Edward Snowden's New Research Aims to Keep Smartphones from Betraying Owners

https://theintercept.com/2016/07/21/edward-snowdens-new-research-aims-to-keep-smartphones-from-betraying-their-owners/

by secfirstmd • 10 years ago

296 150 10 years ago

This does seem feasible for the specific use case of a protected phone for "clandestine" meetings.

My initial thought was they'd have to redesign it for every phone, but that's not necessarily the case. If eaves dropping is such a concern for you, I would think you would be okay with not having the latest gen phone. Or having an old one just for these sorts cases.

I suppose the concern then shifts to whether this device is easily subverted, or whether it's easy to determine if it has been subverted.

DamnYuppie• 10 years ago

Why does not wanting to have someone eaves drop on me mean I have to use inferior technology? I find that to be offense in the extreme. Everyone should be concerned about or more ideally not have to worry about people accessing their phone without their knowledge.

semi-extrinsic3• 10 years ago

No disrespect to Snowden and Bunnie, but it seems to me that a much simpler solution giving you a much higher OPSEC is to buy a smartphone with a removable battery. No battery, no radios are on.

And if you are truly paranoid, it's simple to disassemble the phone and look for/remove any backup batteries. I know, I had to pull the backup battery from my wife's Moto G after it fell in the sink.

ashitlerferad• 10 years ago

No battery leads to a useless mobile computer.

pyre• 10 years ago

Depends on your use-case. If you only want to stop communications during a specified period of time (e.g.) during a "secret" conversation, then this is useful. If you have any apps installed that might be polling the 'net for information (e.g. checking the weather), then this is useless in the general case of "the phone is on my desk next to me while I'm working."

panax• 10 years ago

There is also the convenience factor. I do remove my battery frequently from my phone but it is too easy to just leave it on. People will generally not want to hassle with it if they don't have to.If security is easier and requires less effort then it lowers the cost and will be favored more often and it will protect more people.

There are also many times that people have been unhappy because I have my phone off and unable to reach me. There are also other times you want to be available.

Unfortunately, if your phone is owned then they can just exfiltrate the data when normal data transfer occurs. The data will still need to be stored for transmission later though.

With the iphone, you also need to monitor Bluetooth and WiFi in addition to cellular activity. Hopefully they will also monitor these.

nfjstjstns3• 10 years ago

Actually, regardless of whether or not smartphones have a removable battery, there's always a small second battery connected to the baseband for emergency purposes. I've confirmed this firsthand by taking apart several models, and you make out small coin cells on most online disassembly documentation as well.

The one in my old Atrix was a good 250mAh.

walterbell• 10 years ago

What would the baseband transmit in an emergency and how would it know that there was an emergency, if the phone itself had lost power?

When a phone is off or out of power, is the baseband periodically pinging cell towers?

semi-extrinsic3• 10 years ago

Sure, I said as much in the comment above, and I also know and have tested that at least one common smartphone works just fine with this battery physically removed.

agumonkey3• 10 years ago

Always ? from the few (~10) cellphones I disassembled I remember nothing that looked like a cell.

Also how do you trigger an emergency call ? manufacturer embeds a special firmware so you don't have to boot the main OS and only use energy for the call ?

DyslexicAtheist• 10 years ago

then store your phone in a Faraday cage like you have in your kitchen (probably)

secfirstmd3• 10 years ago

I've heard about this emergency capability for years, e.g earthquake, tsunami etc...But has anyone ever heard of it actually being activated for real?

dmitrygr4• 10 years ago

citation please

(good luck, as this is false)

jeffbush2• 10 years ago

I don't mean to call you out, but I'm fairly positive this is wrong. I ran the baseband software team at Apple and worked on the first two generations of iPhones. I'm intimately familiar with that hardware having done reworks by hand myself on the first prototypes and being in all schematic reviews. They definitely didn't have secondary batteries connected to them. While this may exist on some new models of phone, I've never heard of it.

