Hacker News Reader

Comment by c7DJTLrn | Hacker News Reader

The smart crooks use Signal on iOS with backups off. Maybe a VPN for good measure.

I think the real crooks do the old-fashioned stuff. Like, not use a smartphone at all for criminal things. Just use expendable workers over two or three layers of hierarchy :)

Is signal on iOS safer than signal on Android?

Yes, just because iOS itself is harder to hack. For example there are trivial evil maid style attacks against Android: https://www.tiktok.com/@android_infosecurity/video/718590789...

Security 101: Physical compromise is full compromise. If someone with the means has access to your unlocked iPhone, it's game over as quickly as Android. Remember JailbreakMe? That was the NiceGuy™ version of iPhone hacking. Now companies bill governments millions of dollars for iPhone jailbreaks and you can't even sideload apps after.

As time goes on the cost of physical attacks increases. This was more true in the 90s when secure boot and FDE weren’t a thing, sure it’s still possible but it’s much harder now.

Secureboot and FDE will still protect against this. The attack in the linked video just uses a flipper zero to mimic someone holding your phone and disabling protections then installing malware.

Even if the phone was on, unencrypted, and locked it would fail.

Edit: I initially misunderstood where you were coming from. Yes, today things are more secure, but if someone has unfettered physical access to your device they can just as easily install hardware that waits for you to login and then do these things or replace your charger plug (on a mobile device) or use a modified Bluetooth or USB proxy to keylog (on a full device). We're of course getting into high-level corporate attacks at that point if to be unnoticed (i.e. no popups, prompts, unexpected changes), so the average user is much more safe.

Pretty much, iOS jailbreaks were common and free, now they’re worth millions (assuming they can be exploited remotely).

At some point, if you have physical access and the device pin, you should assume it’s game over, but there may also be a point in time where we no longer care about physical security as much, if at all.

No. Actual criminals are going much deeper than that. Custom hardware, custom apps, custom servers. Sometimes it works, sometimes they get this.

Are you speculating or is there precedent for this? I highly doubt even the largest criminal organisations are producing custom hardware or software.

The largest cartels operate their own cell networks and have dedicated proprietary technology and netsec divisions.

El Chapo’s cartel had their proprietary cell network, but the FBI simply grabbed up the cartel’s technology/IT head and threatened him into giving them access.

https://amp.cnn.com/cnn/2019/01/09/americas/el-chapo-it-tech...

Good old $5 wrench attack.

Reply on news.ycombinator.com