nu.nl
(original link, in dutch: https://www.nu.nl/tech/6083317/mivd-baas-vergader-zonder-sma...)
I would add one hint, which is to also NOT have internet-connected Smart TV's in your meeting rooms.
They might be streaming whatever you say for "diagnostics" or to "improve customer service" or just to shove more ads into your face the next time you turn it on.
"Samsung's small print says that its Smart TV's voice recognition system will not only capture your private conversations, but also pass them onto third parties."
https://www.cnet.com/news/samsungs-warning-our-smart-tvs-rec...
"I don't think any board of directors of a large organization should be meeting on business secrets with a smartphone or iPad on the table," says [the officer].
(The original: "Ik denk dat geen raad van bestuur van een grote organisatie meer moet vergaderen over bedrijfsgeheimen met de smartphone of iPad op tafel", aldus Swillens.)
You can also say "Ik denk niet dat...". But using "geen" adds emphasis
Unless this is advice for state-level institutions discussing state secrets, this seems like completely useless advice, the kind that gives security people a bad name. It is both too paranoid for regular businesses, and provides too little protection if you truly are being targeted for espionage. Especially in a time where most meetings are happening online.
Even as a power user you will never get admin rights on your machine, neither will you be permitted to download anything lest install it.
At least a laptop there is a chance of corporate IT noticing unusual network traffic.
Bonus clip: https://www.youtube.com/watch?v=8CRA_yE4D-s&t=35
====
Wow Setara, fit 5. Da Komante Da Bik Im Du Xite Efa.
(most Expanse asteroid belters prefer dubs to subs)
Leya: Setashang Lando?
Solo: Lando na setashang, im mang.
...
Leya: To tenye timting mali to. Wamali, ye to tenye imalowda.
A minority of laptops are thinkpads, a fraction of those have SIM cards, and, finally, attacking that subsystem requires serious skills and the benefits are dubious.
Compare that with android/ios phones, which 99% of people have, and have a large underground market of backdoors that anybody can buy and install. Not to mention all the spyware that users and OEM install.
Here are some questions I don't have the answer to, but would be relevant:
- Are these SIMs always active?
- Do they communicate broadly with the internet, or just specific servers?
- If they communicate with specific servers, where does an attacker have to be exploit these communications?
- Does this technology allow for the arbitrary execution of code, or can it only wipe the hard drive?
There are probably more contraints here, but the basic point I'm driving at is that the challenge here is not equivalent to the challenge of exploiting an old android or iOS device. Is there some risk, yes, but it really doesn't seem to be the same amount of risk.
I disagree about the GPS chip. GPS chips are receivers only. You cannot track someone through GPS unless you bug their device and make it send location through another channel. Yeah, that 3rd party internet connection :)
Also, GPS only works outdoors. Not in a corporate boardroom.
Forget WiFi. Walking down a street with lots of retail shops while Bluetooth is enabled receives pings from all sorts of trackers/beacons. We know where you are.
TL;DR: If you think location data is only discernible by using GPS, you are incorrect.
Taking over a mobile device remotely and activating the camera and microphone is a real thing (citations available but https://www.wired.com/story/whatsapp-hack-phone-call-voip-bu... from 2019 provides a solid 'is possible to do' example).
I have worked in more than a few sites where all cell-phones needed to be placed in to faraday cage lockers located outside the highly secure areas prior to entering but laptops were ok to take in and use (subject to high contrast stickers over cameras, dummy jacks placed in mic sockets and wi-fi switched off).
Given that these were a mixture of national infrastructure, military and embassy type sites and was a thing ten+ years ago I think the various governments are well aware of their own abilities and assume that the opposition have equal capabilities.
I take your point regarding “Unless this is advice for state-level institutions discussing state secrets” but knowledge leaks and filters down in to the corporate world. Those same C-Suits that have to attend meetings discussing restricted information projects go away thinking – Huh, I wonder if it could be done to us by a competitor.
When you consider the difficulties of verifying the supply chain of a random mobile device (from the chipset through to all installed apps) it leaves so many security holes that it is best to assume that anything a nation state can do so can a well skilled hacker (or group).
Exactly. From most people, "smartphones are spying on us" sounds a little tinfoil hat. Coming from the Director of Military Intelligence, however, gives the message some credence.
This is probably a reasonable threat for executives to worry about, but it's still ultimately an expression of "we're concerned about a threat where breaking into a home and bugging the device or swapping it with a compromised one is a real concern".
