iPhone Malware that Operates Even When the Phone Is Turned Off

Researchers have demonstrated iPhone malware that works even when the phone is fully shut down.

t turns out that the iPhone’s Bluetooth chip­—which is key to making features like Find My work­—has no mechanism for digitally signing or even encrypting the firmware it runs. Academics at Germany’s Technical University of Darmstadt figured out how to exploit this lack of hardening to run malicious firmware that allows the attacker to track the phone’s location or run new features when the device is turned off.

[…]

The research is the first—or at least among the first—to study the risk posed by chips running in low-power mode. Not to be confused with iOS’s low-power mode for conserving battery life, the low-power mode (LPM) in this research allows chips responsible for near-field communication, ultra wideband, and Bluetooth to run in a special mode that can remain on for 24 hours after a device is turned off.

The research is fascinating, but the attack isn’t really feasible. It requires a jailbroken phone, which is hard to pull off in an adversarial setting.

Slashdot thread.

Tags: , ,

Posted on May 18, 2022 at 6:06 AM • 40 Comments

Comments

John • May 18, 2022 6:53 AM

Hmm…

Isn’t open source wonderful….

Even if you have to reverse compile it yourself!!

John

RapidGeek • May 18, 2022 8:12 AM

If it is in the Bluetooth chip, then is it applicable to android devices as well. I would assume so unless there are some additional protections. Very interesting and a bit scary

Ted • May 18, 2022 8:25 AM

Big ask in the research paper:

Apple should add a hardware-based switch to disconnect the battery

I haven’t yet figured out why the Bluetooth chip would have been designed with less security than the other two wireless chips (NFC and UWB).

The NFC chip has encrypted and signed firmware. The UWB chip has firmware that is signed, although not encrypted. However, the Bluetooth chip’s firmware is neither signed nor encrypted.

https://arxiv.org/pdf/2205.06114.pdf

Clive Robinson • May 18, 2022 8:44 AM

@ Bruce, The usual suspects, ALL,

Researchers have demonstrated iPhone malware that works even when the phone is fully shut down.

As long as there is power connected to a chip with a suitable state machine or microcontroler in it, as well as indipendent communications IO this is going to happen.

Which brings us onto,

“[I]t turns out that the iPhone’s Bluetooth chip­ — which is key to making features like Find My work­ — has no mechanism for digitally signing or even encrypting the firmware it runs.”

It would not matter if it did have both features. Both have been bypassed in various ways on other chips over the past three or four decades.

But everyone should remember that at the bottom of,

1, Code signing –which uses–
2, Encryption.

There is a “Root of Trust” that has to be embeded in the CPU chip.

Secondly and more importantly for code to execute it can not be encrypted –currently–. Even if you could, stopping a side channel existing that did not leak information that would assist in key recovery would be at best difficult and highly inefficient.

But of interest is another very recent attack on Bluetooth, which is to do with BLE and range limiting security…

Even though the Bluetooth SIG do not specifically say the range limit function of BLE is a “security feature” many people use it as such.

One such is Tesla who use it in their “owner token present” assumption to deactivate locking of the doors, engine and much else. Just so Tesla owners can “bum bounce” opening doors etc rather than actually turn a key in a lock.

Well another security group has shown how to in effect increase the security range eight to ten fold by a very simple technique (move down the comms stack). Which enables “Relay Attacks” to become much more easily possible,

https://www.theregister.com/2022/05/17/ble_vulnerability_lets_attackers_steal/

Now in your head, combine these two attacks into one and see what it actually means for quite a large number of supposadly secure Bluetooth BLE based systems, of which there are very more than most suspect all using phones and smart devices and similar.

As they say “Welcome to my world” trying to tell people not to do things that were known to be stupid into atleast four decades ago… Yet “Marketing and Sales” and similar will neither learn from living history of ICTsec or even listen when you tell them… But will blaim you when what you warned of does indeed happen…

Andrew • May 18, 2022 10:20 AM

A hardware switch is problematic for many reasons. First, the actual physical space requirements are hard to fit into today’s slimline phone designs. Second, and more important, there are things that still need to run even when “off”; the immediate item that comes to mind is the real-time clock. It’s simply not feasible to put a second dedicated battery for the clock into a phone that takes up space, can run down over time, etc.

