What happens when your phone is spying on you
today.ucsd.edu
today.ucsd.edu
I was hoping it would cover spy/malware that install remotely through many more infection vectors like clicking text messages. I guess NSO/Pegasus malware has this capability.
I barely use any apps and would gladly settle for a flip phone... I value privacy more than the ability to order food through my phone.
The irony of pointing out how to spot a "spyware" app disguised as a WiFi icon when the dozen Big G apps pictured alongside are collecting the same data...
There should be real protections for consumers to prevent ANY application from slurping up this data, and I don't mean just a disclosure or system setting to hamstring the application into uselessness. I mean, there should be regulations preventing the collection of this data in the first place, with hefty fines and punitive damages.
A lot of the tech I imagine you are referring to has been life changing for me, and if it cost normal SASS prices would not be affordable.
Regulations and disclosures are good, but a straight ban would (depending on how it was written) quite likely affect services that inherently require mass data collection, like Tile trackers, and might make other services have to do subscriptions and become unaffordable for many.
If there was a state sponsored Pine64 style company that could do all of what Google does for the same price without spying, it would be great. But at the moment, the FOSS community does not have true equivalents, or the budget or interest to do so, nor the marketing power to do the stuff that only works if everyone else uses it, and the non-spy commercial solutions have many of the same issues and cost too much for low income people.
I think part of the issue is that it is too affordable. The whole free content, free email, free infrastructure got us into current mess to begin with and since advertising was the only place that paid, now it is a part of the landscape. But on that front, pendulum may be swinging the other way.
And privacy itself is one of those terms that can easily led into a very broad discussion unless it is not clearly defined from the outset.
<< we need to be careful to find suitable replacements before we ban things.
Nah, as a society we were very permissive for the past two decades at least. It is time for tech to grow up and join the rest of the mature industries.
<< But at the moment, the FOSS community does not have true equivalents,
Sadly true. I am currently on Pine ( postmarketos ) since my main phone died. I absolutely love the idea and I keep trying to support it when I have a chance, but it is still not ready for prime time ( and I am not good enough to contribute in code ).
<< and the non-spy commercial solutions have many of the same issues and cost too much for low income people.
And this is why spying - ekh, totally voluntary data collection - should just be verbotten. We have seen where this road leads and it is not fun long term.
As far as effects on me, getting rid of modern tech would already be getting close to the authoritarian nightmare they talk about, far more than basically any of the laws other people complain about.
If the effects are harmful enough to regulate, it's the same kind of conversation as cigarettes and gas engines and a million other things that we put varying levels of restrictions on but don't ban.
Going after spy tech with more force than we go after everything else just seems like government enforced luddism.
You do have a point especially if I examine my thoughts on cigarettes, alcohol and so on to determine what makes spy tech more of a target in my life. I think the difference is that even without regulations and restrictions, I can escape both cigarettes, gas engines and so on if I so choose.
With spy tech, even if I take just about every step there is to take, even full blown luddism does not get me the world that was. These days, being a private person takes real money ( vide FB Zuckerberg buying property to ensure privacy on his real estate ).
You do have a point nonetheless, which brings me to this: what is an acceptable restriction on it to you?
One thing that definitely seems uncontroversial is protection for spaces that have an expectation of privacy. Obviously no democratic state has any business allowing AirBNB bathroom cameras, since basically nobody aside from criminals wants that to exist, and by extension any space that specifically claims to be private should have the same protection.
Requiring a "Facebook moderators may access these chat logs under some conditions" notice at the beginning of everything someone might otherwise think was private seems reasonable.
What I have more of an issue with is defining new spaces with that expectation.
The government should probably have stricter rules than everyone else on privacy, since they are the main group who both can and possibly might want to actually make use of data to harm an average person.
Digital search warrants and subpoenas have solved real problems, so I wouldn't want to get rid of those entirely, but there could be a central logging facility where you can get access to any data they have on you, get notified instantly (Or within a time limit that expires if you are arrested, if there's a need to temporarily seal it to prevent tipping off a murderer) of any new accesses, and appeal the decision that allowed them to access it, so they can't just rubber stamp give it to everyone without any transparency.