This is closer to "if you can pay a team to go and find a way into that specific person there" then they're going to succeed.
But you're already close to "infiltrate the window washing company, and stick solar powered listening bugs to every window on the upper floor suites".
Pen-Testers use the 'cloned cleaners' pass' thing all the time and it works surprisingly well.
Most people have their email, personal photos, medical records, financial records, chats etc. on their phones. If you believe your phone is likely compromised, you should first move all of those off your phone before being concerned about realtime audio recording.
A year or so back I stayed over with some extended family, one of which was 'In to IT and earns a living from it. During that time (using the I.T guy's network) I noticed that one of my phones was eating through the battery at a crazy-stupid-mad rate. A quick check showed that this particular phone had begun uploading a metric shit-ton of data on an otherwise normally asymetric data profile (in other words Data Uploaded vs Data Downloaded Ratio).
A check with the 'family IT guy' confirmed that he had Remoted In to a high value clients' system to trouble shoot something at around the same time that one of my phones began to furiously upload any and every thing on its' memory card.
Sounds like one of those "Cool Story Bro" types stories right?
All I will say is that because one of my 'Low Hanging Fruit' thangs got p0wned I was able to alert the $corp of the problem (since the probe originated on their end not mine).
As with all things in Life, YMMV.
People underestimate the spying potentially of mobile phones very often. They are always on, have a data connection, and run software that is abysmal for security.
Also, strict security practices that affect productivity often get worked around - for example, if I want to examine a diagnostics archive I got by mail on my phone, but the IT policy won't let me, I may well forward it to my personal mail, open that though Firefox, and get the archive this way. It's much worse for overall security, but pretty hard to prevent, and less important to me when I get a call about blocked builds at 10 o'clock.
But most corporate networks likely have much more likely vulnerabilities that are worth much more thought than this, in my opinion. If your phone has been taken over to the extent that an audio/video stream can be recorded without your permission, I would bet also that much more valuable information than that audio/video stream can usually be obtained as well, for most people who are not used to high security.
No, you can not call me a paranoid anymore. Before Snowden you could call me like that. But today, it is not secret anymore...
However, if, as most companies, you have already chosen to move the vast majority of internal communications, records and documentation in the cloud, it makes little sense to then be afraid that they'll listen to your meetings through your phone.
It's a known risk from the Snowden leaks. So it's not fair to characterize it as paranoia.
At least when it comes to smartphones, there is the baseband circuitry that tends to run completely independently of the OS:
* https://techcrunch.com/2019/11/08/android-baseband-flaws/
* https://threatpost.com/baseband-zero-day-exposes-millions-of...
Some people do worry about the Intel Management Engine having similar issues:
* https://en.wikipedia.org/wiki/Intel_Management_Engine#Securi...
They are more likely to be attacked because they are better targets. They are more often carried around, have GPS and more cameras.
They are MUCH more difficult to manage centrally (e.g. company-managed antivirus/vpn/firewall, locked-down software installation, secure boot...), or inspect or modify.
They are more often used to all sort of untrusted networks (cafe', airport, hotel...)
Personal phones often have tons of untrusted apps with access to microphones.
> Unless this is advice for state-level institutions discussing state secrets, this seems like completely useless advice
citation needed, especially after Snowden revelations
If you're a company whose financial reports, email and documents all reside in the cloud, having your boardroom meetings snooped on through your phone is the last of your worries.
Tech aside, one scenario: C level exec parent - or any parent - hands phone or tablet to child in backseat as a pacifier. That's much less likely with reg phone or laptop.
Also, the fact that he didn't specifically mention laptops might simply be an oversight. That is, pretty much everyone will bring their phones or tablets. An exec with a laptop? In a meeting? Probably a rarity.
Smartphone location tracking data is extremely high-dimensional and sensitive. It is capable of revealing a lot of things which you might not even want to tell to your family. I think for a company such as Google, getting a list of CEOS in e.g. The Netherlands which visit psychotherapists, or occasionally spend the night at the home of their secretary when their wife is on business travel, is little more than an elaborate database query.
My laptop has a small plastic sheet to pull over the camera and I really like that solution for cameras. For microphones there need to by a breaker switch.
"Wait a minute, go back a bit. Just there, enhance! Now convert to audio waves"
Another crime solved by NCIS.
Luckily it seems to require a fast shooting camera?
Technical spying is quite interesting. Like how you can see the picture of a remote display by radio disturbances. Reality is like living in a crackpots nightmare.
