Spying on a smartphone remotely by the authorities: feasibility and operation • Hacker News Board

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#51

Post by qup » Sat, Jul 08, 2023, 4:54 PM UTC

joebiden2 wrote: post #44

qup wrote: post #2

Is there some kind of vote bot ring or something? This is a question with one short answer (at the time of my comment). It's hard to imagine why it made the top on its own merits.

No, it's not a bot ring. I assume you think that because I posted links to stackexchange quite a few times the last few months. Instead, I just skim over stackexchange.com as part of my feed and when there's something what I assume HN interests, I post it here. I don't care much about Karma. I posted this specific topic since I find it kind of hilarious that police should now lawfully be able to do something they are…

It seemed ridiculous to me that it could make the top of HN. It was a question with no discussion, yet.

If it had a discussion or even a good answer, it would have made perfect sense.

I assumed the goal would be stack overflow karma, as that's actually valuable.

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#52

Post by anonym29 » Sat, Jul 08, 2023, 4:58 PM UTC

mdp2021 wrote: post #48

rgrieselhuber wrote: post #32

Earlier quoted context omitted.

I’m always amazed at how many people don’t understand this. Hanlon’s Razor is just a way to sound smart while indulging in self-soothing biases.

The practice of assessing whether a tempting evaluation of "malice" can instead cover evidence of structural faults is part of the effort towards seeing things as they are. And keeps you away from paranoia.

Spoken like someone being paid to stigmatize rational skepticism.

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#53

Post by vhcr » Sat, Jul 08, 2023, 5:18 PM UTC

flangola7 wrote: post #50

bambax wrote: post #23

A little OT but strongly related: in France you can go to prison if you refuse to give your phone's password to the police (nothing like a "free country", I guess). Is there a way to set up a phone so that typing a "special" password puts the phone in an alternate state with different apps and content, etc. (and possibly erase the regular content)?

- I presume that's considered willful destruction of evidence and interfering with an official investigation, and worse charges than whatever you were probably facing (unless you really did fuck up and committed something bad). - Investigators are not going to be typing your password into the running original device, they're going to be trying it against an offline clone of the encrypted storage. All that will happen…

About point 2, modern devices have a secure enclave, which means that copying the encryption key is pretty much impossible.

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#54

Post by aSockPuppeteer » Sat, Jul 08, 2023, 5:19 PM UTC

euniceee3 wrote: post #13

anonym29 wrote: post #8

Earlier quoted context omitted.

Baseband backdoor. No need to target the OS or the primary CPU.

Any signs of these in the wild? I know it is a valid threat, but even in the cases that set this precedent there was a team of 140 and they did not leverage a baseband exploit.

I only have my experience with this so it requires you to have a phone that is off and without a battery or in a faraday(foil) shielded bag. Be in an area your government doesn’t want regular people to be (unacknowledged military base), turn on the phone.

I’ve done this many times so I know how long it takes to power on my phone to a “usable” state on my iphone and android.

I can’t take my phone inside where I work and they have mobile phone detectors which set off alarms if you bring one near any door or the inner facility fence. I put my phones inside a foil cooler bag with ice packs so they won’t overheat inside the car.

My guess is that there was a cell site simulator and it was setup to take over any phone which comes in the area. I got the same result with my android and iphone. Phone boots, weird hang where all indicators appear but I cannot interact with the phone. Wait at least one minute then I can use the phone.

I think this is why governments don’t like China developed 5G technology. It doesn’t have their default back doors.

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#55

Post by l8_to_catch_up » Sat, Jul 08, 2023, 5:35 PM UTC

I know for a fact that my electronics (including smartphone) is being monitored (including this post) by my government.

That probably doesn't surprise others. What isn't as known is that the government also intrudes into chats with other people on social media.

They don't just monitor, but actively interfere.