This doesn't even make much sense to me. Assuming you're talking about emergency calls, the application processor is necessary for dialing. You'd need to power the entire phone including the screen to make an emergency call.

awqrre3• 10 years ago

Wouldn't it be easier to use some kind of case or pocket [0] that acts as a Faraday cage?

0: http://www.popsci.com/sites/popsci.com/files/styles/large_1x...

milesokeefe4• 10 years ago

That seems safer, with Snowden's device it has to detect transmission after it begins to occur in order to trigger shutdown or alert the user, so it's going to leak some amount of RF even if little. A properly constructed Faraday cage shouldn't though.

misnome2• 10 years ago

So it records and transmits later, at opportunity.

rl3• 10 years ago

Better yet, install a small custom switch that enables you to physically disconnect power from the battery without actually having to remove it from the phone.

Much less conspicuous if you're in public under physical surveillance, and provides options for phones with non-removable batteries assuming the right modifications are made.

superuser2• 10 years ago

+1. If you are trying to detect surveillance by considering RF emissions but only some of the time, a sane attacker will simply have the bug record what it needs and transmit it in a burst later when you will not find RF activity suspicious.

You need to prevent the thing from recording you in the first place.

Iv2• 10 years ago

A metal case will block any unwanted RF emission. That said, the article states that the goal is to make it possible for users to still use their smartphones as camera, GPS, or whatever tool you need on it, while being safe.

As someone who knows a bit about computer security I find it mindblowing that journalists would go into war zones and expect to be stealthy with their smartphones in their pockets but they apparently are willing to risk their lives for their iPhones, so the best we can do is offer tools to mitigate the risks.

jokoon2• 10 years ago

Snowden explained that the CMOS button battery is enough to send a transponder signal that can be heard by a drone. He said the only way to shut it down is to put it in a freezer.

I mean, I'm a programmer, I am not an expert on sigint stuff, but I don't think it's very hard to innovate in intelligence gathering technologies.

jakobdabo• 10 years ago

When I place my smartphone on the desk near the computer speakers any time it is going to ring the speakers start making a funny noise a second or two before the ringing starts. So I presume it must be possible to DIY a cheap sensor for GSM signal detection based on a little speaker.

retox• 10 years ago

This is a silly question but I'd like to understand if it's possible for a human to sense those same signals. So many times I have had a sensation that my phone will ring and then moments later it does.

Probably confirmation bias or maybe I'm subconsciously hearing the interference in speakers and taking the hint from there. It doesn't happen every time and I don't receive a lot of calls.

HN seems a decent place to settle it once and for all.

kcorbitt• 10 years ago

It seems very unlikely that you would be able to sense those frequencies, except indirectly through something like audible speaker interference.

However, this would be pretty easy to test! Just have a friend call you at random times throughout a 2-hour interval or something, and record every time you think the phone is about to ring, and every time it actually does. If there's a close enough correlation between the two, that's fairly persuasive evidence.

spraak• 10 years ago

Very hand wavy of me, but I'd say there is a way that it's true you can sense it. We may not yet know how you can, though. An example that I like to think of is of infrasound. People can't hear it, but there are some who sense when it's moving through them.

dingaling• 10 years ago

People have long reported experiencing radio reception through tooth fillings, usually in the ham and FM bands from 1 to around 100 MHz.

I can imagine cell frequencies would be even more likely due to smaller antennae for the higher frequency.

kosmic_k• 10 years ago

I don't believe that humans can really sense it on their own. But there was/is a group of "body hackers" who would implant a small shard of a magnet into their finger tip to allow them to feel electromagnetic fields.

reitanqild• 10 years ago

At some point during some school work I felt I could sense when someone tried to call me on my parents landline. More then half my life has passed since then and I have never felt close to replicating so I guess most likely my subconsciousness figured out some patterns in who called when.

Another observation though: I worked professionally with radar systems for a while and IIRC one of the oldtimers mentioned one isolated case where a person had been able to tell when a certain radar was transmitting in his sector. (Radars often only transmit in sectors turning away from the population.)

