4

The EFF Secure Messaging Scorecard lists a number of apps that meet all of its security criteria. So assuming that end-to-end encryption is accessible for the majority of people in countries in which encryption is legal, how do intelligence agencies listen in? It seems like in the case of a high-value target (Alice), the strategy would be to hack into Alice's endpoint.

I'm wondering about the security of mobile phones versus laptops. Laptop users have a bunch of choices to increase their security (use Linux instead of Windows, use TOR, use TAILS, etc.). But after reading this article I'm thinking about how cellular device users are stuck with a device with a baseband chip running a propriety O.S. that is in constant communication with a cellular company that is forced to cooperate with intelligence agencies. In other words, can't the NSA just ask Verizon to send Alice's iPhone malicious data via cellular that will cause her baseband chip to read something from memory (like her private key) and send that back?

In light of this concern, is usage of a device NOT connected to a cellular network preferable for keeping your communications private?

1

Most phones have the cellular network interface share some memory with the main processor (I wonder if it's cooperation between manufacturers and carriers/law enforcement to give them potential access to the phones?). As a result, a compromised/malicious cellular NIC could take over the entire machine.

There are ways to mitigate this without completely disconnecting from the cellular network though. For example, this guide explains how to harden an Android tablet, and they use an external cellular modem connected over Wi-Fi (which limits its ability to do nasty stuff). USB dongles are also safe assuming you protect against BadUSB (if the dongle suddenly decides to turn into a "keyboard" and starts typing in malicious stuff). A separate mobile phone used as a hotspot would also be safe.

Basically all you need to do is get an "external" cellular modem, something that doesn't directly have access to your system's memory. Once that's done, the rest is standard network security techniques which are fairly well understood and there are many questions on the subject already (and a phone in this case is no longer that different from a standard networked computer).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.