Winter • May 18, 2022 10:42 AM

@Andrew

Second, and more important, there are things that still need to run even when “off”; the immediate item that comes to mind is the real-time clock.

There are quite a number of phones that do have a hardware switch for a silent mode. That could also be used to construct a hardware airplane mode. It could also disconnect the microphone and cameras. If my phone is on silent, I really do not want to use it.

Officially, none of the connection chips should work in airplane mode, enforcing that with a hardware switch should not be problematic.

lurker • May 18, 2022 10:55 AM

@Ted

NFC is used for transactions involving money. UWB was invented at a time when people had started to think what they were doing. I can’t remember what BT was intended to do, but one of its first major uses was for playing bop over boom boxes, hardly a major security risk.

kari • May 18, 2022 11:47 AM

The differing firmware-security requirements between chips remind me of Michael Steil’s 2005 talk “17 Mistakes Microsoft Made in the Xbox Security System” (Xbox dashboard loads audio, 3D meshes, fonts; it hashes audio, 3D meshes… but not fonts). There’s probably no good reason, and the less-restrictive component will naturally attract the attention of attackers.

@ Andrew,

First, the actual physical space requirements are hard to fit into today’s slimline phone designs.

People often ask for switches, or for removable batteries. Apple tends to just dismiss them with “ack! thickness!”, although extreme thinness isn’t something that people actually seem to be clamouring for. (People do seem to be interested in below-average width and height. There’s the iPhone mini for that, which is not much smaller though apparently few Android phones can match it.)

Similarly with the headphone jack, Apple claims size and waterproofing constraints and dismisses the requests; although other manufacturers had produced waterproof jacks that didn’t take a huge amount of space.

Second, and more important, there are things that still need to run even when “off”; the immediate item that comes to mind is the real-time clock. It’s simply not feasible to put a second dedicated battery for the clock into a phone that takes up space

How important is the real-time clock? Is it impractical to get a quick enough timesync from the phone network, GPS, or NTP? I have a laptop that sometimes loses the time, and apart from the logs showing bad timestamps at bootup it’s not a big deal; even that could be easily fixed in software. I don’t know why any software would really need accurate time before network access. Unfortunately, many software time APIs aren’t designed to provide an “I don’t know” response; obviously that’s bad design and ought to be fixed, and given how often I’ve seen embedded systems boot up in “1970”, I’m retroactively shocked nobody’s fixed it.

Could a capacitor reduce the space requirements compared to a battery? Most people wouldn’t regularly turn their phones off for more than 12-24 hours at a time (let’s say 100 hours for a work phone on a long weekend), so it doesn’t need to last 5-10 years like a watch battery (which isn’t huge itself).

I see no good reason why any of the wireless chips would need to run for 24 hours after turning the phone off.

Quantry • May 18, 2022 12:20 PM

@ Gang

The statement

the attack isn’t really feasible

mis-leads us to believe there is no feasible attack:

APPLE ITSELF still has access. This IS a successful attack against a user who thinks the phone is off: There is no other way to say it. IT IS MALWARE.

ONCE AGAIN, the users’ own devices are their worst enemy.

(Use an RFID Faraday bag, during off times.
h–ps://www.cisa.gov/ recommends
defendershield.com/shop, shop.faradaydefense.com, and mosequipment.com

Or insist on owning a device with a removable battery.)

@ Andrew, I ran my last two phones just fine with the battery removed between calls. And my POTS phone never had a clock for 30 years prior to that. IMO, lying to, and entrapping users is not justified by the necessities of deceitful contrivances.

@ Winter, “OFFICIALLY”, isn’t it the MODEM, NOT the transmitter that is powered off in airplane mode?

…the central problem with cell phone use today is you have NO IDEA what the hell its doing at any given time…
– Ed S.

h–ps://www.youtube.com/watch?v=VFns39RXPrU

Ted • May 18, 2022 1:18 PM

@lurker

Re: Uses of NFC, UWB, and Bluetooth

Here’s a feature I’d never heard of… Digital Car Key (DCK). I guess it’s supported by Ultra-wideband (UWB) and Bluetooth. So says the paper.

…the Bluetooth and the UWB chip are able to operate standalone while iOS is powered off. These capabilities are undocumented and have not been researched before.

