Architecture of smartphone security: why FBI needed apple’s help?

I want to focus on technical aspects, not on the fact that they wanted to make a precedence.

i assume the smartphone security architecture is following:

  1. cryptography chip. it’s read only and stateless. it contains physical cryptography key. it offers some transformations of user input. it doesn’t expose the key. it doesn’t remember number of retries

  2. NAND disk. contains encrypted data

  3. OS. get input from user, talks to the chip, changes the content of the NAND

  4. retries counter. no idea where is it? is it stored on NAND disk or some other dedicated long term memory?

from what i know the FBI wanted apple to make for them less secure iOS version that doesn’t erase the disk after a few failed retries. but why do the need it? can’t they just:

  • make a copy the NAND disk (in case it has some killswitch)
  • get the chip’s spec and just send to it a few millions decrypt request (testing every possible user pin / password)
  • if the chip stores retires counter in some dedicated memory, they can always plug in a tweaked memory that always replies with the same value when read

why do they even need an OS? it’s just a simple program that can communicate with a chip. what am i missing?

how to protect smartphone data against theft?

i assume typical android has fully encrypted disk with a key stored in a header. header is encrypted using pin / pattern / fingerprint or not encrypted when there is no lock. is that correct?

when the phone is on, a thief can use the OS to access the data. pin and pattern accepting delay will be sufficient. also all the theft protection application might kick in in this scenario

but what happens when the thief turns off the phone and takes out the disk. he can run simple brute force. 4 or 6 digit pin, patter and probably a fingerprint is not a problem for the disk password bruteforce, right? are there any hardware level (NAND level?) protection mechanism? or the only thing that works would be a strong disk password?

if no, is there an option to set strong disk password and separate pin password / pattern / fingerprint for OS level protection? or is there any other way of keeping your data secure in case of a theft (android device)?

Mobile Hotspot, Smartphone or Router?

I am using a laptop with dual boot Windows and Ubuntu. In Addition I am having another Linux distro installed on a usb and using it only for certain things.

Generally speaking – If android devices are vulnerable in terms of privacy and security, does that mean that my linux will be vulnerable too if I use the Hotspot from android devices?

Does Mifi devices, all these jetpacks any better than a smartphone for security and privacy?

Getting a mifi, a good plan simcard and using a Linux distro on a usb should be better than, using my linux installed on the laptop alongside with windows, and using my android phone as a hotspot?

I have access to unlimited data from a broadband provider, but don’t have access to their hub3 device and can’t configure any settings and I think its very unsecured as it is now. So that’s whyt I am using mobile data for my laptop, thinking its more secure.

Getting a mifi, mobile simcard and using a Linux distro on a usb should be good idea?

What is the security of using an Internet-capable mobile phone? (not smartphone)

I’m talking about a class of old mobile phones that are not smartphones but are still (theoretically) Internet-capable, at least via 3G. Examples of such phones include Series 40 Nokia phones or the Samsung phone featured in Spectre (OK that one at least is still available so I have to retract the ‘old’ word). Note these phones enable running user code via their Java thingy. Symbian phones, however, are out of the scope of my question.

Note I don’t ask about browsing the Internet with such phones – these capabilities are, in my experience, often all but useless nowadays anyway. Instead, I mean carrying the phone around while it is switched on and making phone calls.

Until recently I assumed these phones were too simple and too old to be unsafe… But is this really correct? It suddenly struck me that these phones are likely directly routable from the Internet through an IPv4 address – which sounds pretty horrible, doesn’t it? Aren’t these phones, therefore, under a constant scan? To make things worse, many of such phones are very unlikely to receive updates (are they even technically capable of updating themselves?)

In short – one may not wish to use the internet with their phone – but will the internet forget about them?

This question asks about dumbphones. My question asks about phones that are in-between of dumbphones and smartphones – that already provide attack vectors (Internet, user code, …?) but not precautions (updates, app scanning, …?) of smartphones. It would therefore seem that such phones are the worst?

And yet there is, from my experience, noticeable demand for these in-between phones: namely from older people who seek the ease of use of a dumbphone, fear they could not manage to use a smartphone but won’t use a true dumbphone because of their diminished availability. This, I believe, makes my question important.

Little bonus that made me ask this Q – some time ago my old Series 40 Nokia phone started showing me a weird message briefly each time I switched it on. The message was saying (IIRC) that my phone was sending some message. What message? Where? I remember seeing this message quite often during my country vacation, but now I switched this phone off and on again, hoping to provoke this message, but it is gone. I suppose this is benign?

Why since I configured my smartphone APN protocol to IPv4/IPv6 I (might) only have IPv6 addresses?