Edit: By the way, Nokias and other dumbphones (without physical off-switches -- the PinePhone has them, but good luck getting one) can also get their mic and GPS remotely activated. The partial solution is to get one with a removable battery and remove the battery whenever not in use.

iPhones can be hacked into through IMEI if you connect them, but are useful, encrypted offline-only PDAs if you don't install any app.

Also, if your electronics are being spied on by the government to this degree, chances are you are also being physically monitored.

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#56

Post by pessimizer » Sat, Jul 08, 2023, 5:38 PM UTC

scarface_74 wrote: post #24

anonym29 wrote: post #19

Earlier quoted context omitted.

This is why I'm an open source advocate. It's not that open source automatically makes software/firmware trustworthy, it's that closed source empirically guarantees the software/firmware can never be deemed trustworthy.

And yet there have been plenty of long standing security issues in Linux… Why would you think that a bunch of people volunteering their time would be more motivated to look for security issues and even those that are found, how many would be disclosed responsibly instead of being sold to places like Pegasus?

FOSS doesn't mean "volunteers." FOSS means that the source is viewable, legally usable, and that changes can be made and redistributed without permission from the author(s).

Volunteers can make closed source software, massive corporations and governments can make FOSS.

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#57

Post by kelipso » Sat, Jul 08, 2023, 5:46 PM UTC

GeekyBear wrote: post #6

Can the thing France just made legal be done? > French police should be able to spy on suspects by remotely activating the camera, microphone and GPS of their phones and other devices, lawmakers agreed late on Wednesday, July 5. https://www.lemonde.fr/en/france/article/2023/07/06/france-s... Why would anyone stir up the civil libertarians if the thing you are making legal is not possible?

More than likely what happened is they made it so it's easily doable by barely trained cops and then they secretly lobbied to make it legal.

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#58

Post by woozy3756 » Sat, Jul 08, 2023, 5:48 PM UTC

l8_to_catch_up wrote: post #55

I know for a fact that my electronics (including smartphone) is being monitored (including this post) by my government. That probably doesn't surprise others. What isn't as known is that the government also intrudes into chats with other people on social media. They don't just monitor, but actively interfere. Edit: By the way, Nokias and other dumbphones (without physical off-switches -- the PinePhone has them, but g…

This is always a dumb take I see by so many people. No goverment is monitoring all electronics and there is zero evidence that is the case. Sure companies collect a lot of user data and that user data could easily be given out with a request. Or maybe if you are a really big target they might use a zero day against you but they are never going to have all electronic devices connected to a botnet. You and many other people can test it right now, just run a basic traffic analyzer through your phone or PC.

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#59

Post by nickserv » Sat, Jul 08, 2023, 5:48 PM UTC

dvhh wrote: post #43

wombat-man wrote: post #26

Earlier quoted context omitted.

I would assume this is possible. If the gov wants to bad enough, I'd guess most OSes have a way to remotely control and observe. A state has resources to research 0days, bank them, and use them as needed. But probably not worth using unless it's for a high value target.

Considering most mobile phone operator would require you to install additional software to be able to use their network and that they would most likely cooperate with the authority if asked by the justice department.

That's not the case in France.

You can use any unlocked phone with any operator (assuming it can connect to EU cellular networks of course). Nothing in particular to do, just put in the SIM and it works.

I've never bought a phone from an operator, but I think it's also possible to switch operators without switching phones quite easily, no software update required.

Re: Spying on a smartphone remotely by the authorities: feasibility and operation

#60

Post by nickserv » Sat, Jul 08, 2023, 5:49 PM UTC

erealquestionis wrote: post #42

To me the real question is. Technical feasibility aside. Would the cell phone manufacturers (Apple, Samsung, Motorola, Nokia, Xiaomi, etc) say no when faced with the possibility of losing market share in France. Because of a law pushed through under the cover of security. Many a liberties have slipped under that blanket cover called security. I think they will put in this feature if it's not already there.

Wouldn't be surprised if it's just a toggle they activate when building the ROM...