But, to be honest, I haven't heard about it anywhere else and most people who claim to sense that kind of radiation either refuses to undergo blind studies or fail them so if you treat this as anything but an old wives tale you have to do your research :-)

elif• 10 years ago

Scientifically: There are people from disparate countries who believe that they suffer from a condition called `EM hypersensitivity`, and are convinced they must live in remote areas away from radios to avoid sickness or headaches. In the handful of published studies that exist, evidence points to an inability of these people to distinguish between exposure and non-exposure in a laboratory setting.

Anecdotally: I can definitely "feel" large AC transmission lines. They do have an audible buzz, however the "feeling" sensation seems distinct to me. My experience is from hiking the Appalachian Trail, which spends days outside of cell phone range, and then crosses regional transmission lines periodically.

So if that observation is not pure illusion or auditory synesthesia (perhaps a fully deaf person can assist here?), it would seem to follow that there is a mechanism to sense EM radiation, and it is simply a matter of whether the perceptive threshold has been met, which would obviously vary from person to person and even from instant to instant.

kleskjr• 10 years ago

Theoretically it might be possible. There are some studies on the effects of electric fields onto single neurons. If an external field can influence the firing of neurons in some way, probably one can train to read these signals.

http://journal.frontiersin.org/article/10.3389/fncel.2014.00...

I have no idea on what field intensities are sufficient to influence the neurons.

iaskwhy• 10 years ago

I'm curious about animals other than humans. Once I was waiting for a call by a window, there was a generous spider on the other side. As I'm very afraid of spiders, I was looking at it while waiting for that call to arrive, it was very calm, barely moving. As soon as the call showed on the screen, silent mode on, no sound or vibration, the spider got completely mad, moving around like crazy so I moved away and the spider stopped moving again. I did experiment moving closer and away repeatedly with the same result. So maybe spiders are sensitive to that frequency?

agumonkey3• 10 years ago

These are GSM/3G signals. I never hear anything when transmitting wifi or bluetooth.

Zigurd• 10 years ago

You would need a GSM phone, not just a speaker. Your phone's radio can interfere with electronics like land-line phones. My Nexus 5, on a GSM/LTE network, will cause my Polycom speakerphone to make "dit-dit-dit" noises occasionally (when the network interrogates devices in range) if it is with a few inches of the speakerphone. I suspect people who think they can sense a call coming in are hearing the network looking for their phone in order to offer a call, and not sensing radio waves.

secfirstmd3• 10 years ago

That was an old IRA technique to detect certain types of signals nearby. Cheap headphones and a modified radio of sorts. Looking for interference.

13of40• 10 years ago

I have no idea how this happened, but about twenty years ago, I had an internal PC modem that started randomly speaking to me about fire, brimstone, salvation, etc. Thought I was going off my rocker, until I figured out that it was picking up an AM religious station and playing it through the onboard speaker. My best guess is that somewhere on the circuit board there was a diode and a capacitor just in the right spot and it was using the phone line as an antenna.

roflchoppa• 10 years ago

its probably signal interference because i get it too. " beep-beep-beep ; beep-beep-beep ; beep-beep-beep ; beeeeeeeeee" then call or text comes through

Qantourisc• 10 years ago

Use old style opamps for this btw, they are more susceptible to this, like LM741 NE553, LM883, ... If you are ok with putting your cellphone on the detection box, all you need is an opamp driving a small speaker, and the opamp requires no input. Or you could just hook an antenna on it. If you want I could try, but I have more exiting things to do :)

vincnetas• 10 years ago

Mobile flashing stickers powered by RF from your phone (no batteries) : https://www.alibaba.com/product-detail/GSM-mobile-led-flashi...

