Lessons:
- The Good Guys (Cops, Feds, Sheriff of Nottingham, etc) Are not ”Your
plasticgovernment pal who’s fun to be with!” - Don’t install anything you don’t trust totally.
- If you lose sight of your phone at a check stop, border crossing, customs or maybe even at work or a party. Wipe it. (if at a government check-point consider getting a new phone anyways.
- Maybe even practice frequent wipe procedures anyways. And hope its not in the firmware. (more power to those who take the time to wipe and reload firmware and hope it’s not baked into the device itself)
- It’s not paranoia if they really are after you
/ravingmad
And these uninstalls are initiated how?
Remember when hackers who worked with the cops were called “white hats?” I think we need some new terminology.
Thought. Get servicing software for the phones, or tap directly the flash, and get the ability to completely image the filesystem. Essentially what common forensic tools for the phones do. A phone that’s switched off will not be able to detect that something “wrong” is happening on it. (This is bad for “our” security but good against “their” secret tools. Few coins don’t have two sides (and the often neglected “edge case”).) Possibly leverage the access to the flash via JTAG, if accessible.
After the border checkpoints and other such suspicious encounters, image the phone; if possible, before as well. (Ideally, get into habit of imaging the phone before travel; helps also as a backup for the more common problems - failure, theft or loss.) Compare the images.
For those with access to the phone internals - phone hackers, servicemen, etc., the task can be finding the phone types that are most friendly to such form of auditing. For example where the JTAG pads are accessible. Or where the NAND flash can be connected to in a comfortable(ish) way. The NAND chips are often conforming to the ONFI standard, with defined pinout and behavior. Then the issue will be the filesystem layout on the chip, which block is which. Which is already solved in the problematics of data rescue/recovery from NAND devices.
If you are an activist or other “undesirable”, you can as well volunteer as a “canary”; get a hacktivist/hacker crew behind you that will look after your equipment’s “health” and watch for planted parasites, and if found, disclose and dissect them. (Beware though - these tech crews can also be infiltrated. It is always a bet; everything you do can “kill” you, including doing nothing. Maybe have one crew on each side of the border, so they would effectively watch each other too? Balance here the benefits and risks of having more than one person accessing the hardware.) So a group, perhaps even just loosely affiliated, where some play the role of attracting the deployment of secret tools (which can be played by just doing what they want to do anyway), and the others watch for these tools. Essentially a “honeypot” tactics. I suggest the codename “POOHBEAR”.
Let’s make the world where the adversary never knows if they are dealing with a powerless victim or a well-prepared honeypot, where every piece of someone else’s hardware they interact with has the potential to disclose that they are up to no good. Will not be an absolute cure but has a good chance of making such surveillance attempts more risky and more costly.
I suggest “blue hats”.
As a person who regularly attempts to keep a limited set of tracks on the intertubes, at this point I’m just about ready to throw in the towel. I’ve got a security app on my phone and I don’t download stuff from unknown sources. I keep my bluetooth radio off unless it’s in use (by me, which is not often) and I rarely use the wifi (unless I’m at home).
It seems our modern communications devices offer so many avenues to being hacked that it’s almost not worth the effort to stave off the inevitable. Which is really shitty, governments-around-the-world, because you’re setting yourselves up for some serious failure.
“Hacking Team insists that its tools are only sold to “democratic” police forces”
Democratic police forces don’t NEED those hacking tools. If you find a democratic police force, please let me know, I’m considering a move.
Scab hackers?
Wouldn’t it be illegal for police to install malware?
Did that ever stop them?
This topic was automatically closed after 5 days. New replies are no longer allowed.
