »

qbasic_forever wrote: post #252
ActorNightly wrote: post #235

Earlier quoted context omitted.

No? Baseband firmware is the firmware for the modem. It has no relation to the SoC that runs the phone, unless there is some sort of exploit that allows it direct hardware/memory access. To listen to the mic or capture video, it has to interface with the ADC chip which is not directly connected to it. There may have been phones in the past that allowed DMA to the SoC from the baseband chip which hypothetically would…

Many phones have the peripherals including microphone connected or accessible to the baseband.

Can you provide some examples?

Re: Tell HN: Your Android carrier can remotely turn settings on

#260

Post by Scoundreller »

Am4TIfIsER0ppos wrote: post #256
withinboredom wrote: post #249

Earlier quoted context omitted.

Is that a thing? At least in this part of the EU, they never ever sound unless it’s a genuine emergency or the monthly test. I’m pretty sure the only reason they would go off is for a tsunami because they don’t even go off for tornados.

Apparently government alerts come though to americans at all times at full volume whenever a parent doesn't return a kid to the other one on time.

I think in the US you can set it to a lower-than-highest level, but in Canada, they send the kid-in-a-custody-dispute ones at the nuclear incident level (which was also sent out by mistake once).

Nothing sadder/funnier than seeing politicians defend their broken system as it increasingly did broken things.

Post reply on HN