Schneier on Security

Roger • August 29, 2005 4:41 AM

@B-con:
“In all honesty, how hard could it have been for Cingular to wipe the data off of the cell phones?”

Well, first off it appears the phone was sold illegally before Cingular had a chance to wipe it.

Secondly, “how hard” depends on the phone, and can be a lot harder than it looks.

One of the trickiest ones I’ve found is if you teach the T9 spelling algorithm new words. On many (not all) phones on which I’ve tried it, it doesn’t seem possible to subsequently erase them, in any way at all. So if you teach your phone to spell, say, ‘chlamydia’, then forever after it will be easy for someone to confirm that I’ve sent an SMS about a rather personal illness. (As a non-security aside, it is double-plus ungood if you accidentally teach it a misspelled word, especially one with a common numeric sequence.)

Not as yawning a security hole as some, but interesting that you can’t get rid of these words, period.

Other things include WAP access credentials, which may be erasable but are easy to overlook, and are buried as much as 8 or 9 levels down in a clumsy menu system that is slightly different for every model of phone.

Here’s another good one: on my phone, in the calendar application, if I make a day memo and don’t know about “auto-delete”, then the only way to erase it later (if you can’t recall the actual date) is to scroll back in time until you find it, open it up, and select “erase”. If, like many people, you have thousands of memos dating back several years, then erasing could take many hours and give you RSI of the thumb. Now it happens that if I drill down to the auto-delete menu and set “auto-delete after 1 day” it will immediately start erasing all existing entries older than that — but this feature is not documented (I had to discover it by experiment), and only works on “single event” memos, repeating ones must be done one by one.

Basically, at the moment this is just far too hard. And as someone else has pointed out, it doesn’t need to be. The characteristics of Flash devices are such that it would trivial, and have negligible cost, to include a simple electrical switch that erased all user-programmed Flash memory. It could also been done in software, at negligible cost. Note the “user programmed” part. A key fact is that you need to clearly delineate between stuff entered by the user, and stuff built in at the factory. If you erase the latter, you might turn the phone into a paperweight. However this should not be an especially difficult problem unless the file system design is totally brain dead.

@Clive Robinson:
“Now imagine, you manufacture, phones, you put a short cut menu item in that will clear the phone book etc, imagine how many customers will either use it by mistake, or worse accidently”

This is a valid point, but it is also a fairly well understood one. A variety of methods exist to guard against it. For example, a hardware switch could be hidden in the battery compartment, and need to be depressed by the point of a pen or similar.

“due to having the phone in their pocket (how many of you have accidently dialled this way?).”

My phone has a keypad lock which, to unlock, requires two keys on diagonally opposite sides of the keyboard to be pressed, in the correct order, no more than 2 seconds apart, but not simultaneously. It’s very easy to operate intentionally, even without looking at the phone, but it has never operated unintentionally. And yes, I normally carry it loose in my pocket. However I’m inclined to go with the recessed switch beside the battery. Much closer to fool-proof, and also simpler to implement.

“If you are in the business of issuing phones as part of a network contract, you are not going to be too happy if the repair process unlocks the phone, so the user can start using it on a more advantages network.”

Yes, you clearly need to delineate between user data (which should be able to be wiped) and “built in” data which includes things like SMS connection string and definitely should not be erased. But that isn’t exactly rocket science.

“Then if you a theif who steals phones, imagine your delight at having a function that compleatly clears the phone removing all the phone ID info would be wonderfull, as the tracebility effectivly becomes zero.”

If it’s a GSM phone, it can be traced by the IMEI, which is hard-coded into the phone and used to identify it to the network. In fact the IMEI is the only really useful tracing information. Presumably other cellphone protocols have something similar. (Important security tip: if you haven’t already done so, enter *#06# into your phone, and it will display its 15 digit IMEI. Write this down and keep it somewhere separate from the phone. If your phone is lost or stolen, report this number to your phone company, and most ethical telcos [1] will be able to disable the phone over the air.)

“Finaly imagine you are a policeman who has pulled up a “suspect” for drugs or other illegle dealing activities. You releive them of their phone before putting them in to a holding cell, you can then look through their phone details to see if you can tie them into other criminals or their activities. You lose this if they have a quick way to deleate the details.”

By this logic we shouldn’t sell matches because crooks might burn their evil plans. The fact is, many phones already provide a way to make this information very difficult to access: the PIN code lockout (which however is no use to the honest man selling his phone, because he needs to give the buyer access to all the phone’s functions). But if the police are sufficiently interested, they can take the phone back to their forensic labs and have the PIN overridden. And if they are sufficiently interested, they can also extract quite a lot of information from a Flash chip which has been “erased”. If you want additional protection, you can make the “erase all” function quite slow, with an ability to abort by, say, pulling the battery out. That would be no inconvenience to the typical user (who probably knows at least days in advance that he plans to sell the phone) but would enable phones seized under warrant to have their information retrieved. Meanwhile, for an honest user who has the phone stolen, PIN lockout is sufficient.

“As an asside, it is also quite difficult to securly erase mutable but non volatile memory devices. Even dynamic ram chips have been known to retain usefull and recoverable information some period of time (hours) after all power was removed. Also Static memory sufferes from a modicum of the “burn in” process (similar to that of the old VDU screens).”

Quite true. But I don’t think anyone is demanding that protection from this kind of attack. Just something slightly better than we have at the moment, where it is all too easy to given up massive amounts of extremely personal information to even a casual snoop.

“Security is subject to the laws of the market place just like everything else, you want a feature then you pay for it (one way or another).”

The problem is, what a lot of people don’t know or else forget, the laws of market forces provide for reaching market equilibrium only under the assumption of perfect information, whereas security problems are often difficult for the layman to see or understand (ie. people aren’t demanding these sorts of features because they don’t even realise that the problem exists). Consequently, we find in many security applications that people fall into two categories, those who have been fscked in the past and want steel bars over everything, and those who haven’t (yet) and think only a paranoid changes the PIN on his phone. As security professionals, part of our job is to realistically evaluate the relative risks and costs to help people make these decisions better. In this case, the risk is moderately high and the cost is very slight, so if we do our job people should soon be demanding such features.

Note 1: Yes, this is an oxymoron.