[EDIT] http://electronics.stackexchange.com/questions/38838/powerin...

greggman2• 10 years ago

Those stickers are cool. Japan had various dangly things to attach to your feature phone that worked similarly for years. Smartphones generally have no place to attach anything so they seem to have mostly disappeared.

rosser• 10 years ago

How does this address masking "bad" transmissions behind "good" ones? Instead, the spooks will just make sure not to upload your chat logs until you start Tindering the next time, or something.

mzs• 10 years ago

Interestingly in the paper they address this somewhat for alternatives they discarded. Since they are proposing an introspection engine it should also drown-out the mic and cover the cameras. But then you still have the shock sensor that could record steps. I'm really inclined that a true power switch with introspection engine to verify things are really off is a better approach.

ISL• 10 years ago

Why go through test points rather than directly detecting RF emission?

In addition to the required hardware modification, a sufficiently nefarious attacker might be able to spoof test points. RF power detection, on the other hand, can't lie. If it's going to communicate, the phone must transmit.

An RF-detection tool would be as easy as a phone case (and could double as a backup battery for the phone). It'd be far simpler and easier to adopt than directly hacking on the hardware.

Edit: My concerns are partially addressed in the actual paper: https://www.pubpub.org/pub/direct-radio-introspection

milesokeefe4• 10 years ago

One nefarious method malware could use to get data off the device without RF would be to play sub 20kHz audio through the speakers, assuming there was a device with a microphone near by that's able to receive the signal, and of course that the speakers can play a frequency that low.

Along the same lines, but only successful if the user isn't looking, would be to use the flashlight LED.

Or maybe very short low power vibrations, if the receiving microphone is on the same surface.

All of these require somewhat particular situations, but fun to think about in any case :)

cobbzilla• 10 years ago

yup, there are lots of non-EMF ways to get data off a device. iirc it's easier to transmit data with higher (inaudible) frequencies than lower ones.

brian-armstrong4• 10 years ago

If anyone would like to see this in action, try this out on your laptop https://quiet.github.io/quiet-js/

</plug>

eon1• 10 years ago

It would be around/above 20KHz, not below; our hearing is theoretically ~20Hz-20KHz (though almost noone starts out actually able to hear that high and the high frequencies decrease with age). AD/DA converters will also apply a low pass filter below Nyquist to prevent aliasing - assuming they are operating at 44.1/48KHz (and even if they are spec'd higher there's no real reason they'd always be running the higher rate), Nyquist is about 21KHz, though filtering lower than that is beneficial as it allows them to employ a less steep slope on (very steep filter slopes can create artifacting of their own). The small speaker set up in your average phone would be quite capable of outputting 18-19KHz, which is still outside most people's hearing range, and unless you're particularly attuned to high frequency audio you might not notice or work out what it was anyway.

tripzilch4• 10 years ago

One nefarious method malware could use to get data off the device without RF would be to play sub 20kHz audio through the speakers, assuming there was a device with a microphone near by that's able to receive the signal, and of course that the speakers can play a frequency that low.

did you mean to say "sub 20 Hz"? or rather the ultrasound between 20kHz and 22kHz?

it's a bit ambiguous cause both 20 Hz and kHz are lower and upper ranges of human hearing, respectively.

if you meant the lower, then no. mobile speakers already almost entirely lack power in the musical bass frequencies (50-150Hz roughly), let alone the infrasonic ones. if the speaker would even have a response to such a signal, it's not going to have a lot of range. .. a sub-20Hz audio signal has a wavelength of more than 17 metres in air, I'm not sure if that's physically impossible, but I'm having a hard time imagining that tiny tweeter to manage such a signal (my knowledge is mostly with digital signal processing, not entirely sure about what speakers can do, Bose has done some pretty amazing room-shaking bass with very clever tiny speakers, that seemed impossible to me as well, has to be some trick there). And then, doing it without getting harmonics in the audible spectrum! :)

Vexs• 10 years ago

In addition to the other things people have mentioned, the NSA appears to be fond of retroreflective bugs that don't transmit anything, but reflect incoming signals with modulation.

digi_owl3• 10 years ago

Why go through test points rather than directly detecting RF emission?

I'm guessing it comes down to making sure the signal is from the phone and not from an external source.