Encryption should be permanently made a right, along with anonymity networks like Tor, and Cryptocurrency in general(Although maybe not proof of work, and I sure wouldn't want to become an everyday thing we all have to deal with).
The big problem with spying is that it's just observing people and telling others what you saw, you can't fully eliminate spying without eliminating an important part of free speech.
In general, the GDPR seems to get things mostly right, but I still think the best solution is actually having private alternatives people actually would use by choice, and making sure those are legally protected.
The guiding principle for when that line is crossed is whether or not the affected person was completely and accurately informed about what is going to happen, and that they have affirmatively given their consent for it to happen.
> some privacy advocates seem to think that's still not enough.
I am one of them. I think the GDPR is inadequate in many ways, but it's certainly a huge improvement over the nothing that existed prior, and it's much better than anything we have here in the US.
But the things I think are inadequate about the GDPR still revolve around consent. I will admit that "consent" is a very broad term, though, and includes a whole lot of intricacies and nuances. It's a bit like "freedom" in that sense.
To me, it's just like any other data, licensing it to someone is no different than licensing the source code to something you wrote, if it's revokable the whole concept doesn't make sense, and you don't really own it so much as it's held in trust by the state.
But it seems like some people see it as something really personal and special that inherently shouldn't be treated like any other commercial asset, (Possibly because they've got more interesting lives than mine!) and there doesn't seem to be any compromise that doesn't make someone unhappy.
Revocability does make a lot of sense and I can think of a lot of very good use cases for that right, but also some ways it impairs P2P.
I think the only real solution is for private tech to achieve real parity with nonprivate tech, at least as much as is possible (Tech is almost never private compared to no tech at all, it can always be hacked), but I have no idea how that would be possible.
Technically it could happen, socially FOSS devs would rather work on minimalist stuff.
We live in a world where “buy this movie” on a streaming site gives you no kind of ownership, merely a temporary license to rent the data until the company decides they don’t want you to have it any more - treating personal data the same way doesn’t seem bad by comparison...
I agree with this. It's your data, you're free to license it out in any way you choose.
> if it's revokable the whole concept doesn't make sense, and you don't really own it so much as it's held in trust by the state.
I don't understand this. How does your ability to revoke a license you've issued mean that it's held in trust by the state? Revocability underscores that you own the data and can control what happens to it in the future.
By the way, almost all licenses are revocable.
> But it seems like some people see it as something really personal and special that inherently shouldn't be treated like any other commercial asset,
And those people aren't wrong. They're exerting their rightful control over their data as they see fit. If I choose to license my data out, I am also exerting my rightful control over my data as I see fit. There is no contradiction here -- in both cases, it's about consent.
It's just completely banning the choice to use nonprivate services I have an issue with.
It seems this is the article you were expecting: https://news.ycombinator.com/item?id=26639261.
I know you didn't mean it like this, but I find it funny that it reads like we've abandoned the idea of calling a restaurant and just talking to a person to order takeaway.
Also supports small business by saving them double-digit app fees!
Having worked in a restaurant, if someone took 30% of my gross it certainly would have been all of my profit and then some.
https://www.restaurantbusinessonline.com/technology/nyc-coul...
> New York, like many cities, put a limit on third-party delivery fees during the pandemic to help restaurants that had come to depend heavily on the service. Last August, it became one of the few jurisdictions to make the emergency measure permanent ... Last year, it passed a first-of-its kind law that would force delivery providers to share more customer data with restaurants.
I said they do not use GrubHub. They have their own system run as SaaS. The company they use takes care of the POS system, merchant accounts, and a white labeled app just for their store.
Does the SaaS/POS company let customers use one app and "install/subscribe" to each restaurant as needed?
In an abusive relationship that part is called the honeymoon period. The goals, the mindset of the perpetrator, and the end results are the same.
Or are you referring to the app in the Apple Store that optionally supports Apple Pay (not in app purchasing) where the merchant is charged the standard credit card processing fee - $0.25 + 2-3% of the price?
