> Also, one of the Snowden disclosures was that apparently the NSA can power on the cameras and mics of Android phones even when the phone is off. I don't know exactly how it works, but it does, probably based off the residual current drawn from the battery and the circuitry that handles the power button. Smartphones are basically never safe, although I've heard iPhones are significantly safer than Android.

I mean, even if you could turn on the mic/camera, I would think you still need to possibly save it to storage for retrieval later which pretty much requires the OS to be running.

Otherwise, maybe, you could somehow transmit the data but that would require the ability to communicate with the device via Bluetooth/WiFi and for the data from the camera to be passed to the wireless interface.

Unless a device was designed with that sort of functionality, I'm not sure how the NSA could just turn that on.

They would likely compromise the device via its baseband, and patch the operating system to give the illusion of a complete shutdown when the user attempts to power it off.

"The baseband has DMA access and so can get root at any time" is a myth that won't seem to go away no matter how many times security professionals refute it. On iPhones and all but maybe the cheapest Android phones, the baseband is exposed to the CPU as a USB device, with all the usual memory protections. You cannot patch the device over the baseband (unless there's an existing vulnerability in the USB stack or something).

USB device drivers are for sure bullet-proof, just like the baseband controllers are bullet-proof....

Jumping from one exploit target to another in a chain is pretty much how all modern exploits work. To say that because they would need to find an exploit in the USB driver (or some other hardware or software interface), not only states the obvious, but more importantly misses the point: it's far more plausible than most engineers intuitively believe.

The depth of modern exploit chains is incredible, and while the conceptual difficulty has gone up the pace hasn't seemed to abate, which is clear evidence that our intuition about "too difficult" and about the elasticity of the exploit supply and demand curves is woefully inadequate to accurately gauge risk.

Part of the problem is that the complexity of the systems grows at the same time as improvements in security and correctness. Sometimes it grows faster, sometimes slower, but it's dynamic.

Cursory web searches seem to point away from the USB device theory. Usually the modem is integrated on the main SoC. You can't find mentions of USB associated with the recent Qualcomm onchip modems, for example.

Do you have links to any of the refutations? I recall hearing that the iPhone separates the baseband, but I thought it was otherwise usually on the same chip.

I believe that there are circuits within the baseband hardware that cannot be powered off, short of completely removing the battery. And even then, there are capacitors and other technology that will store power for those circuits for a period of time.

I believe that this has actually been pretty well established in the community, but I don’t have the evidential links immediately at hand.

At the very least, there's the real time clock.

Even working in prisons they are strict on equipment, I have a mate who does Air Con work and he had to account for very tool he took in to make sure they went out with him.

>Even working in prisons they are strict on equipment

The tone of incredulity in your comment suggests, as if this practice is extraordinary, when it would be considered SOP ─ tools and crims behind bars make the most unlikely bedfellows.

As opposed to a SCIF or going for a DV Clearance Interview a lot less strict.

Yeah i'd be wary about the switch unless I understood it.