All modern wireless protocols have multiple devices share a single frequency range. Thus just listening for traffic on those ranges with an antenna will produce false positives.

venomsnake• 10 years ago

Isn't that device a Faraday cage?

And if you are in war zone - using a phone with removable battery is absolutely mandatory IMO.

milesokeefe4• 10 years ago

As nfjstjstns notes, very often there is "a small second battery connected to the baseband for emergency purposes".

dmitrygr4• 10 years ago

This is entirely false for most modern phones

walrus012• 10 years ago

The problem that got Colvin killed is at the RF/layer 1 layer in the OSI stack... Iridium and Inmarsat phones operate in the L and S bands (1.2 to 2.0 GHz) which is not difficult to do radio frequency direction finding on, if the Tx source remains active. Particularly easy if you have access to Russian military grade DF equipment. The protocol layers and crypto are moot if you are radiating and have a determined DF adversary.

sievebrain• 10 years ago

Yeah, I'm not sure if the article starting that way was meant to suggest this device would have saved Colvin or if it was just meant as a vague illustration. Because as it points out, journalists do actually use their phones for calling people and receiving calls quite a lot, so the utility of a phone that is forced offline - for a journalist - would seem to be very low. Why have it powered at all, in that case? Couldn't you just buy a tablet that doesn't have any long-range radios to begin with? WiFi signals don't travel far.

walrus012• 10 years ago

A typical handheld satellite phone doesn't stay powered up and on net much, if it's in a backpack or being carried around... You need to be standing with a clear sky view to use one. But if you're a journalist in a war zone sleeping in the same location 3 or 4 days in a row and making one 5-minute phone call a day, or sending iridium SMS a few times daily from the same lat/long, that is enoigh to DF you.

dewster10• 10 years ago

Probably just showing my ignorance, but there is a processor running in the phone, and it is connected to the various chips on the board, and you can run your own apps that could query the chips directly? If the OS disallows this, I'd be hacking the OS, rather than the hardware.

How did we get to this point, where our personal computing devices are completely out of our basic control? We live in bizarro world.

dcposch• 10 years ago

They explain in the article: your phone may be compromised, and an app running on the main processor has no reliable way to tell.

That's why they're using a completely separate piece of hardware.

dewster10• 10 years ago

OK, I agree, we should wash our technical hands and let some poor schmuck in exile clean up all of our technical security messes.

digi_owl3• 10 years ago

In this day and age, no computer is just a CPU. Each radio effectively have their own CPU and accompanying firmware.

The phone OS is as much in control of that radio (at best) as your laptop is in control of the ISP router.

dewster10• 10 years ago

Surely the main processor could query the sub processors for relevant info like current state? if this isn't possible then the HW/SW world of phones makes no sense.

jokoon2• 10 years ago

How did we get to this point

The point happened when those devices were being common enough so that there is a good enough opportunity to use it as an intelligence and information gathering tool.

Not saying it's right or wrong, but until around 2010, smartphones were not mainstream enough for the government to be interested. If you're a government and you have a lot of resources, things get done pretty quickly, especially in sensitive matters like this one.

heartsucker3• 10 years ago

You can buy unlocked Android phones and run whatever custom Android ROM you want (Cyanogenmod, Paranoid Android, etc.). The situation isn't as dire as you make it seem.

dewster10• 10 years ago

I'm curious as to why Snowden didn't simply recommend everyone go this route instead of bending over backwards trying to fix the iPhone?

jonknee2• 10 years ago

And that does nothing about the baseband which is responsible for all the radio communication. The baseband of your unlocked Android phone is still closed source.