Would it be better if the person running the restaurant had to do all that themselves?
I’ve seen a mom and pop pizza shop that had all of the technology of a papa Johns thanks to all of the SaaS offerings available
Revenue for the major US delivery apps is currently in the billions, with feudal taxes.
Revenue may be in the billions. But they are all losing money. The smaller companies can easily be “lifestyle businesses” that hire in low cost of living areas and go after “enterprise devs” who are very happy to make $135k - $165K and don’t expect “equity”.
I spent most of my entire career as an “enterprise dev” working with SaaS companies in the bill payment space, field services, and health care.
I’m in $BigTech now working in the cloud consulting department working with a lot of the same types of companies.
The sad thing is that even if you do that, the restaurants are now almost guaranteed to use your phone as unique identifier and use that data for, hopefully, their own purposes ( hopefully, because the lure of selling data might be too much ).
Tracking cookies, browser fingerprinting, and ISP-level monitoring logs everything you do.
Various consumer database warehouses hoover up the data for resale/targetting by ad companies
Hint: once a business has it, at a minimum the FBI/CIA/Government has it. Likely, they've been hacked by China and Russia too.
In addition, the CIA/FBI run ISP-level and DC-level monitoring/hoovering.
Finally, there is no oversight. Either the FBI will cookie cutter whatever request they need after the fact to the rubber-stamp-anyway kangaroo oversight "Court", or they won't even bother. The CIA doesn't even need to care. The only limitation of widespread abuse is some sense of patriotism in the CIA/FBI, and of course that is pretty simple to frame/justify as needed.
The bottom line is that there is a 100% turnkey total information awareness infrastructure for any authoritarian regime that takes over the US government (see: Iraq war, false flag attacks, McCarthyism, etc). They know everyone you communicate with, your political views, your buying habits, and they will soon have AI software to maximize usitlization of the firehose for profiling, reeducation camps / gulags, and the like. The US government can deny you civil rights by declaring a US citizen an enemy combatant, and are more than willing to setup concentration camps for immigrants, and therefore "terrorists".
The abuses stemming from a lack of privacy have not been realized because of political convictions, but because of technical limitations. The advent of advanced AI models will remove many of these technical limitations and allow corporations and governments to quickly build detailed profiles of every citizen that touches the internet.
This has been apparent since "Carnivore" was revealed to not be a conspiracy theory, but an actual system in THE LATE NINETIES, and ECHELON since the 1960s. And since then I would roughly say computing power is 20-40x more powerful (5x the gigahertz, 8x the cores), and storage is probably 1000x more scalable (40GB/280$ vs 14TB/200$).
I have no idea how old you are, but three years ago, heck that is well past the point you should have been aware of this. Look:
https://en.wikipedia.org/wiki/Room_641A
That was revealed in 2006. Basically, the crux of it was that there were "secret rooms" like that in EVERY SINGLE telco. Well, except apparently Qwest, which blew my mind at the time because they were the worst regional telco of them all, so the fact they stood their ground was a total anomaly in their usual monopoly extraction sociopathy.
One big sign of this is Tiktok. Tiktok is an attempt by the Chinese to subvert the normal monopoly the FBI has with social networks, since the US/EU governments are working with US/EU companies for facebook, twitter, etc. But Tiktok is Chinese.
So Tiktok looks like just another social network to a typical social network junkie, but then you read all these headlines where congress and the EU wants to ban it, seemingly strangely up in arms over just another video social network, and .... that's because the Chinese are doing what the US/EU have done for 25+years. The US government has ITS toys, and doesn't want the Chinese to take them.
That should clue you in to how much the government likes have total information access to social networks that are US/EU based.
A lot of this could be swallowed if the US exhibited healthy signs of a functioning democracy, instead it is another sign of an emerging postmodern totalitarian state. The last hope of this was our judicial branch, which has been so thoroughly compromised by 30 years of partisan nominations (read: pro-elite in all cases) and Iraq war case law that it will never go back.
I would stay quiet, but by the time I realized what was going on I had 10+ years of data on me. It doesn't matter anymore.
