Hacker News Reader

Comment by patrickaljord | Hacker News Reader

Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone if asked by the government. As long as you don't control the backend and even the frontend, you're at the mercy of whoever controls it (Apple in this case). That's why all the Apple talks on privacy lately sounds like not much more than good marketing to me.

View on HN

"Of course they can. Even the iPhone, Apple can easily push an invisible update and install a bot on your phone"

... or on your SIM card, which is a full computer with CPU and memory and can run arbitrary java programs that your carrier can upload to it.

AFAIK, sim cards are basically storage devices. When did they get CPUs?

I think in the 90s.

Check out: https://en.wikipedia.org/wiki/Universal_Integrated_Circuit_C...

They have always had CPUs. Just like most other types of ISO7816 cards, including any that have any kind of pin protection for the data stored within.

More on this little computer: http://www.gemalto.com/techno/sim/

Wow, thanks!

And on the Gemalto sim-card hack by the NSA and GCHQ: https://theintercept.com/2015/02/25/gemalto-doesnt-know-does...

"In the secret documents, provided by NSA whistleblower Edward Snowden, the intelligence agencies described a successful effort to obtain secret encryption keys used to protect hundreds of millions of mobile devices across the globe."

Google can do that, too, through the "Play Services" framework, in case others weren't aware of it. We know this because Google has already used these "powers" to uninstall apps/malware from phones (non-Nexus).

> Mr Snowden said GCHQ could gain access to a handset by sending it an encrypted text message and use it for such things as taking pictures and listening in.

This sentence is as much context as the article provides, and I won't rehash my other comment, but this could be from a recently purchased ~$20 burner to a ~$800 iPhone. Not every phone is windows/android/apple and connected. idk, I found it pretty eye opening.

Yeah--reading the Ars Technica review of Marshmallow terrified me with some of the things they are doing there. Like the fact that users have more granular control over permissions now, but internet is always on for apps no matter what, there's a whole slew of permissions that aren't exposed through the user-controllable permissions that are pretty bad, and there's new stuff in there that allows screenshots to be sent from an app to Google for "searching in the app." I try to read this stuff without a tinfoil hat, but they sure don't make it easy.

The internet permission has been semi-broken from Android 1.0 onwards. In particular, people tended to interpret it as "this app cannot upload my data to the internet". But then it was discovered apps could do things like request the music app to play an audio stream from an arbitrary URL. Any data to exfiltrate can be put into the query params. Or the app can request the browser to open, same trick. By the time the user realises what's happened the data is gone already.

In fact more or less any app that can be convinced via IPC to open an attacker-controlled URL can be used to circumvent the expected meaning of the internet permission.

And then there's the inconvenient fact that virtually all apps need it for one reason or another, so it just became meaningless. Good riddance, I say.

What permission are you referring to, that allows apps to send screenshots to Google?

Not sure it is actually a permission so much as a feature of Google Now.

Paragraph 2 of this page: http://arstechnica.com/gadgets/2015/10/android-6-0-marshmall...

There's no such thing as a front-end that you control.

What do you mean? I can turn javascript off in my browser which effectively takes control of the front end by preventing communication with the server. Native is a different story but saying "there's no such thing as a front-end that you control," is misleading.

Did you write the browser yourself? On an operating machine that you hand-coded on a CPU architecture that you clean-room designed and implemented personally?

I even soldered the cpu

I smelted my own silicon

How do you know the silicon in the Matrix was not back-doored?

Apple can, but what about GCHQ?

They just need to (il)legally compel Apple to do it.

Isn't that true of anything that has automatic updates? Browsers, games, operating systems, etc.

Does this mean that if we don't trust our government we should stop pushing anything that automatically updates?

That has seemed to me like the reasonable approach for a good while now.

Reply on news.ycombinator.com