Australian PM says to turn your phone off and on every night to improve cybersecurity

[thewayne]

This is, surprisingly, a good idea.

There are two types of malware threats with smartphones: persistent threats and non-persistent threats. A persistent threat is very hard to achieve on smartphones running the latest OS and fully-patched. Not impossible, but very hard. You would probably need to be a high-value individual, journalist or military or government official. Something like that. It's also expensive. The bad guys are looking at buying zero-day exploits - software flaws that are not yet known to the phone vendors and thus are unpatched - and those can cost a half million dollars or more to buy.

Non-persistent threats are different. These are newish and a common form is what's known as a zero-click exploit, achieved through sending someone a message in email or text that looks normal but actually is a web page with embedded code that activates an exploit.

There's a big difference between the two. The non-persistent threats vanish after a reboot! Power-cycle the phone, or turn it off for five minutes to let the memory completely drain, and it's gone like it had never been there. And these threats are much more widely seen than persistent threats: visit the wrong web site, or have your email address compromised to certain people, and you're targeted.

And all you need to do is power off your phone for five minutes, and no more threat.

https://www.theguardian.com/technology/2023/jun/23/turn-your-phone-off-every-night-for-five-minutes-australian-pm-tells-residents

This Stackexchange post goes a little deeper into how this works for purging non-persistent threats:
https://security.stackexchange.com/questions/270904/does-rebooting-a-phone-daily-increase-your-phones-security

Now, there's an interesting twist that some non-persistent threats use to keep you from rebooting, and you're going to say something like 'Damn, these people are evil!' when you read this: fake power-off screens and dialogs! It looks like your phone is powering down and rebooting, but it's just screens and dialog presented by the program because it intercepted the power off key signal.

https://yro.slashdot.org/story/23/06/26/1237237/turn-your-phone-off-every-night-for-five-minutes-australian-pm-tells-residents

Comments

[dewline]

I manage to remember to turn off my cellphone almost every night. That should take care of some of the threat traffic.

[acelightning73]

I occasionally get unintelligible text messages with links in them. Since my phone is just a plain flip phone, I can't click on links. And I once tried to manually copy the link onto my computer, and when I clicked it was "no such URL exists".

But if i turn off my phone and leave it off, if someone tries to reach me I won't know. If the local village text alerts tell me my street is going to be torn up for sewer repairs, or warn me of "coastal street flooding" during a storm - the car I used to have was destroyed by street flooding getting into the engine. I think this house no longer has a land line.

Maybe you can thwart the fake dialog by removing your phone's battery for a few seconds.

[thewayne]

For phones with removable batteries such as yours, that would be the same result.

[disneydream06]

I turn my phone off almost every night. At least the nights I am working.
Gets turned off and thrown in the backpack. lol.......
Hugs, Jon

[blue_green_dream]

Damn. I use my phone to play music or meditations to help me fall asleep. Hopefully a general 5 minute power down each night before I go to bed will achieve the same effects.

[thewayne]

Or do it when you shower in the morning or whatever.

[kaishin108]

Yes those people are evil!

But what a great idea!
I am going to start doing that.

[silveradept]

That's certainly an interesting habit to try and build. It's certainly possible to do, but it's not something I like doing, because it takes slightly longer than forever to boot back up, and some of the notifications that I would like to keep don't persist through a reboot, so it's extra tricky to find a time during the day to do that power-down and to not lose any important notifications.