Always strive to learn something useful. --Sophocles

This is, surprisingly, a good idea.

There are two types of malware threats with smartphones: persistent threats and non-persistent threats. A persistent threat is very hard to achieve on smartphones running the latest OS and fully-patched. Not impossible, but very hard. You would probably need to be a high-value individual, journalist or military or government official. Something like that. It's also expensive. The bad guys are looking at buying zero-day exploits - software flaws that are not yet known to the phone vendors and thus are unpatched - and those can cost a half million dollars or more to buy.

Non-persistent threats are different. These are newish and a common form is what's known as a zero-click exploit, achieved through sending someone a message in email or text that looks normal but actually is a web page with embedded code that activates an exploit.

There's a big difference between the two. The non-persistent threats vanish after a reboot! Power-cycle the phone, or turn it off for five minutes to let the memory completely drain, and it's gone like it had never been there. And these threats are much more widely seen than persistent threats: visit the wrong web site, or have your email address compromised to certain people, and you're targeted.

And all you need to do is power off your phone for five minutes, and no more threat.

https://www.theguardian.com/technology/2023/jun/23/turn-your-phone-off-every-night-for-five-minutes-australian-pm-tells-residents

This Stackexchange post goes a little deeper into how this works for purging non-persistent threats:
https://security.stackexchange.com/questions/270904/does-rebooting-a-phone-daily-increase-your-phones-security

Now, there's an interesting twist that some non-persistent threats use to keep you from rebooting, and you're going to say something like 'Damn, these people are evil!' when you read this: fake power-off screens and dialogs! It looks like your phone is powering down and rebooting, but it's just screens and dialog presented by the program because it intercepted the power off key signal.

https://yro.slashdot.org/story/23/06/26/1237237/turn-your-phone-off-every-night-for-five-minutes-australian-pm-tells-residents

This is mind-bogglingly bad. "Samsung shipped an estimated 100 million smartphones with botched encryption, including models ranging from the 2017 Galaxy S8 on up to last year’s Galaxy S21."

FOUR YEARS they blew it?! And Samsung was supposed to be the flagship of Droid phones?! There were two major flaws, one was fixed after it was revealed, then the second, dealing with initialization vectors, which was also there from the beginning, wasn't fixed until another paper was published.

Sorry, I'll happily stick with my lovely walled-garden iPhone. But to each their own. It may have its own issues, but I think their attitude to security is better than the Android paradigm.

As a commenter on Slashdot points out, "... Apple just issued a Security Update in September, 2021 that patches iOS 12, covering models clear back to lhe iPhone 5s." Instead, Google just obsoleted the Pixel 3, released three years ago.

'Build things fast and break shit' indeed. Great paradigm when you have your life's history in a device in your pocket. And it's not secure.

https://threatpost.com/samsung-shattered-encryption-on-100m-phones/178606/

https://mobile.slashdot.org/story/22/02/24/222207/samsung-shattered-encryption-on-100-million-phones#comments

Saw this on Slashdot this week:

Phone Passwords Protected By 5th Amendment, Says Federal Court
Posted by timothy on Thursday September 24, 2015 @03:28PM from the good-luck-arguing-this-at-the-border dept.

Ars Technica reports that a Federal court in Pennsylvania ruled Wednesday that the Fifth Amendment protects from compelled disclosure the passwords that two insider-trading suspects used on their mobile phones. In this case,

"the SEC is investigating two former Capital One data analysts who allegedly used insider information associated with their jobs to trade stocks—in this case, a $150,000 investment allegedly turned into $2.8 million. Regulators suspect the mobile devices are holding evidence of insider trading and demanded that the two turn over their passcodes."

However, ruled the court, "Since the passcodes to Defendants' work-issued smartphones are not corporate records, the act of producing their personal passcodes is testimonial in nature and Defendants properly invoke their fifth Amendment privilege."

I expect this will probably end up being appealed to the SCOTUS, still, it's a promising thing for now.

http://yro.slashdot.org/story/15/09/24/2128243/phone-passwords-protected-by-5th-amendment-says-federal-court

The Blackhat security conference is coming up very soon, and with it, advanced information about all sorts of wonderful problems. In this case, two new ways to compromise smartphones.

First up, a report on a tool that's built in to all smartphones: Androids, Blackberrys, iPhones sold by Sprint. They haven't tested Windows phones yet. It's a management tool that allows the cell providers to update firmware in the phone through over the air updates, and the security implementation isn't very good.

Granted, this is a team of advanced security researchers, but they were able to get in and totally pwn the phones they were working with. They've notified the maker of the management tool and the cell companies, so a fix should be distributed over the next few months that will make this more secure. Also, no evidence of this being exploited in the wild.

http://www.wired.com/2014/07/hackers-can-control-your-phone-using-a-tool-thats-already-built-into-it/


Next up, an iPhone, if connected to a compromised Windows PC, can potentially be turned in to a botnet! This is interesting stuff as it has falsely been assumed that Apple had pretty tight security on its iPhones, which is broadly true, but they're also kinda slow pushing updates. I assume that the exploit would also be effective against iPads that also have cellular radios built-in.

http://www.wired.com/2014/08/yes-hackers-could-build-an-iphone-botnetthanks-to-windows/

I replaced my iPhone a couple of weeks ago, the light sensor had failed and it no longer knew when you were talking on the phone and moved the phone away from your face to use the keyboard. Inconvenient, fortunately I had the extended warranty and the only hassle was driving to El Paso (and having a good Italian dinner and seeing Wolverine) and the time involved in re-syncing it.