SixSigma• 10 years ago

Go for you life, build your own phone

https://www.sparkfun.com/products/9533

calebm• 10 years ago

I wonder if the use of the word "betraying" in the title is a subtle jab at Snowden.

akshayn• 10 years ago

Unlikely - the founding editor of The Intercept is Glenn Greenwald, one of the journalists who published the original Snowden stories.

pluma• 10 years ago

Quite the opposite. The idea is obviously that security agencies are betraying the people.

phones• 10 years ago

Of interest perhaps, here is a full source code of an Android phone software and its baseband firmware:

https://github.com/mtker/MT6735_Longcheer

Actually there is some .o files in the baseband but easy to pull apart in IDA. Each one relates to a single .c and there are export symbols.

frockwearer• 10 years ago

This same sort of approach has been used by terrorists in the past.

misnome2• 10 years ago

So?

zanny• 10 years ago

You know, if we had source access and hardware blueprints to these devices and actually owned them, this wouldn't be a problem.

But trying to solve an obvious problem (proprietary basebands, phones, and hardware) with bandage solutions kicks the problem down the road. We need to liberate the hardware eventually for liberty's sake.

jmiserez• 10 years ago

If you can't trust your phone, how would you ensure that it doesn't just record everything (audio, etc.) when in airplane mode and uploads it somewhere later, once you disable airplane mode.

Seems to me that removing the battery would be safer.

pigeons• 10 years ago

The Neo900 is designed to detect unauthorized radio transmission from the modem and power the modem down in a fraction of a second, and notify you. It seems to be the only device that will have that capability.

https://neo900.org/

http://neo900.org/stuff/cccamp15/ccc2015talk/neo900-wpwrak_C...

smartbit4• 10 years ago

The poor mans way of stopping your iDevice from transmitting, is by putting it in DFU mode [0]. This regretfully will prevent you from using it for anything else too, unlike airplane mode. And some will probably argue that a nation state could mimic DFU on an active phone, but it is a viable option that anyone afraid of being under surveillance could chose. The timing of DFU mode can be quite difficult, this video [1] has been help to millions.

Alternatively some use an iPod with only Signal installed. As stubborn Moxie requires access to the address book [2], the iPod address book is exclusively used for Signal addressees.

[0] https://www.theiphonewiki.com/wiki/DFU_Mode#Entering_DFU_Mod...

[1] https://youtu.be/bITIiGswjF

[2] https://whispersystems.org/blog/contact-discovery/

mikeevans• 10 years ago

I'm getting "This video does not exist." on the YouTube link.

smartbit4• 10 years ago

Sorry, link [1] is http://youtu.be/bITIiGswjFI

willstrafach3• 10 years ago

This advice does not make much sense, DFU Mode is for performing a full restore on a device. It is not a way you'd just carry a device around, I believe it actually reboots after a certain amount of time.

At that point just walking around with a powered off device makes more sense than DFU.

smartbit4• 10 years ago

Maybe this is not an option for you and you prefer turning it off if you want to protect yourself against nation state attackers. I assume the DFU mode ROM is hardcoded and therefore more difficult to attack, but if you have heard of DFU mode attacks/simulations/circumventions, by all means let us know. Turning a device off can be easy simulated on a jailbroken device as Snowden argued by asking journalist to put their devices in the fridge.

I wasn't aware that an iDevice comes out of DFU mode after some time, please enlighten us. According to the instructions [0] I understand you need a special set of actions to return to the normal firmware.

Spooky23• 10 years ago

Why not just place it in a shielded bag that blocks RF?

cowardlydragon• 10 years ago

Almost like you need a faraday cage for the phone, with an internal antenna, a "router" through the faraday cage that you have hardware/software control, and then an antenna to rebroadcast outside the cage.

Basically, a radio firewall. So you can enforce absolute radio silence if needed. And log the signals.

sangnoir• 10 years ago

How hard would it be to make the following after-market modifications?

1. add a physical "off" switch that cuts battery power to everything

2. (Hard Mode) Cut power to all radio chips/subsystems (GSM, WIFI, bluetooth) while leaving the rest smartphone operational for taking pictures or recording audio?

contingencies• 10 years ago

If Freedom of the Press Foundation set up a supply chain of modified phones then the NSA and their ilk will likely intercept and compromise any mailed devices before they reach the intended recipients.

Edward Snowden's New Research Aims to Keep Smartphones from Betraying Owners

Related Stories