From bop to beep beep.

tfb • May 18, 2022 4:48 PM

@kari

Without a real-time clock it would be impossible to turn the device on and use it (causing timestamps to be recorded in the filesystem) without it seeing a network, and thus probably revealing its location. So, yes, real-time clocks matter, quite a lot, if you want to be able to use the device off the network after it’s been off.

However I suspect real-time clocks can be kept alive for a very long time from big caps: you don’t need a special second battery.

SpaceLifeForm • May 18, 2022 5:09 PM

@ Andrew, Clive, ALL

hxtps://arstechnica.com/gadgets/2022/01/the-pinephone-pro-brings-upgraded-hardware-to-the-linux-phone/

The phone has a 6-inch, 1440×720 LCD, 4GB of RAM, 128GB of eMMC storage, and a 3,000 mAh battery. There’s a USB-C port with 15 W charging, a headphone jack, a 13MP main camera, and an 8MP front camera. The back cover pops off, and inside the phone, you’ll find a removable battery (whoa!), a microSD slot, pogo pins, and a series of privacy DIP switches that let you kill the modem, Wi-Fi/Bluetooth, microphone, rear camera, front camera, and headphones.

I would only enable headphone jack and the WIFI/BT for the use case that I think about.

It would be better to be able to separately disable WIFI and BT, but that would increase costs. As long as I do not use any BT functionality, AND the chip can not LEAK via BT while using WIFI, then this can be useful. The problem is that it may be able to leak because of the radio using 2.4 GHz for both WIFI and BT.

Having a 3.5 mm headphone jack is very useful, as then you can have a more secure MFA because it would require complete physical contact, not just radio proximity.

That Apple eliminated headphone jack should tell you something.

The relay attack can not happen if an MFA security token requires headphone jack.

Important to note: The headphone jack supplies power to your security token.

SpaceLifeForm • May 18, 2022 7:13 PM

@ tfb, Clive, ALL

In the Land of Confusion

Without a real-time clock it would be impossible to turn the device on and use it (causing timestamps to be recorded in the filesystem) without it seeing a network, and thus probably revealing its location.

Completely wrong.

It depends upon your use case.

I can live boot a computer, with my root filesystem existing entirely in RAM, and I can make it usable whilst not giving a care in the world what the clock thinks the timestamp is. And no net.

My filesystem is throwaway. I don’t care about the timestamps. As soon as I poweroff, my filesystem disappears.

In the olden daze, upon boot, you would enter the date and time on the console. There was no battery backed clock.

Do not fall into the trap that implies you need net and an accurate clock.

JonKnowsNothing • May 18, 2022 7:57 PM

@ SpaceLifeForm, @ tfb, Clive, ALL

re: Do not fall into the trap that implies you need net and an accurate clock.

Rewritten to:

  • Do not fall into the trap that implies the clock is accurate or an acculturate representation of anything.

===

Of note: The seats are warming up for one of the trials that Marcy Wheeler (emptywheel .net) is following. A fair number of exhibits show manipulated and altered timestamps.

There is a specific set of timestamp-ID-stamps that are used as chain of evidence markers since the same evidence can be passed among different trials to track who-had-it-who-has-it-who-lost-it.

iirc(badly) There will be a LEA Experto to testify or stipulate (unchallenged) about the timestamps and their alterations and how evidence-emails can display 2 different timestamps within the same email and also how those timestamps can alter later, after the fact, to be different from their original presentation.

This should be VERY INTERESTING legal explanation, unless it’s all rubber stamped….

kari • May 18, 2022 8:59 PM

@tfb,

Without a real-time clock it would be impossible to turn the device on and use it (causing timestamps to be recorded in the filesystem) without it seeing a network, and thus probably revealing its location. So, yes, real-time clocks matter, quite a lot, if you want to be able to use the device off the network after it’s been off.

The GPS network sends time anonymously (but doesn’t reach inside all buildings). I’m not sure about the cellular network. With wi-fi, not always, but if there’s an open network, NTP with a random MAC address wouldn’t reveal much.

Why do you think it’s “impossible” to use a device without a good clock? Yes, filesystems record timestamps, but sometime’s that more of an antifeature—like with access times, which is why we have the “noatime” option on Linux. Filesystems like to track btime, ctime, and mtime too; the inability to record these time as “unknown” is something else I view as a design flaw, since very few things really depend on them—particularly in restricted environments like phones, where people aren’t running “find” or incremental backup software (and for the latter, a Lamport timestamp would be sufficient).