It was always the intent to make sight of citizens completely transparent.
Remember though, privacy comes at a cost. Thousands of parasitic "startups" that live off of VC, produce nothing for sale, have no profits and rely on surveillance to demonstrate speculative "value" might suffer or even "go out of business", "Big Tech" might not rake in billions per quarter for selling ad services, "tech jobs" might be lost. It could be catastrophic. The entire economy could crash. It could put an AI-driven utopian future at risk. All because of the desire to maintain privacy. This is not just another HN comment conatining only FUD or hype-based predictions with zero factual support. "We take privacy seriously." It's threat to what we do. As an "industry" it's vital that we maintain peoples' trust while we surveil them. /s
What if a company has no profits.
What if a company's product or service is "free". Is that sales.
What if a company has sales, i.e., online advertising services, but in its communications with employees and the public it continually suggests its "business" is something else. Why would it do that.
In any event, there is a question IMO of whether a "tech" company is even "in business" if it can only ever pay its employees and other expenses with investment rounds. Is it possible to "go out of business" if the company was never "in business" (assuming we accept the usual definition of a business).
We already know how VC and "tech" companies would answer these questions. Anyone who questions what they are doing is always wrong. We know that. We have heard it before. But VC and "tech" companies do not have a history of being honest. There is a credibility issue. Not to mention that trying to discredit people who ask questions is silly.
This thread titled "What happens when your phone is spying on you" is about (free) "smartphone apps" that collect data about people below peoples' awareness, strategically avoiding the issue of consent. Why is this even happening. Did VC and "tech" companies have anything to do with it. No, of course not. Performing such hidden data collection is exactly what they consider a "business". It seems that some folks would prefer not to be spied on even when it is essential to someone else's "business".
https://prestersperspective.blogspot.com/p/schizophrenia-ran...
I'm just a hobbyist geek, though, so I may heavily overinterpret things (and the OP) here. :)
Thanks. I puked a bit. Put a damn /s on that thing.
If it was not in jest, seek help. You aren't thinking properly.
https://www.sysnet.ucsd.edu/~voelker/pubs/spyware-pets23.pdf
It's academic research, so this thread here expressing disappointment about the article is weird. We should probably just replace the press release with a link to the study itself.
From the abstract:
. In this work, we perform an in-depth technical analysis of 14 distinct leading mobile spyware apps targeting Android phones. We document the range of mechanisms used to monitor user activity of various kinds (e.g., photos, text messages, live microphone access) — primarily through the creative abuse of Android APIs. We also discover previously undocumented methods these apps use to hide from detection and to achieve persistence.
This was built after the NSO group hacks to lock down the device to be resilient to nation state attacks.
It limits some of the attack vectors you’re taking about (with a tradeoff of also limiting some features).
Apple also enabled true e2ee in the cloud where only you retain the keys.
Is there a procedure to realistically verify that your communications are e2e and not e2mitm2e ?
https://petsymposium.org/popets/2023/popets-2023-0013.php
PDF Paper: https://petsymposium.org/popets/2023/popets-2023-0013.pdf
Sounds to me like physical access is most likely. Your friend, or someone who knows them saw the message on your phone because you left it unlocked somewhere, and added it that way.
Option 2:
Autocomplete randomly added some weird stuff to your message without you noticing it, and your friend took credit for it, because that's the kind of friend they are.
Option 3:
Your draft got synced to some other phone or computer that you were logged in to that your friend had access to. Maybe you logged in on a device that they own or something, or maybe you aren't using any sort of MFA and they just guessed your password.
Option 4:
Carbon monoxide poisoning : https://www.reddit.com/r/legaladvice/comments/34l7vo/ma_post...
If you're interested in narrowing things down a bit, you could give more information about exactly which model of phone you have, what level of jailbreak that it's in, exactly which Android flavor you're running, the patch level of the OS, and exactly which text messaging app you're using (different carriers and manufacturers ship different default SMS apps). Also relevant would be the message you were trying to send, and exactly what got injected.