This laptop has a microphone kill switch: https://puri.sm/products/librem-15/.
A meeting is a vehicle for unifying all the minds in the room and disseminating information. Phones, tablets, laptops are all distractions. There is nothing worse to me than sitting in a meeting while all my peers peck away at their own stuff and only offer 10% of their attention span.
Desh tu kowltim. Na im pash, na pash im. ("Always two there are; no more, no less.")
Desh o na desh, deting pegunta xiya. Sili mebi mogut ere gova to tili xalte wit peng fong tung tung tung shukumi, o to mebi du kombat wit walowda walowda durating wa wel, unte to du suchok wit imalowda fo imalowda gonya decho. ... -- Hemelet, da bosmang da bik da kong fong denmowk ;)
There should be.
Why are sensors always connected to the machine? They should be physically disabled when not in use. We need physical kill switches for the hardware. It's pointless to obtain access to sensors that don't actually work.
We also need a way to impose complete electronic silence. The phone should not emit anything unless the user wills it. This gets rid of unwanted radiofrequency emissions that can be used to communicate with and track the phone, as well as stuff like ultrasonic tracking beacons.
For the record, I moved out of the UK in response to the UK government’s response[1] to the increased encryption that was a response to Snowden’s whistleblowing.
[1] https://en.m.wikipedia.org/wiki/Investigatory_Powers_Act_201...
I'd say the actual reason for this announcement may have been some undisclosed incidents where this actually happened or has been suspected to have happened. We'll never know. But with people having an active microphone permanently on in their pocket, there's very little need for getting people to break into buildings and install some microphones (a plot point in most spy movies in the last century or so).
I'm not sure if it's really possible, but sound has been reconstructed from video of the movement of leaves of plants or empty potato chip bags. Is it so strange that the signal from a transmitter might be carrying info you don't expect?
Sound is such a strange beast. The keys you press on a keyboard can be reconstructed from audio because of differences in the sound of each key. Cryptographic keys can be reconstructed from the sound of a processor decrypting specially computed messages. I even read a theory about a bios worm that can infect nearby air-gapped computers via sound waves.
Am I paranoid? Perhaps.
Are these things possible? Perhaps.
And spying isn’t even the most likely source of information leaks. More likely is that you have an insider threat or someone who unintentionally leaks information.
When you're at the level that it becomes a concern, you should be paranoid in any case, not just because you might get targeted, but because industrial espionage doesn't require the NSA. When serious money is involved, every competitor can hire a bunch of guys who are, for all intents and purposes, in the same league. They may not have the latest & greatest 0day, but the NSA isn't going to burn that on most industrial espionage cases either (especially not in Western countries, where they can just talk to their intelligence counterparts and expect cooperation).
I think this should be a normal advice in any country. Countries spying on each other isn't new and smartphones and tablets are just an easy door to open.
Listening to conversations seems minor if you already have access to documents, which seems easier to hack than phones.
Well they don't need to hack them. From the Snowden leaks the government has a program called "PRISM". Where companies such as google and amazon just hand over everything from their servers to to government.
> If they can hack your phone
Not quite. With your phone there is nothing to hack as it is "pre-hacked" fresh out of the factory. You're opting in to use an always-on remote listening device.
Either that or you were under the impression that the Dutch security services are giving tips for how to protect yourselves from themselves!
Or if your the Mafia "Johnny Pliars" collects your phone before you go into the backroom :-)
We've sort of normalized everyone having a camera on them most of the time and whipping it out to record a whiteboard after a meeting. But I can remember the days when bringing a camera into company facilities required a fair bit of security rigamarole. (I needed to shoot some pictures of old gear for a presentation.)
Mostly you can safely assume the meeting room or internal servers and routers are already tapped. So act accordingly.
Else, no. It's just a bureaucrat speaking mumbo jumbo security theatre.
GPS, I might believe. Analysing networks is an interesting area. And GPS I could see leaking.
People in Intelligence are as smart and more importantly dumb! as the general population.
One difference is they can't smoke pot (Unsure about the Dutch)
Their only 'power' that makes them seem better than mediocre is they can do things that would be considered illegal for a normal person without fear. IE force everyone to hand over tax records for analysis
This person has climbed the ranks. They 100% are a bureaucrat. I 100% stand by what I said.
(If you think they are leaking a Zero Day, no. Not on a crappy paywalled interview. And I'm not sure I've ever heard of a phone recording people by foreign intelligence or hackers)