I’ve run computers with wrong clocks, and almost every non-networked thing works just fine. With Apple’s level of control over the app ecosystem, they could easily issue an edict requiring “unset clock” support, and I suspect most software would need very little modification.

However I suspect real-time clocks can be kept alive for a very long time from big caps: you don’t need a special second battery.

They absolutely can. The charge can last weeks if no energy is drawn. The question is how large one would need to be, physically, to run an RTC for a useful amount of time. RTCs typically need less than one microampere of current.

lurker • May 19, 2022 1:42 AM

@karl

I suspect a modern RTC could run on a lot less than a microamp; however my back of envelope calculations indicate one microampere could be supplied for 24 hours at typical cmos device voltages from a one millifarad capacitor. Physical size will depend on the dielectric and construction method, which I haven’t been following for a few years.

Clive Robinson • May 19, 2022 5:31 AM

@ lurker, Karl, ALL,

Re : Real Time Clocks

When it comes to,

I suspect a modern RTC could run on a lot less than a microamp

Yes and nearly yes.

A Clock has two parts,

1, A stable oscillator.
2, A counter.

With a little careful thought and design the electronics of the counter can run on pico amps these days, you are only shuffling a very few electrons around a tiny distance for a tiny fraction of the oscillator period. It averages out to next to nothing.

Unfortunately, a stable oscillator, is still after several centuries a physical object in some form of resonance… Once it was a weight on a string, then bars on pivots as pendulums, then escapment mechanisms, to the modern use of beta cut synthetic quartz crystal osscilators running at 32768Hz in a tiny metal tube about 1/3rd the size of a match stick we generically call “Watch Crystals”. Though these are getting replaced with MEMS devices in newer designs at heart they all use physical movment.

As we should know from high school physics, physical movment has various issues, not least being,

1, It is inefficient
2, It is a vector sum of forces

Both of these require a certain minimum of energy to overcome, and it is here that the most energy gets currently used in RTC’s

Can we reduce the energy, yes we can reduce size and mass of the resonator, but that usually means the frequency goes up. Taking the frequency up means more energy gets used in the counter… So we have a sort of “sweet spot” where the curves cross.

In modern wrist watches that could last for ten to twenty years on a tiny battery if not for the batteries self discharge, most energy is used by the display electronics… Those watch batteries are usually slightly smaller than “Super Capacitors” that also have self discharge issues… You could if you have the money and some people do, use a packaged chip size “Nuclear Battery”[1] but they decay as well. Which ever way you play it entropy wins.

[1] In theory you could use a nuclear battery as both a power source and an oscillator that decays at a very precise rate… Not sure if you could do it practically, I’d need a couple of more cups of tea before the old grey porrage between the ears could start working on that.

Peter A. • May 19, 2022 7:35 AM

As already said, quite stable RTCs in cheap wrist watches run for years on a tiny battery quite fine, while powering the LCD display 24/7 on top of that. An RTC chip will run for decades on the charge available in a watch battery if the battery would not obliterate itself earlier (acid or base in the electrolyte eating the housing or internal connecting wires). Damn, it will run on a slice of pickled cucumber. But why you worry? You’ll throw your fartfone in the trash in less than a year anyway to get a new shiny model.

kari • May 19, 2022 12:30 PM

@ Clive Robinson,

In modern wrist watches that could last for ten to twenty years on a tiny battery if not for the batteries self discharge

Well, not too modern, because the cool new thing is the idea of watches that run out of juice in tens of hours, whose non-user-replacable batteries won’t even be able to be recharged in ten years (but don’t worry: there’s little chance the software will still be supported by then, and you can’t replace the provided software). Reviewers call this “all-day battery life” pretty good.

It doesn’t seem that crystal oscillators normally operate within a vacuum, with the possible exception of radiation-hard models. I wonder how much that would help; presumably the crystal’s container would need to be larger to hold a vacuum, and that might negate the size reduction of the capacitor. I really have no idea of the sizes of either component, but Apple’s the type of company that would be willing to experiment/improve/invent these things if they decided it was important.

