Timeline for Does the saying "physical access = game over" apply to smartphones, too?
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 8, 2020 at 10:08 | comment | added | Alexander Fadeev | @Peteris There is a difference between offline attack and runtime attack. If the questioner asked about ANY attack, "could I get pwned", it would be another discussion. Your example is a runtime attack against the unlocked phone which can be carried out remotely without physical access. Why would we discuss this case in this thread? With the same success we could consider just any phishing. Obviously apps have vulnerabilities, and even your example affects a single sandboxed application. You cannot just cast "zeroday" and "Celebrities" words here and there. | |
| May 8, 2020 at 8:55 | comment | added | Peteris | @AlexanderFadeev they can't hack everything, they do need to have obained an unpatched zeroday, but those exist. Military forces using off-shelf phones does not imply that off-shelf phones are uncrackable, it is the whole reason why other military forces may want to buy such services for use in battlefield forensics. E.g. that Samsung Galaxy S9 was vulnerable to zdnet.com/article/… ; Cellebrite advertised that they can crack these models, so they may have bought that same vulnerability a year or two ago. | |
| May 6, 2020 at 8:02 | comment | added | Alexander Fadeev | @Peteris Maybe I will surprise you, but even they cannot hack everything. And military forces also uses mobile phones indeed. Some special secret military phones with self destruction from movies? No, it can be just, say, Samsung Galaxy S9: samsung.com/us/business/solutions/industries/government | |
| May 6, 2020 at 0:37 | comment | added | Peteris | @AlexanderFadeev a few specialist companies like Cellebrite have such solutions available (cellebrite.com/en/ufed-premium) which are known to work on up to date phones but they are not available to the open market - they sell the services (and often just the actual unlocking of particular devices by their people in their premises, not the actual software/knowhow/zerodays) to selected customers e.g. law enforcement and military/intelligence services. I mean, one should not be surprised that zerodays for phone OS exist; but they're quite expensive and usage risks "burning" them. | |
| May 5, 2020 at 9:40 | comment | added | Alexander Fadeev | @paj28 Only a limited capabilities are accessible in Android right after the boot: source.android.com/security/encryption#full-disk (almost everything doesn't work after the boot) | |
| May 5, 2020 at 9:31 | comment | added | paj28 | @AlexanderFadeev - Look I don't want to have a long conversation about this, but you do not enter a 256-bit key at boot, there's a kind of TPM that holds the key. | |
| May 5, 2020 at 9:23 | comment | added | Alexander Fadeev | @paj28 Not exactly: imagine that you use a random 256-bit symmetric key, the storage is then encrypted on that symmetric key using AES256, then you reboot device, and drop it away. The only way at this world to "hack" your device is to brute force the key. There is no magic tool in CSI and FBI against that. That's happen on a modern mobile device.... But if you still remember the key, they will do thermorectal cryptanalysis :) | |
| May 5, 2020 at 9:05 | comment | added | paj28 | @AlexanderFadeev in the open market | |
| May 5, 2020 at 7:38 | comment | added | Alexander Fadeev | It is a huge trendy oversimplification: there are magic tools which allows you to hack, and also FBI... Let take a look at "dr.fone": while unlocking the phone it erases all data. "Please note this unlocking process will also wipe the data on your iPhone/iPad. Honestly there is no solution to bypass iPhone/iPad lock screen without data loss for the moment in the market." | |
| May 5, 2020 at 1:00 | history | edited | Mike Ounsworth | CC BY-SA 4.0 |
added 27 characters in body
|
| May 5, 2020 at 0:55 | history | answered | Mike Ounsworth | CC BY-SA 4.0 |