Schneier on Security

Clive Robinson • December 19, 2016 4:14 PM

Hmm, one thing to note,

He could also use it to spy on everything the thief did, provided there was an active internet connection at the time. He could take photos and record videos, enable the microphone of the device to snoop in on conversations, collect all location data, read all the text messages, access call history, check contacts, and see all the contents of the phone.

What is the betting that a Law Enforcment Organisation version does not need an Internet connection?

Clive Robinson • December 20, 2016 3:42 AM

@ 65535,

The lesson for the average Joe is not to use smart phones altogether or just not communicate sensitive information while using them.

The problem with “not communicate sensitive information” is knowing in advance what is and is not sensitive, and it does not need to be a smart phone to foul up.

Look at it from a possible consumer concern. Every friday you go and buy a six pack and nachos from your local franchise. You always pay cash and text your partner to say you’ve got the stuff and are on your way, and then you drive home, you are in effect “regular Joe”.

Then one day you have an accident… It’s then you find out that somebody can tie your cellphone location records back get your text messages, and store video footage and paint you as a dangerous drunk menece to society and that you should be locked up for forever and a day with the psychos etc etc… Then you get a plea deal offer…

It’s the direction we are heading in and joe public has a lot to learn even about dumb mobile phones, transport cards, toll tokens, plate reader cameras etc etc. The authorities are not realy interested in fingering the “right collar” but “any collar”, and doing deals to cut corners and meet efficiency / bonus targets, all whilst immune from any consequences.

After all “it’s what you voted for” only you didn’t, you were voting for change or 3cents off of tax etc etc…

Clive Robinson • December 20, 2016 4:40 AM

@ Winter,

… in July 1789, when the French did get all the “change” they could ever hope for…

And they became even more unsufferable as well 😉

Nearly all revoloutions do not solve a problem they just change one set of veinal incompetents for another set, and it’s the “same old same old” at the end of the day just different faces and flags, great if you sell flags and bunitng, but not otherwise. As one wit once noted “It’s called a revolution because like the Catherine wheel it goes around and around driven by gun powder, but it does not go anywhere”.

As for taxes, it rather depends on your viewpoint. They should be used for “the common good” or for what they are claimed to be for. The reality is as most would agree, somewhat different.

There is the philosophical point of “Are you being moral if you activly perpetuate that which is immoral?”

Clive Robinson • December 20, 2016 12:27 PM

@ Winter,

The gullible are punished.

Oh that it were only the gullible.

Politicians lying for votes has become a science, and most people want to live a life, not chase lying scumbags down and hold there feet to the fire.

Traditionaly that was what journalists were supposed to do, but now they are treated as badly as the proprietors can get away with whilst they schmooze with the politicos and celebs (see “two beards” of the Evening Standard). In the UK we have the Rupert “the bare faced lier” Murdoch and his “Red Top” “Scum” etc. We also have “The Guardian” supposadly a bastion of “social conscience” that Bruce used to write pieces for when they were actually paying for the well thought out writing.

Well you ask the jobing journos and photographas there now who are on zero hours contracts and laid off for a month or so about once a year to stop them getting employment rights. Then there are all the hopefull interns working 90 hours a week for bus fare and a cheap sandwich being used doubly as unpayed labour to generate click bait and as a threat to those who still get payed the wages they had a decade ago. That’s “Free Market MSM” for you, oh and there’s all that click bait and celebrity flesh flashing for online offerings, with adds trackers and even God knows not what else being shoveled your way…

We are told to worry about “Phoney Facebook News”, but who’s telling us to worry about “Phoney MSM News”.