How much does self-discharge really affect a good watch-style battery? The original CR2032 in my circa-1990 Legend of Zelda game cartridge has been powering some SRAM for upwards of 30 years. That’s not the case for everyone, but it’s not rare. (Unfortunately, when that battery eventually needs replacement, I’ll have no idea how to shop for one that will last as long.)

@ Peter A.,

The point is that watch batteries are dismissed as “too big”. Given that they last much longer than necessary, could we get a much smaller component that would last “long enough”? Then we’d be able to switch off or remove the main battery, with no inconvenient side-effects, when we wanted to be sure the phone was off.

tfb • May 19, 2022 2:04 PM

@SpaceLifeForm

Yes, I am quite familiar with machines that had no real time clock, thank you: I have used many such. And I am fully aware that you can boot machines from volatile file systems.

But, you may not have noticed, we’re talking about a phone. I probably want to do the things people do with phones with it (no, not make calls, no-one does that), like look at calendars (needs the time to be useful), make notes which I would like not to be dated in 1970 (or 1900 if you’re using a proper OS), listen to music where I would like the last listened log to have sane dates &c &c &c.

Indeed, I have a device which I use to do some of the things other people might do with a phone – a little field recorder. It doesn’t have a real time clock, so all the audio it records is dated whatever the FAT epoch is. That’s so annoying (‘when did I make that recording?’) I’m probably going to buy another one which does have an RTC.

If you want the thing to be comfortably useful by actual humans it needs to know the time., because knowing the time matters to most people, it turns out (and phones are how most people know the time). If you want it to be usable only by people who are willing to put up with significant inconvenience … good luck getting it built.

tfb • May 19, 2022 2:29 PM

@kari

GPS is a good point. I am not sure how long it takes a GPS receiver to get a good idea of the time, but it may be fairly quick: I think frames are 30s and each frame has the time. Whether waiting 30s is too long I’m not sure.

As to ‘impossible’: what I meant (which I had assumed was obvious, sorry) was ‘impossible to do the things people tend to like to use phones for which very often require knowing and recording the time’ . See my reply to someone else for more on that.

(Not to mention, of course that the number of programs which will puke their guts all over the floor if the system’s notion of time becomes funny (for instance not monotonically increasing) is not even funny. I have spent too much of my life trying to pick up the wreckage of databases where that happened. )

tfb • May 19, 2022 2:45 PM

@Clive Robinson

Pretty sure that relying on half-life for timekeeping is not going to be usefully accurate over useful timescales if the half-life is long enough to be useful as a battery. I like the idea though.

However I think the point is moot really since as you say RTCs do in fact last for ages on tiny batteries. I have a watch I bought in the 1980s which runs for about a decade on a (small) battery. I have a watch with a heart-rate-monitor and bluetooth connectivity to my phone I am wearing now which runs for over a month (I charged it 3 weeks ago, it’s at 61%) between charges. (OK, it outsources long-term time time accuracy to the phone, but it keeps time quite well enough to be useful even if it can’t find the phone).

And finally: mechanical watches can sustain themselves from the energy they can scavenge from the movements of their wearers. Chances are electronic clocks can too, if we want them to.

kari • May 19, 2022 3:25 PM

@ tfb,

As to ‘impossible’: what I meant (which I had assumed was obvious, sorry) was ‘impossible to do the things people tend to like to use phones for which very often require knowing and recording the time’

Sure, I kind of guessed you might mean that, and perhaps I should’ve said I consider the time to be “nice to have” rather than “necessary”.

like look at calendars (needs the time to be useful),

Well, we used to get along quite well with calendars that did not know the current date. I’ve got one on my fridge now. They’d be open at the last page we looked at, and if that was the wrong one, we’d manually adjust.

make notes which I would like not to be dated in 1970 (or 1900 if you’re using a proper OS),

I mentioned the “wrong date” thing as bad software design. Software should know when it has no valid date, and act reasonably. It might be annoying to have notes show up with unknown dates, though, as above, we used to not have automatic dating of notes.

The order of notes is often enough, and doesn’t need a clock. But if a clock’s really needed, the note-taking app can track the time since boot, and when it detects the time becoming known, retroactively timestamp the note. Worst case, ask the user for the time—aren’t we all used to resetting our household clocks occasionally?