I also changed my pin because I suspect he saw me entering it, but when this occurred he was at the other end of town so it would have had to have been some sort of remote access. I am thinking maybe phone link, which I had been using with my laptop, I disabled that.
It was definitely not autocomplete because he said something that only he would have know regarding the message I was typing.
He is being kind of a dick about it but I think will probably tell me if I push it but I guess part of it is I don't want to appear as stupid as I guess I am and want to at least get an idea of what it was.
I also turned on face recognition so that people will not see me putting in my pin.
I do not think he went through my laptop because it was turned off at the time.
It has been making me crazy. I will probably have to buy him a bottle of wine or something to get him to confess :)
UI Verion 5.1 Android Version 13 Kernel 5.4.219 Android Security patch level March 1, 2023
The app is called Messages, it's the default app and it's version 14.1.30.19
It was a half typed message, something like this:
I put in: "Hey Dan, are you going to the comedy club Friday " but was going to put night and is anyone else going. but took a call. then he somehow put in the text area where i was typing "yeah, Jan and Steve are going too but you are buying me drinks if you want to know how I did this."
So I knew it was him, I never hit send. So, he was in my phone I think.
One day he came in with a bunch of goons and they seized every piece of IT equipment I had, including the fridge with the large screen. On the way in they shot the dog and tossed a smoke grenade into the crib, which was fortunately empty since baby was at my baby mama's house. Since my child support was based on my IT salary, I owed her $12500 monthly in child support. Court does not care that I'm unemployed now, and they're seizing custody.
Lesson learned, do not let these pranks escalate unanswered. It can make you lose your dog, your kid, and/or make you a deadbeat dad.
Be courageous, and say goodbye to your potentially horrendous friend while you can.
I was hoping HN could give me ideas, but now he will probably read this on HN and then really give me a hard time about it.
My guess is that at an earlier time he had access to your phone unlocked (when you stepped away perhaps) and changed the autocorrect for a common word or phrase to be something else as a prank.
By definition he should not see "your" draft on "his" phone.
agree, he is being a dick.
The title makes it sound like this isn't a 24x7x365 concern when it very much is!
After replacing a damaged Moto with a (presumably) identical one, several months later, before leaving for work, I invoke my trusty old VPN for its maiden journey on my new device. But it won't connect. Because 'Why?', I'm not certain, but the permission dialogue for initial use wasn't appearing, while the VPN was requesting that I grant it permission... but I couldn't manually do so, because...
I then examine my network settings, and a queer surprise rears its absence -- The VPN setting/option is simply missing. Not there. AWOL.
I tuck in to hasty research (what's watching?) and find that I'm not alone. But I've insufficient time to troubleshoot. I go to work.
After work I resume, though find that the VPN now works and the options under network settings now includes 'VPN'.
Automagically fixed. Although I had rebooted the device several times that morning, it had not rebooted since - I know this do to examining Running Services, some of which I manually stop after every reboot, and were still inactive.
I connect to ADB and peruse the logs. Not knowing exactly where to look, I find nothing relevant.
I
I feel like mobile operating systems have been stuck in the early Windows “undetectable RAT era” for far too long, only recently getting basic UI prompts for oversight/control of OS-level permissions settings per app.
I believe it was Apple that forced this privacy angle on the smartphone space and Android was forced to comply, since Android and Google’s business model is to track, profile and harvest user generated data for targeted advertising. AdTech is too profitable and has pervase incentives to keep spying on users.
With all that said, I really respect the approach the EU takes to safeguard privacy and enforce compliance from big corps.
You can do things via MDM on iOS for example and install spyware “monitoring” apps/set OS level permissions that are invisible to non tech saavy users.
Also if you have access to the device and the iCloud password/device pin (e.g. abusive partner scenario, etc.) then non tech saavy people don’t stand a chance against being secretly monitored.
Should also point out that neither app store is perfect and both have let malicious app slip through. Thanks to the Epic lawsuit we also know that they have tried to hide major incidents ( as in 500M installs of potential malware) from consumers.
> After installation, they covertly record the victim’s device activities — including any text messages, emails, photos, or voice calls — and allow abusers to remotely review this information through a web portal
And the “malware” that was installed was because people were using hacked XCode versions that didn’t come from Apple and they still didn’t escape the sandbox.