One problem came up: we could no longer sync our laptops to my phone.

After the restore was done, the phone configuration was pretty much identical to what it was before, including the phone's WiFi/blue tooth hotspot name. I couldn't figure out why my wife couldn't sync, and started mentally troubleshooting. When you have weird network connectivity problems and you know the wiring is good and you don't think something has changed, you frequently start with flushing caches. In this case, I told my wife's laptop to forget my phone, then I reconnected it. At that point it was fine and had no problems pairing with it.

The issue is something that I wrote about recently: MAC addresses. Even though the name of the phone was the same as far as the laptop that I was trying to connect to it was concerned, the underlying MAC address was different. By telling the laptop to forget my phone, it cleared the cache that maintained that information. When I re-paired it, it saw a phone name that it thought it had never seen before along with a MAC address that it had never seen before, and dutifully added them back in to its cache when I supplied the correct password.

SO. If you ever buy a new smartphone or have to replace one and start having problems pairing your other devices to it, go in to your device's network settings and tell it to forget your original phone, that might be all that you need to do to take care of the problem.

Yesterday, a thread appeared on Slashdot talking that a private company's recycle bins, a dozen all over London, were electronically sniffing you as you walked by. If you had a smart phone, it grabbed your WiFi's MAC address and logged your movement relative to the can. The long-term purpose was targeted advertising since it is difficult, if not impossible, to change this number.

In two test runs, four days in May and eight in June, "...over four million events were captured, with over 530,000 unique devices captured. Further testing is taking place at sites including Liverpool Street Station." The 'event' would be four million people walking by one of their bins, the 'unique devices captured' would be the 8% of those people with smart phones in their pocket. The company, Recycle Now, has around a hundred such recycling bins all over London that also incorporate digital ad boards. They were working towards a Minority Report advertising ecosystem.

According to the firm's CEO, "...As long as we don't add a name and home address, it's legal." He also told Wired UK that "We collect anonymised and aggregated MAC data -- we don't track individuals or individual MACs. The ORBs aggregate all footfall around a pod for three minutes and send back one annonymised aggregated report from each site so the idea that we are tracking individuals again is more style than substance," says Memari in an email. "There are applications in the future which Quartz focused on but during the trial period we are only looking at anonymised and aggregated MAC data."

He adds, "as some of the technology we will be testing will be on the boundaries of what is regulated and discussed it is our intention to discuss it publicly and especially collaborate with privacy groups like EFF to make sure we lead the charge on [adding necessary protections] as we are with the implementation of the technology."

http://www.wired.co.uk/news/archive/2013-08/09/recycling-bins-are-watching-you

The company has a web site that allows you to enter the MAC address of your phone to opt-out of the tracking, which I would think the site would just take and aggregate the data for future use since in the initial version the bins aggregate the data before sending it back to the mother server, which means the individual MAC addresses are not there. They might push an ignore list out to the bins, but I doubt that.

Well, the City of London Corporation has told Renew Now to stop running the program.

http://www.techweekeurope.co.uk/news/recycling-bin-firm-denies-tracking-london-phones-with-wi-fi-124461


FYI, a MAC address is a unique identifier built-in to the networking part of your equipment. Your smart phone or tablet has one if it can access the internet, any network card or a computer with a built-in network card has one, which is pretty much all computers made today. So does your DVR, your networked printer, your BluRay player, etc. It's a two-part number consisting of six hexadecimal digits, normally each digit is represented with a colon separator, like this: 01:23:45:67:89:ab. The first three digits identify the manufacturer, the last three are unique to the card. This gives a total number of unique values of 247 x 10 to the 14th. A unique MAC address is essential to network routing, that is, getting the packets that your computer sends to a specific web site returned back to you and not to someone else. In Windows and Mac PCs, you cannot change this number. In Linux machines, even though the number is burned in to a read-only memory chip, it can be changed if you want to tinker at that level. I don't know if you can change it on an Android smart phones whose operating system is based on Linux.

In this case, Renew Now claimed that they were just gathering the manufacturer code of the MAC address, so it wasn't tracking you, it was tracking who made your smart phone. Marketers like to make assumptions about people based on branding, for example, some web sites look to see if you're accessing them from a Mac, and if so, they charge you a higher price because they know you'll pay more money for some types of computer hardware. It's a very broad brush that they're painting with, and I think it's fallacious when it comes to smart phones. If someone drives a Ferrari, yes, you can assume they're wealthy. Smart phones, not so much. I was making less than $30k annually when my wife bought me my iPhone, that ain't wealthy.


The only way to truly block tracking like this is to either turn off the WiFi on your phone when you're out in public, or turn off your phone altogether. How many people could or would actually do that? It's funny to think about 20 years ago when almost no one owned a cell phone.

They're applying strong crypto and logging to the voice stack, not much detail as to whether the data on the phone is encrypted which I think would be fairly trivial. They're also discussion about Germany encrypting other smart phone OS's. It'd be cool if the software were released to the public, but that'd totally screw law enforcement and CALEA.

http://www.h-online.com/security/news/item/NSA-German-government-using-Android-for-secure-phones-1466294.html