Remember that this only affects people who choose to turn their hardware “really” off, then back on while keeping it disconnected from any network. They’ll decide whether the extra clock-related hassle is worth it, and good design could minimize the amount of hassle.

listen to music where I would like the last listened log to have sane dates

Well, on general principle, I’m against tracking user behavior this way unless it’s on an opt-in basis. I’ve been fighting for decades with adjusting registry permissions, symlinking to /dev/null, etc., to prevent the programs I use logging data about me.

Young people tell me it’s old-fashioned to listen to music without using a network connection. But, where offline music logging is desired, it can be done the same way as notes.

Indeed, I have a device which I use to do some of the things other people might do with a phone – a little field recorder. It doesn’t have a real time clock, so all the audio it records is dated whatever the FAT epoch is. That’s so annoying (‘when did I make that recording?’) I’m probably going to buy another one which does have an RTC.

I agree this is really annoying. FAT, like most filesystems, has no way to store “no known time”. We could re-use “absolute zero” for this purpose (1980, 1970, 1900), but the OSes would have to know how to store and display it as not-a-time. How have we gone decades with no programmers noticing the need, when even lay people recognize the secret meaning of these absurdly wrong timestamps?

I’m all in favor of putting RTCs in most electronic devices, so long as I can say “I don’t care” (and it’s not gonna annoy me by flashing 12:00 or recording wrong times). Sometimes I just don’t want another clock to manage, to periodically adjust for drift and DST etc. I tried to buy a digital thermometer/hygrometer recently in a local Home Depot, and all the damn things had clocks, and since none were running I couldn’t check whether they had reasonable “unset” behavior. I ended up with a pair of analog devices. Boo-urns.

Clive Robinson • May 19, 2022 5:34 PM

@ tfb,

Re : Chances are electronic clocks can too, if we want them to.

Actually the then UK watch manufacturer Timex, made a watch back last century that used the heat difference between your wrist and cooler air temp via thermocouples or peltier devices that charged a battery that powered a watch. It was bot a market success. In the 1990’s I had removed a low power microcontroler from it’s packaging to demonstrate it running off of the heat from the back of your hand for a “science fair” to show kids what was possible (the average adult generates about the same amount of heat as those old 100W incandescent light bulbs, something worth knowing if you are involved with testing designs for efficient homes etc).

It’s not well known but most “Dry Cells” and similar you are told are “not rechargable” often actually are if you know the right waveform to drive them with.

Even those carbon-zinc batteries can be recharged about twenty times providing you do not discharge them too far (there is a “continuous charge” trick you can use with them, that we looked at to put in “cordless phone base units” back in the 80’s when “silly specs” were issued in some now EU countries).

Some of those miniture “Coin” or “button” cells with high silver content can be recharged about the same amount as NiCad batteries, and can be “trickle charged” almost indefinately to correct for self-discharge.

So there is no reason why you can not have a watch that runs for a very very long time, using a small solar cell as the watch face. See the Casio “Wave Rider” watches that have a solar face, and a 198kHz “Rugby Time Standard” receiver built in so you can “discipline” it every so often. The one on my wrist has been working for something like a decade, one of the four buttons nolonger works and I can’t make my mind up if I should “crack it open” to repair it or not. The problem being the chances are I won’t be able to get a waterproof seal back… Which as it goes swimming with me, then under the shower and stays on my wrist most of the time including in torential rain storms would make me disapointed.

I joke with the “pacemaker technicians” that my watch will outlive not just their box in my chest, but me as well, so I will be able to time “snowballs melting in hell” when I get there.

SpaceLifeForm • May 19, 2022 7:05 PM

@ kari, tfb, Clive, ALL

re: Do not fall into the trap that implies you need net and an accurate clock.

The Elephant in the Room is that a semi-accurate clock is required for any TLS Certificates to work these days.

You can try this at home. Set your clock back a year, and then try to read this.

kari • May 19, 2022 8:17 PM

@ SpaceLifeForm,

The Elephant in the Room is that a semi-accurate clock is required for any TLS Certificates to work these days.

I wouldn’t necessarily call that an elephant, since we’re mostly talking about the case where network is unavailable—leaving little use for TLS. I do wonder whether it could cause WPA authentication to fail, for methods such as EAP-TLS. If not, you’re only a few seconds away from learning the time via NTP (the NTS “Network Time Security” feature does consider how to handle bad clocks). Unless you’re on some non-internet-connected network that advertises no time servers.

