Hacker News Reader

Comment by mtsr | Hacker News Reader

Why? Is there any way to be certain these are done in hardware and can’t be caught in a low level system once the device is rooted? It’s a black box, so no way to know until somebody manages to pull it off.

View on HN

I can implant a tiny microchip into your phone that will intercept every disc read/write and transmit it. Is that something it makes sense to check for, though?

These days, it's easier to thwart the Evil Maid attack, as it's known, by replacing the device, and some recommend doing that when entering/exiting China, attending DefCon, and a few other scenarios where it's credible under a given threat model. Most of us aren't Edward Snowden, but are still cases where thats not so ludicrous. The FBI has installed keyloggers into laptops supposedly fresh from the factory that have been discovered before. It's not just specific person devices, either. Aspersions were cast on Supermicro motherboards installed into Cloud provider data centers, even if nothing was ever found/proven.

> Is there any way to be certain these are done in hardware and can’t be caught in a low level system once the device is rooted?

If you suspect your device has been tampered with and need a guaranteed reboot, just let the battery run down and don't use it until it has.

> If you suspect your device has been tampered with and need a guaranteed reboot, just let the battery run down and don't use it until it has.

Just a (overly paranoid) thought: a sophisticated attacker could simulate a drained battery and subsequent reboot, no?

No sophisticated attacker can make a phone run for five days without recharging. Just leave it on for five days and you should be fine.

Yes

Yup - this combination works even if the device is hung.

Reply on news.ycombinator.com