Doesn't really matter how the malware get there. The important part is that it waltzed right past Apples quality control.
To be fair, this particular issue — the creative abuse of Android APIs by "stalkerware" apps — applies to Android only.
Also, MDMs on iPhones can't do the kinds of covert monitoring that this paper discusses. They can't access texts, emails, photos or other personal messages or data within apps on a device.
https://9to5mac.com/2022/12/13/apple-alternative-app-stores-...
So much for the "app store is like 1984" marketing spin that Epic put out lol. Now you have the freedom to have spyware installed on your phone... which is what I and many others have been saying all along. Not just abusive spouses but Facebook and others will be all over this.
https://www.youtube.com/watch?v=euiSHuaw6Q4
As I said previously... Facebook and others already have this sort of spyware ready to go, because they were already using their developer credentials to get users to sideload it for data mining. Now it won't be optional/"we'll give you a gift card", it'll just be mandatory if you want to use Facebook on a ios device. Sorry this device is not supported via web, please install the native app.
https://arstechnica.com/gadgets/2019/01/facebook-and-google-...
You now have access to everything via iCloud and FindMy app for location tracking. You can even sign into another device and have real-time iMessage and other private data without installing any spyware apps. I will admit this is outside the scope of the paper, but arguably harder to mitigate if you are not ever checking your iCloud settings.
Also bad for people with stalkers/abusive partners. I don’t know why everyone says it’s so hard to compromise a device/number (either platform) when it’s not. Or maybe I’m just in a position where I see it more often and overall it is hard? My day job minimum of 2 a day, confirmed not counting otherwise. Volunteer work, its not as frequent but also don’t deal with same volume of people. It is creepier though and no one knows what to do. One case working w a big agency as it involves a high dollar amount and is ongoing and THEY can’t seem to give advice that works either. Person at this point went to a flip phone.
Reset the phone? Didn’t work. Abandon all accounts, reset phone, cool. Didn’t work. K now all of the above and dump the number, and/or replace entire phone, latter usually works but not always. Sorry this is long here is my point in commenting. I wish someone with knowledge would take the time to do a solid write up for people with zero tech knowledge not just how to protect themselves but how to determine if/how they are compromised, log proof if possible (court etc) get rid of it and move forward safely, or as safe as possible for both android and IOS, a comprehensive write up. They would be a super hero. Literally help countless.
It would help people like the 83 y/o grandma who got cleaned out THREE TIMES and cried to me begging for help on how to stop it, the women whose abusive exes show up at shelters because they have accessed sms or location despite the women using precautions given to them as the precautions are not up to date with what’s possible. Forgive me, it gets to me some of the most vulnerable people are dealing with this at an alarming rate and the people they are told to get help from genuinely don’t know what to do, while I know some it’s not enough to truly be of help say if someone has a well versed ex determined to hunt them down. These people could care less about the Gov knowing all, they just want to be safe.
But the two systems are pretty much on opposite end of the spectrum.
Can you name one?
> "While Google does not permit the sale of such apps on its Google Play app store, Android phones commonly allow such invasive apps to be downloaded separately via the Web. The iPhone, in comparison, does not allow such “side loading” and thus consumer spyware apps on this platform tend to be far more limited and less invasive in capabilities."
Recommended:
https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents...
> "After confirming forensic traces of Pegasus on Nour’s iPhone, we identified the presence of additional spyware, which we attribute with high confidence to Cytrox. We further conclude with high confidence that it is unrelated to Pegasus spyware."
But this is still qualitatively different from android where the threat model is "connect USB cable and run ADB command", if even that much.
This sentence ruins the credibility of the article because Android doesn't let you do this. The camera, microphone, can only be used when an app is in the foreground. For location data being tracked in the background it will have a persistent notification telling the user that an app has your location. For an app to read your call log or SMSs it has to be set as the phone's default phone or SMS app.
This combined with androids reminders to review the permissions for apps that have dangerous permissions and Play Protect which can detect and remove spyware this article is giving Android much less credit than it deserves.
