101

tl;dr No, this completely falls within the realms of fiction! The longer explanation For something like this to work, Alice would need to find an exploit in the camera of Bob, which would then prevent Bob from taking a picture. The only ways of Alice to exploit Bob's camera is for her to send some kind of information to it. Possible ways for her to do ...


72

TLDR: There are several categories of security you must consider when looking for a phone. The main advice, though, is to get a newer phone with the latest security features, and from a manufacturer that has a good reputation of providing updates. Security against other people (peers, police/government) Look for newer devices with full disk encryption, and ...


71

Unless you have secrets on that phone that someone would pay a lot of money to uncover, you don't need to go overboard. A factory reset would work just fine. To decrease the chances someone would still recover something, point the camera out of the window and let it record until it fills up all memory. Repeat if you want. Doing that will overwrite almost ...


68

By just passing (potentially malicious) traffic through, it is very unlikely. After all, routers on the Internet are relaying tons of malicious traffic everyday without getting compromised themselves. However the danger begins when your computer itself gets compromised from a malicious file downloaded via torrents, and from there the malware on your ...


63

Has the security of the basic phone call changed much, in the last 10 years ? So, do smartphones utilise anything new [purely in] the initiation and connection of just the phone call itself ? Yes. There are new technologies used to establish phone calls in cellular networks. Those new technologies mitigate some attacks which were possible due to flaws in ...


59

One of the key aspects to consider for this is the support/patching policy of your mobile device vendor. If you're planning to keep the phone for say 2-3 years you don't want it to go out of support after 18 months. Unfortunately this can be quite tricky information to come across with many vendors not providing published support lifecycles. Also ...


49

Under the assumption that you have a somewhat recent phone (Android 6+ installed from factory, I don't know for Apple but read something about from iPhone 6 on): Wipe the phone/do a factory reset (assuming the phone is still working) Modern devices always encrypt all the data and only delete the key for this encryption if you wipe it. This makes it ...


47

"Physical access = game over" is an over-simplification. It absolutely boils down to the outcome of a threat assessment, or what the vendor needs to protect and to what level. The direct answer to your question is a great big 'it depends'. Smartphones are no different than other devices to the extent that they are computers running an operating system of ...


45

A sophisticated threat actor could potentially try to exploit the Android Debug Bridge's authorization protocol by switching your phone's storage media to another same model phone with already active ADB/ADBD authorizations (based on HWID like the network chip's MAC address) and maybe some additional tinkering. From then on, provided he knew how to get ...


43

There is nothing stopping an attacker from putting a powerline ethernet transceiver as well as a USB-enabled microcontroller into a USB charger. This would allow them to communicate with the charger in the hope to offload some malware onto a smartphone plugged into that port. However, such a device would need to be highly specialized and specifically ...


41

I don't understand why you don't want a password manager that works on both? Your non-tech friends that don't use a password manager yet are too limited by your requirements. You seem to be running in paranoid mode. Your friends want something that is convenient. If you can get them to move to Lastpass, that will be a huge improvement over their current ...


37

The other answers regarding encryption are great. I'm going to approach this question from the tinfoil / dissident angle, as I believe it's valid for nearly every scenario... but I still want to explain my reasoning, and how I came to these conclusions. All of the problems I'll discuss are routinely exploited by criminals, and repressive governments. In some ...


33

Data dealers often buy data from multiple sources and aggregate it to generate an all-compassing user-profile from it. For example: xyz company sold your telephone number and what the conversation was about. social network which asks for your phone number for password recovery sold your telephone number and your ip address at some point in time. ...


32

When your phone is acting as a hotspot it's basically just a router connecting two protocols together (802.11 and either LTE or GSM). It's not actually interpreting any of the data passing though, as that would use a lot more CPU and memory. It's literally just passing data back and forth at OSI Layers 2 and 3. That said, it's no different than other ...


28

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and ...


28

Without full-disk encryption, your unencrypted data can be read without recovering the pincode. Enabled USB debugging, definitely, extends the attack surface, but it's not necessary for a determined and skilled thief. But most likely, they will wipe everything and resell your phone to get the daily dose.


28

All android 7+ devices are equipped with Trusted Execution Environment (TEE) as a mandatory requirement for Google apps licensing. It's a hardware backed keystore which provides isolated storage and data processing for cryptographic blobs. In Qualcomm Snapdragon and Samsung Exynos SoCs, TEE is based on ARM Trustzone. Some devices like in Pixel and iPhone ...


23

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in the ...


22

Case in point: Snowden uses a feature phone (i.e. 'dumb phone). A few people would like to attack his phone, but even if they succeed, it's a very limited reward. OpenMOKO is an example of such a phone. An attacker will likely need a good working knowledge of the system he is trying to penetrate, and android is easy to persist on once in. Harder to persist ...


22

Without the encryption, your data can be trivially read out using a flash adapter such as this one: Removing a flash chip is a 5 minutes job on a hot air rework station. Of course, this assumes that the thief decides that the data on your phone is worth more than they could get by wiping and reselling it. If you have an old inexpensive phone or it has ...


22

As a general concept in information security, physical access is a rather severe attack vector. Standard x86 PCs and servers are particularly vulnerable because they have little or even no mitigations against physical threats. Some things like disk encryption can help, but it is just not a significant design feature. Smartphones treat the threat more ...


21

Yes, it's possible. A malware can simply utilize the SMS functionality in your phone to transmit formatted data from and to your phone. Heck, it might even use DTMF. Update: After your edits, your question turned from acceptable to really bad. In any case, the most plausible scenario here is via Bluetooth. However, I think you're just very paranoid and/or ...


20

Look at the authentication methods for unlocking phones. On my galaxy S4, there are: Swipe (no security) Face Unlock (low security) Face and Voice (low security) Pattern (medium security) PIN (medium to high) Password (high) From personal experience, the face unlock is kind of hard. You have to train it, and then you have to stick your face in the right ...


19

By disabling WiFi and mobile data, you shut down some attack paths. That means that your system is more secure, and probably immune to most "script kiddies" attacks. However, the telephony part will still be active. It is certainly harder to exploit, but a smartphone is far from a 1960s telephone, and even the telephony part has interaction with the phone's ...


18

TL;DR: the answer is yes, given enough (unrestricted) physical access, skills, motivation, and resources. Long answer Those laws are often very general laws that express general concepts in information security. In this case, the law says that the attacker generally needs unrestricted physical access. And when they say it's not your computer anymore, it ...


17

As the Telegram FAQ mentions, there is a 'secret chat' option that does not store chats on their servers. As for the underlying question of, "does storing chats lower their security?" then that is something to consider. Chats being stored on the server does mean that copies can be made on the server for decryption later. This increases the exposure of the ...


17

You aren't hacked. Well, not by this link anyway. I opened the link you provided on a cloud instance and proxied the connection through Burp Suite so I could track exactly what happened with the redirects. Turns out it is a grabify.link link. Grabify offers url shortening and provides some level of detailed information about who follows the link. This ...


17

TL;DR: By December 6th, 2018, Google stopped serving Nearby Notifications. Android users won't receiving this kind of notifications. How were they able to push a notification? As @Martin F├╝rholz pointed out, that was came from Google Maps notification service. Specifically, from Nearby Notifications feature that being developing by Google for the last ...


16

EFF's Secure Messaging Scorecard currently rates "Telegram (secret chats)" with a 100% security rating. However, the software of the servers Telegram uses is not open; cf. the FAQ "Why not open source everything?" WhatsApp was docked on the "Is the code open to independent review?" metric. Telegram is now completely open; source code here. Being open, you ...


Only top voted, non community-wiki answers of a minimum length are eligible