Smartphones and the location data marketplace

Re:Smartphones and the location data marketplace by javajosh on Saturday December 21, 2019 @02:32PM (#21852904)

Yeah, apps are bad, but what concerns me (well, scares me to my bones, actually) is the prospect of malware below the app level. The operating system, drivers, and hardware are all ripe for abuse at an unimaginable scale. The "baseband" blob in particular seems like a holy grail of invasive surveillance. And, theoretically, there's a huge opportunity for the manufacturer of the PCB and every chip on it, to add what is logically a blob - a region of the chip that is mostly dormant, but reacts to some signal and come's alive. And we cannot verify that these features don't exist because they are too small!

I mean, if I was China I'd be actively pursuing inserting this kind of trojan horse in everything. Yeah, you'd only get to use it once at scale, but that's all it would take. And you'd probably get away with targeted use for a long time before anyone discovered it.

This, that is, national security, is the best reason to pass "right to repair" laws, and build out replacement hardware and software options that are verifiably open. Heck, if I was with NSA I'd be pushing hard to fund that kind of work with NSA money.

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by amelius on Saturday December 21, 2019 @06:34PM (#21853982)

> Heck, if I was with NSA I'd be pushing hard to fund that kind of work with NSA money.

But what if the NSA had their own backdoors installed in hardware made by US firms?

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by javajosh on Saturday December 21, 2019 @06:44PM (#21854036)

AFAIK very few PCB- or chip-level electronics are made in the USA. And this kind of insertion would best be done at the last possible moment, at the factory. So if you don't have the physical factories, you don't get this opportunity. No doubt the NSA (or any national intelligence agency) would want this, but you can't have it unless you have the physical fabs.

So, being practical engineers, if I was the NSA I'd make deals with telecom's to 'assist' with writing the baseband. But the irony is that the device manufacturer could easily disable this backdoor in favor of their own. Oops! :)

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by amelius on Saturday December 21, 2019 @07:08PM (#21854171)

> But the irony is that the device manufacturer could easily disable this backdoor in favor of their own.

I'm not sure it works that way. Perhaps the NSA could force certain US companies to specifically design and install backdoors, and require these backdoors to be always active. (One of my possibly ungrounded/paranoid fears is that they do this with Intel ME).

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by sfifs on Saturday December 21, 2019 @11:00PM (#21855091)

The balance of likelihood is they do on both Intel and AMD management engines as that's what any competent agency should do in this age. To my mind, there's no other real reason for the explosion of interest in ARM chips on server. ARM design is sufficiently well understood and simple that usable chips can be designed and fabbed away from the control of US companies even if it provides poor performance trade offs.

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by mmmuhd on Sunday December 22, 2019 @10:56AM (#21857803)

When I was a little boy, I heard a myth about argument between the US and Japan, The US said, we can remotely bomb any place that has a Television, and Japan replied, we can remotely bomb any place that has a Transistor Radio. I totally believed that back then.

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by yangwenli on Sunday December 22, 2019 @05:03AM (#21856242)

Its okay when America does it.

But is it really bad? Generally countries don't go to war over spying. If the US or China or anyone really can listen in to mobile networks I'm fine with that. State secrets shouldn't be discussed over an open phone line anyway.

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by javajosh on Saturday December 21, 2019 @03:14PM (#21853126)

I was sort of hoping someone here would tell me I'm being paranoid, or that there is a way to externally verify a chip with ~10nm features...or that there is some other reason why the nation that is the world's 3D printer won't do this.

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by namibj on Sunday December 22, 2019 @12:46PM (#21858498)

Free-electron lasers could use _coherent_ soft-xrays to basically "Hologram" the interesting parts (maybe after grinding it to be very thin).

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by kjaftaedi on Saturday December 21, 2019 @04:17PM (#21853418)

One would think this problem could be easily resolved with carriers publishing version numbers and checksums.

I don't feel like this would be an unreasonable request, and possibly something that should be mandated by law.

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by kjhrwerklj on Saturday December 21, 2019 @03:21PM (#21853170)

So while the location of basically everyone with a smartphone is continuously uploaded to private companies, you say we should worry about what China/NSA might do in the future...

Nothing to see here, move along, oh, look, a shiny enemy there...

[ Parent | on HN ]

Re:Smartphones and the location data marketplace by dang on Saturday December 21, 2019 @03:26PM (#21853195)

Please don't post in the flamewar style to HN. We're trying for something different here.

https://news.ycombinator.com/newsguidelines.html

[ Parent | on HN ]