For example, with respect to the camera, they documented a "standard" way to abuse Android APIs to do it (create a Preview, which unlocks the camera, but hide it in a 1x1 or transparent element), and two "new" ones --- raw frame access with `SurfaceTexture`, and creating a 1x1 WebView.
When you see articles like these at university sites, they're virtually always announcing a paper that got accepted somewhere, and you need to read the paper and ignore the press release.
This is not true. This may be partially true on the latest Android, but you can still set permissions to use e.g. GPS all the time, for things like weather or GPX recording apps.
But it's also important to remember that the vast majority (easily 90%) of devices out there are running EoL'd Android versions, nevermind Android 12 and 13.
It requires you to manually go into the settings to grant this permission. And as I mentioned it has a persistent notification. This is a part of Android 11.
>But it's also important to remember that the vast majority (easily 90%) of devices out there are running EoL'd Android versions
This is unfortunate. If want to have a secure device it's important to be using one which is still supported and is getting security updates. Else if a vulnerability exists an attacker can install spyware by using the vulnerability despite Android's security model.
All I'm saying really is, please try to know more about the world outside of your immediate experience.
In January 2023 78% of Android devices were on Android 10-13.
Note that (1) this was right before Samsungs rollout of Android 13, (2) this is worldwide and things look very different in West.
A week ago I purchased a bluetooth device that takes some measurements. You require an Android or iOS application. The first thing the iOS app did was request permission for your location. Immediate fired up MITMproxy [1] running in transparent `--mode wireguard` and installed it's certificate in the iOS trust store. It was sending a whole bunch of data to China and HK. Since I don't have a jailbroken iPhone, it's off to Android.
For BLE scanning, Android does require permissions for location, but this application is using a Chinese branded tracking SDK and sending encrypted blobs (within already encrypted TLS). So it's time to start reversing and instrumenting the runtime.
Well - not so easy, they used a commercial packer that encrypts their compiled bytecode and decrypts and I think executes it within C++ library that might be an actual interpreter. I managed to pull the Dalvik bytecode out of memory using Frida[2] after the packer had decrypted the base application and converted it to java bytecode with dex2jar[3] then into decompiled java with jadx [4].
Since the developer relied on the packer to hide/obfuscate their software, it's quite easy to follow the deobsfucated code. The libraries that do the location tracking on the otherhand are obfuscated so now I'm at the stage of identifying where to hook before the encrypted blobs are sent to servers in China.
Here it would be nice to have a call flow graph generated based on the static decompiled java code - can anyone recommend anything?
I've sunk about 8 hours into this so far. The message here is that to understand what some applications on your phone does you need to really invest time and effort. The developers increase the cost to the consumer to know what their application is doing by obfuscation, encryption and packing. It's asymmetric. Also note: the play store and apple store state the app does not send data, which is demonstrably false.
I can also see that the tracking SDK has what looks like functionality to dynamically invoke code - which would break the terms and conditions of the app stores.
At some point I will reimplement it's primary BLE functionality and release it as opensource to the public and perhaps write a blog post.
[1] https://mitmproxy.org/posts/wireguard-mode/
[2] https://frida.re/docs/android/
You are really talented, now get paid for it or open source some automated tools for getting the trail to see behind the curtain for these apps that force you to enable permissions to use them.
Perhaps there are opportunities for developing easy to use dynamic analysis tools for the general population.
GrapheneOS and a Pixel phone are about as private and secure as you can get whilst maintaining good usability of a smartphone in 2023.
Highly recommended, no affiliation.
I need it to be open source, not require Google Play Services and not connect to a hardcoded service, but allow me to phone home to an IP address/URL that I specify myself.
Basically, an SSH server configured with reverse tunneling, that instead of just giving me a shell, gives me a control panel to configure high-level features of Android.
Yes I know what search engines are, but I'd appreciate curated / personal recommendations, please.
Anyone recommending antivirus apps for your android is clueless and/or after your money.
BTW I really am clueless, because I've avoided owning any kind of smartphone until now.