About a week ago I configured my smartphone Access Point Name (APN) of the type APN protocol from including the value IPv4 to including the value IPv4/IPv6, all IP addresses I recognized for my smartphone were IPv6 addresses.
I didn’t change the value for the APN type APN roaming protocol → its value is still IPv4 only.

I understand I can now have both IPv4 addresses and IPv6 addresses but the purpose of the following question is to understand the tendency I personally recognize for IPv6 (only?) addresses for my smartphone.

Why since I configured my smartphone APN protocol to IPv4/IPv6 I (might) only have IPv6 addresses? Is it a coincidence or the cause of some global standard cellular operators are now following?

How could I block or at least detect the use of ultrasonic side channels or Google Nearby Messages API on my smartphone?

My question is about the use of ultrasonic messages that are part of the modern advertising ecosystem and are also used by the Google Nearby Messages API.

When it comes to advertising, the type of ultrasonic messages that I am referring to are described in this Wired article titled “How to Block the Ultrasonic Signals You Didn’t Know Were Tracking You”, from 2016. The article says (emphasis added):

The technology, called ultrasonic cross-device tracking, embeds high-frequency tones that are inaudible to humans in advertisements, web pages, and even physical locations like retail stores. These ultrasound “beacons” emit their audio sequences with speakers, and almost any device microphone—like those accessed by an app on a smartphone or tablet—can detect the signal and start to put together a picture of what ads you’ve seen, what sites you’ve perused, and even where you’ve been.

The Wired article also mentions that:

Now that you’re sufficiently concerned, the good news is that at the Black Hat Europe security conference on Thursday, a group based at University of California, Santa Barbara will present an Android patch and a Chrome extension that give consumers more control over the transmission and receipt of ultrasonic pitches on their devices.

Being that the article was from 2016, I looked at the Black Hat Europe conference from that year for more information about the Android patch. The presentation mentioned in the Wired article seems to be this one.

The presentation slides (available here) led me to the ubeacsec.org website where the researchers do have an android patch as mentioned in the Wired article. Alas that patch is a research prototype made for android-5.0.0_r3.

There is also this research paper from 2017, titled “Privacy Threats through Ultrasonic Side Channels on Mobile Devices”. The authors of this paper found out for example that

  • Advertising platforms such as Google’s Universal Analytics and Facebook’s Conversion Pixel provided services utilizing this technology. The researchers analyzed three commercial solutions: Shopkick, Lisnr and Silverpush.
  • 234 Android applications analyzed by the researchers were constantly listening for ultrasonic beacons.
  • Out of 35 stores visited in European cities, 4 were using ultrasonic beacons at the time of the research.

Anyway my interest is not just about blocking advertising trackers. Even though the marketing departments may be the largest consumer of this technology, it can be utilized in many other ways as well.

And this issue is related to another technology, namely the Google Nearby Messages API. The overview document written by Google about this technology (here) says that (emphasis added):

The Nearby Messages API is a publish-subscribe API that lets you pass small binary payloads between internet-connected Android and iOS devices. The devices don’t have to be on the same network, but they do have to be connected to the Internet.

Nearby uses a combination of Bluetooth, Bluetooth Low Energy, Wi-Fi and near-ultrasonic audio to communicate a unique-in-time pairing code between devices.

The concerns about the Nearby Messages API are:

  1. Its ability to pass small binary payloads, i.e. presumably executable code.
  2. That while it is easy to disable Bluetooth and WiFi on a smart phone, it is not so easy to disable the microphone.

Question:

Are there ways to block or at least detect the use of ultrasonic side channels or Google Nearby Messages API on my smartphone?

How are calls or SMS used to exploit a smartphone?

How could a phone number be used as a means to gain access to a smartphone? I am reading claims that you could receive a call or SMS on your phone and an attacker can install their malware that way. Are methods like that possible? That seems a bit over the top to believe. What exactly are the methods used to install malware on a smartphone. I have a pretty elementary understanding of information security, any books or sites to read are appreciated.

Stop smartphone microphone from listening in background

Recently it has come to light that tech companies such as Facebook and Microsoft use humans to listen and transcribe audio conversations on Facebook messenger and Skype to improve their AI. However this only occurs when the app is active.

I’m a little concerned if it is possible for applications to listen to background conversations. Like some apps using Alphonso software listened to TV noise in the background using the smartphone’s mic.

Is it possible to prevent apps from accessing the phone’s microphone in background but still allow microphone use when using the app (e.g. making a Skype call)? Perhaps through an app/operating system which notifies you when your microphone is in use?