Hacker News Reader

Comment by zw123456 | Hacker News Reader

Something happened to me the other day, I started drafting a text using the regular text messaging app on my android phone, I was sending it to a friend, but I got distracted by a call and never sent the text. Later I went to finish it and send it but he had gone in and put some smart-alec comment in the text of the message I was drafting. I was shocked. He refuses to tell me how he did it. I went through all the settings, scans permissions and so on. He says he can't do it now but still refuses to tell me how he did it. Scary. I wish I could find out what it was he did. Any HN'ers have any ideas?

View on HN

Option 1:

Sounds to me like physical access is most likely. Your friend, or someone who knows them saw the message on your phone because you left it unlocked somewhere, and added it that way.

Option 2:

Autocomplete randomly added some weird stuff to your message without you noticing it, and your friend took credit for it, because that's the kind of friend they are.

Option 3:

Your draft got synced to some other phone or computer that you were logged in to that your friend had access to. Maybe you logged in on a device that they own or something, or maybe you aren't using any sort of MFA and they just guessed your password.

Option 4:

Carbon monoxide poisoning : https://www.reddit.com/r/legaladvice/comments/34l7vo/ma_post...

If you're interested in narrowing things down a bit, you could give more information about exactly which model of phone you have, what level of jailbreak that it's in, exactly which Android flavor you're running, the patch level of the OS, and exactly which text messaging app you're using (different carriers and manufacturers ship different default SMS apps). Also relevant would be the message you were trying to send, and exactly what got injected.

I have a Galaxy S21 5G with Android 13

I also changed my pin because I suspect he saw me entering it, but when this occurred he was at the other end of town so it would have had to have been some sort of remote access. I am thinking maybe phone link, which I had been using with my laptop, I disabled that.

It was definitely not autocomplete because he said something that only he would have know regarding the message I was typing.

He is being kind of a dick about it but I think will probably tell me if I push it but I guess part of it is I don't want to appear as stupid as I guess I am and want to at least get an idea of what it was.

I also turned on face recognition so that people will not see me putting in my pin.

I do not think he went through my laptop because it was turned off at the time.

It has been making me crazy. I will probably have to buy him a bottle of wine or something to get him to confess :)

UI Verion 5.1 Android Version 13 Kernel 5.4.219 Android Security patch level March 1, 2023

The app is called Messages, it's the default app and it's version 14.1.30.19

It was a half typed message, something like this:

I put in: "Hey Dan, are you going to the comedy club Friday " but was going to put night and is anyone else going. but took a call. then he somehow put in the text area where i was typing "yeah, Jan and Steve are going too but you are buying me drinks if you want to know how I did this."

So I knew it was him, I never hit send. So, he was in my phone I think.

Have you ever logged into messages.google.com?

No, never. HN is pretty much the only social media I use, the rest of it is not really my thing.

Maybe this isn’t what happened. But I was specifically referring to the ability to pair a computer with your Android device to send/receive messages without your phone: https://messages.google.com/web/authentication It’s actually quite handy.

Maybe too handy.

Did you ever get an answer to how he did this?

Wow, that's very interesting. Please post an update once you find out what the attack vector was.

I will, assuming I buy him enough drinks, I am sure I will wriggle it out of him. That little F---er.

You should not buy him anything. You should cut him out of your life entirely. This is an egregious trust violation. I’d forgive a teenager of such thoughtlessness but if they’re an adult then they’re going to abuse you in other ways. They don’t care about you.

Good points. Maybe time to say goodbye.

I had something like this happen. My friend is a massive prankster, and I let it escalate to the point, where they weren't just pranks.

One day he came in with a bunch of goons and they seized every piece of IT equipment I had, including the fridge with the large screen. On the way in they shot the dog and tossed a smoke grenade into the crib, which was fortunately empty since baby was at my baby mama's house. Since my child support was based on my IT salary, I owed her $12500 monthly in child support. Court does not care that I'm unemployed now, and they're seizing custody.

Lesson learned, do not let these pranks escalate unanswered. It can make you lose your dog, your kid, and/or make you a deadbeat dad.

Be courageous, and say goodbye to your potentially horrendous friend while you can.

love this list, especially Option #4 that is not on everyone's radar but a very real issue clouding people's judgement.

I am pretty sure I would not have written "Hey buy me drinks to see how I did this." even if I was CO intoxicated, that seems pretty unlikely.

Hate to say it, but he doesn’t sound like much of a friend if he’s owned your phone and refuses to elaborate on how.

Sounds like a good joke to be of either side on to me. No harm done.

to me this is an unacceptable boundary to cross. I would never be able to trust someone that does that.

Yeah, I sort of feel that way too but maybe also is a good lesson learned.

What’s the lesson here? That software is insecure? Or that you shouldn’t trust your friends? Sad.

All of the above, plus, maybe, don't let people see you put in your pin. don't take security for granted. Be careful. I guess the lesson I learned is you need to pay attention to security.

Is it because the phone is very intimate to you, or because of the implications?

because they could be viewing all their private communication/media on their device and that causes a lot of anxiety cause they won't confirm or deny if they have access.

Ugh, yeah, if this was not someone I know, the pictures, yikes !

what pictures?

It's basically the equivalent of someone in the 80s tapping your phone line.

Rather someone in the 80 changing the numbers on your phone book so that you dial a wrong number.

I think he will fess up eventually, but is sort of being a dick about it for sure.

I was hoping HN could give me ideas, but now he will probably read this on HN and then really give me a hard time about it.

Instead of freaking out about it, it would be more fun to do a similar joke to him. What's fair is fair.

Yeah, I sure want to, especially on April 1st. Maybe I should do and Ask HN, how do I get back at my dickhead friend on April fools day :)

Type the message you sent again into a random text message window and see if it changes to the smart alec comment again.

My guess is that at an earlier time he had access to your phone unlocked (when you stepped away perhaps) and changed the autocorrect for a common word or phrase to be something else as a prank.

Do you mean your friend edited your draft sms? Did he had physical access to your phone? Are you using stock android app or anything special? What make model is your phone?

By definition he should not see "your" draft on "his" phone.

I have a Galaxy S21 5G with Android 13

He might've paired a bluetooth keyboard to your phone at some point.

hmmm, could be, but at the time it happened he was on the other end of town but I wonder if will we were in close proximity he could have connected a BT device somehow and planted something.

First: What is smart-Alec? Second: Does not sound like a friend to me.

smart-alec is a smart ass, I was trying to keep it clean,.

agree, he is being a dick.

Were the two of you ever in physical proximity?

Yeah, I replied in the thread earlier, I suspect he saw me put my pin in. But at the time it happened he was on the other side of town.

Change your pin and see if he added his fingerprint or Face ID to unlock then dump them for being a privacy invading friend

I would just avoid charging your phone at your friend's place or clicking his links.

Reply on news.ycombinator.com