Oh you mentioned you potential “little Trump” (or assqueak). Well you might have heard of the UK’s Nigle Farage… Who thinks he’s responsable for the Trump Victory as well as Brexit. Well he’s so full of himself he’s not being as cautious as he should be with that motor mouth of his…,

https://www.aseanbreakingnews.com/2016/12/an-anti-fascism-group-is-crowdfunding-a-bid-to-sue-nigel-farage-for-defamation/

Then there’s this,

https://www.theguardian.com/politics/2014/apr/20/marine-le-pen-nigel-farage-slander-antisemitism-claims

And of course he’s stil upset over,

http://www.bbc.co.uk/news/uk-38064664

As Private Eye would say “He’s obviously ‘tired and emotional'” though he’s not yet stooped to the lows of “Discussing the Uganda position” but that will as they say “no doubt come eventually”.

Clive Robinson • December 20, 2016 10:19 PM

@ 65535,

But, the thread focused on “smart phones” with processors and fairly large amounts of memory, GPS, camera and mics.

Which got subverted to a very serious level by someone who is not a computer security expert, LEO or even PI / Gumshoe. Just an “ordinary joe or jo”. So now the jealous partners or even employers can track your every cough or sneeze etc…

Which brings us to the idea of technical countermeasures like,

… you have a faraday cage or elector-magnetic blocking plastic bag.

But it’s not that simple any more. Think about the “before and after” logs at your service provider that in the US the Gov now gets access to for free 24×365.25. The metadata can show not just the location and time but things like battery state and if you turned the phone off or not. Thus the use of a Faraday Bag or box etc can be deduced automatically on all phone users. Thus you become a “Person of Interest” simply by being cautious and taking technical security measures.

Which could then be used to suggest criminal intent, premeditation or even conspiracy, and makes you look as guilty as hell.

You would actually look less guilty if you went “old school” and put the phone on charge in the bedroom in a draw in you bedside table, turned on the bedside radio and shut the bedroom door…

Thus it’s not “what you do” but “how you do it” as it realy matters “how it looks” to a jury when presented in the worst possible way.

But, it’s also the way your phone is also an “atomic clock” record synchronization device. Unbeknown to many is just how acurate time wise service provider logs can be made to look. Those time stamps are traceable to an atomic clock and are often given in mind numbingly short periods of time (think the time it takes light to travel less than 100ft). Which can give a very false impression to those who do not know just how long it can take for information to get into the logging process (seconds or minutes). The problem is that those time stamps not only make searching other logs/records etc much much easier, automaticaly by authorities, but can also be presented in a way to make a person look like they are lying, much like the “Do you still beat your wife?” question.

It would be nice to think that the logs could clear you as well, but it does not work that way these days. There is the pretense that LEOs would look to “rule people out”, actually they don’t as such. What they do is use information to find a short list of likely suspects then focus on proving it’s one or more of them. As that list gets shorter they actually start ignoring contradictory evidence because they are already in to the state of mind you are guilty, but lying, thus they are looking to disprove what you say, not to prove you are innocent. This can be seen from the large numbers of wrongful convictions where it has been found that evidence was “lost” thus never came to the attention of the defense team. It’s the old game of “Police are as honest as the day is long, but criminals are deceitful lying parasites on society” where as in fact the Police are way more practiced at lying…

The thing is we are getting into “Push a button” automated law enforcement more and more and the mindless “The computer says” attitude that goes with it. People rarely hear of GIGO these days or the fact that various studies have found that large data bases of PII data such as credit checking databases upto 80% of records have been found to have one or more errors in them… Likewise the FBI DNA database was found at one point to be less than accurate (apparently unsuprisingly there have been no further independent studies).

Good or bad, data gets kept forever these days, as somebody thinks there is money to be made some how at some point. The problem is that in humans memory ages in various ways[1], thus our ability to defend our selves ages and diminishes quite rapidly unless we have reason to remember, then sometimes we can not forget and our memories get twisted.

Sometimes it feels as though the only defence is 100% “life bloging” but that to has it’s problems…

[1] I’ve heard it likened to box files in a room, where the most accessed are closest to the door, the least hidden in some dark dusty corner at the back buried under others and probably with mice nesting in it…