Live data from Hacker News

Securing a travel iPhone

blog.filippo.io

51–60 of 113 posts

Re: Securing a travel iPhone

#51

Earlier quoted context omitted.

What do you do with a iCould locked phone? It seems like a completely worthless device if it is locked.

Perfect for parts. New screens aren't cheap. Battery, camera modules, etc.

New screens are a lot cheaper than $200, which appears to be the price of iCloud locked phone.

Re: Securing a travel iPhone

#52

Earlier quoted context omitted.

>and even law enforcement cannot look up the cell tower logs to see where it's been. I'm not so sure about that... I worked at a TV news station in a major city where police told us they could track cell phones that were turned off. IIRC, it came up during an interview after they apprehended a suspect in a big rape/murder case. The suspect's phone was off, but they were able to track him. They told us they didn't rea…

When the phone is off it is off. Same goes with flight mode. The NSA* or any other similar actor can load malware to your phone that would prevent it from being completely turned off, the police most likely cannot. The police does have a vested interest in making the public think that turning the phone off is pointless. *on older phones like late 90's very early 2000's there was enough power leaking from from the ant…

on older phones like late 90's very early 2000's there was enough power leaking from from the antenna into the modem part that you could ping turned off phones remotely even if the battery was removed I've seen this in action

I don't see how that could work - even if power through the antenna did cause the phone to transmit something, more than the radio would have to be powered up to get the phone to return any kind of identifier. But I'm skeptical that any transmitter could be powered through the antenna like that.

I could believe that if you transmit enough power that some sort of oscillation would occur in the phone to return a signal that can be detected, but I don't see how you could determine what phone returned that signal.

Re: Securing a travel iPhone

#53

Earlier quoted context omitted.

>and even law enforcement cannot look up the cell tower logs to see where it's been. I'm not so sure about that... I worked at a TV news station in a major city where police told us they could track cell phones that were turned off. IIRC, it came up during an interview after they apprehended a suspect in a big rape/murder case. The suspect's phone was off, but they were able to track him. They told us they didn't rea…

When the phone is off it is off. Same goes with flight mode. The NSA* or any other similar actor can load malware to your phone that would prevent it from being completely turned off, the police most likely cannot. The police does have a vested interest in making the public think that turning the phone off is pointless. *on older phones like late 90's very early 2000's there was enough power leaking from from the ant…

Where was the power coming from if the battery was removed?

Only device that I'm aware that's able to do this is designed for this application.

Re: Securing a travel iPhone

#54

I think two security related changes could be made to iOS that would benefit many people. 1) PIN/TouchID locking of contacts, like you can do with notes. Don't allow messages and emails to and from the contact to be decrypted from the encrypted store without authenticating, like you can now do with notes. Would help with securing communications with legal counsel or other privileged parties from being captured. 2) A…

if I unlock my phone with a duress code or imprint my duress-coded fingerprint, reboot the phone (to look like it was a glitch-induced reboot) and present the PIN prompt again. Auto-wipe the phone if the duress code is given again this second time.

If such a feature was commonplace, criminals would know about it and wouldn't be happy when they saw you activate it with your middle finger (I mean, who wouldn't use their middle finger to activate such a function!?) after they just threatened you enough to make you attempt to unlock your phone.

Re: Securing a travel iPhone

#56

Earlier quoted context omitted.

>and even law enforcement cannot look up the cell tower logs to see where it's been. I'm not so sure about that... I worked at a TV news station in a major city where police told us they could track cell phones that were turned off. IIRC, it came up during an interview after they apprehended a suspect in a big rape/murder case. The suspect's phone was off, but they were able to track him. They told us they didn't rea…

When you worked at that TV news station, were Blackberry phones prevalent? Blackberrys had two types of "off" -- one type periodically checks the network for texts and the other is an actual off. As far as I know phones today don't do this.

This sounds like Android Doze, except Doze isn't (a) manual or (b) explained to the user as being off.

Re: Securing a travel iPhone

#57
post #29

Earlier quoted context omitted.

Going by eBay, a lot of people are still managing to sell stolen iPhones for $100-$300: http://www.ebay.com/sch/i.html?_nkw=icl0ud%20locked&LH_Compl...

What do you do with a iCould locked phone? It seems like a completely worthless device if it is locked.

parts phone for repair of others, perhaps?

Re: Securing a travel iPhone

#58

I think two security related changes could be made to iOS that would benefit many people. 1) PIN/TouchID locking of contacts, like you can do with notes. Don't allow messages and emails to and from the contact to be decrypted from the encrypted store without authenticating, like you can now do with notes. Would help with securing communications with legal counsel or other privileged parties from being captured. 2) A…

if I unlock my phone with a duress code or imprint my duress-coded fingerprint, reboot the phone (to look like it was a glitch-induced reboot) and present the PIN prompt again. Auto-wipe the phone if the duress code is given again this second time. If such a feature was commonplace, criminals would know about it and wouldn't be happy when they saw you activate it with your middle finger (I mean, who wouldn't use thei…

So you'd use the PIN. Then they get the metaphorical middle finger without seeing you use the real one.

Besides, no criminal cares about your phone being unlocked. They just want the phone. Well, I guess there are circumstances where a criminal wants information, but if they're the ones compelling you, you have other pressing issues that go beyond protecting information from unauthorized parties.

I'm talking about being compelled to unlock your phone by someone seeking information on it, either depriving you of due process or your civil liberties.

Re: Securing a travel iPhone

#59
post #44

I think two security related changes could be made to iOS that would benefit many people. 1) PIN/TouchID locking of contacts, like you can do with notes. Don't allow messages and emails to and from the contact to be decrypted from the encrypted store without authenticating, like you can now do with notes. Would help with securing communications with legal counsel or other privileged parties from being captured. 2) A…

Seems pretty niche for a luxury phone.

Ask anyone leaving or entering the US (or, indeed, any of several countries who may choose to screen phones upon entry/exit) if it's niche. I'd also submit that the iPhone is hardly a luxury item. I know that's a relative term - feature phones are luxury items in some regions of the world - but it's no yacht or Maserati or other such "luxury" item. Many, in fact, got their iPhone for free.

Re: Securing a travel iPhone

#60
post #25

Does any of this avoid the pitfall of a stingray device[1]? Is there any way to prevent 2G? [1] https://epic.org/foia/fbi/stingray/

You can mitigate a downgrade to 2G by using a VPN and a VOIP app like Whatsapp or Viber. Call quality would be abysmal on EDGE. I haven't seen any stock configuration of iOS that permits you to disable 2G.

Using 3G or LTE wouldn't help someone trying to evade a state or higher law enforcement organization, since all they need to do is use the cellular provider's Lawful Intercept capability somewhere in the packet core, such as the GGSN (for metadata) or at a tower's next IP router (for call content).

I think the purpose of this guide was primarily for border crossings. Filippo almost certainly gets hassled at borders, as many security professionals do. His comment about the Great Firewall was more likely about accessing an unrestricted internet, and less as an phone call anti-surveillance measure.

Post reply on HN