Asker • May 19, 2022 8:42 PM

SORRY, DUMB QUESTION: Is the iPhone (and possibly other phones too) transmitting your location even when it is turned off?

SpaceLifeForm • May 19, 2022 8:53 PM

@ kari, tfb, Clive, ALL

re: Do not fall into the trap that implies you need net and an accurate clock.

Cellcos do not run NTP by design.

SpaceLifeForm • May 19, 2022 9:53 PM

@ Asker

That is not a dumb question at all.

The odds are very high that this is the case if there are are other devices around that have some kind of net. The other devices have already been geolocated, and via proximity, it will leak.

Did you mention your iPhone being off? Good luck with that theory.

kari • May 19, 2022 10:39 PM

@ SpaceLifeForm, re: “Cellcos do not run NTP by design”, what’s that got to do with anything? There are thousands of NTP servers online, which should be usable by any phone with internet access. Last I checked, the cellular network was a popular time source for stratum 1 servers, which implies any device dealing with a “cellco” shouldn’t even need NTP. Rather, NTP could be a fallback for devices that are not on the cellular network (for whatever reason) and don’t have the GPS time.

Clive Robinson • May 20, 2022 4:14 AM

@ kari, ALL,

you’re only a few seconds away from learning the time via NTP

But for how much longer and how do you trust it…

Not so long ago there were several radio transmitters in the world transmitting “Time Codes”, but the government’s that funded them as a “social good” have decided to defund them.

NTP gets it’s time sources from the same place… And without the radio clock funding, they would have no real reason to keep funding the time sources…

With regards @SLF’s

Cellcos do not run NTP by design.

It is true they don’t, for quite a few sound technical reasons, and the laws of physics, geometry, mathmatics, and that little problem called relativity…

Cellular networks effectively run on a very local “local time” that is time slipped against other time standards, in ways that try to smooth out the likes of leap seconds and the fact cell sites are at different latitudes. That is “They don’t keep Railway Time”…

Winter • May 20, 2022 4:58 AM

@Clive

Not so long ago there were several radio transmitters in the world transmitting “Time Codes”, but the government’s that funded them as a “social good” have decided to defund them.

The UK does indeed descend into third world levels, e.g., with defunding such transmissions. But not the rest of the world. These signals are still transmitted and you can still buy radio controlled clocks and watches:
ht-tps://en.wikipedia.org/wiki/Radio_clock

My experience with the German transmissions are good.

For those who want choice, GPS timing applications are available. GPS can also be used to time stamp “events”:
ht-tps://gssc.esa.int/navipedia/index.php/GPS_Time_and_Frequency_Transfer_Techniques

ht-tps://www.gps.gov/applications/timing/

As for the security of NTP, there is NTPsec. Not sure how far they are along the path:
ht-tps://www.ntpsec.org/

tfb • May 20, 2022 5:44 AM

@kari

Well, we used to get along quite well with calendars that did not know the current date. […] though, as above, we used to not have automatic dating of notes.

Indeed. We used not to have computers.

Another good example is taking photographs, and I know something about this because I’m a film/darkroom photographer. I have an entire process by which I number film rolls on on the neg envelopes, write down when and with which camera/lens I exposed the roll, when it was processed and what in etc etc. It’s a significant amount of manual labour, but it means I can find negs to print them again.

But it turns out I fucked up, because I didn’t start writing down notes on the prints I make, so now I have boxes and boxes of prints which I have to guess about when they were made, what enlarger & chemistry I used &c &c &c.

And quite recently I’ve realised that, for the little ‘serious’ colour work I do, I could buy a really good 2nd-hand digits camera for the cost of 20 rolls of Ektachrome, so I did that. And while I fundamentally hate having computers involved in making photographs, oh my the administrative bits of the workflow are better. I wrote a little Perl script based on ExifTool which will pick the images off the camera’s card, and use their timestamps to dump them into a directory structure (not ever going to trust a photograph cataloguing app for anything I care about), so now I know that I can find what I want in .../Originals/2022/05/01/ say. And the same tool will copy the sacred originals into a project directory where I can make things I can send to be printed from them. Oh, and it turns out the processed images have both the original timestamp, and one or more processed timestamps in them, as well as a unique ID which you can track back to the file that came out of the camera if you lose track.

It’s great. It’s saved me a lot of work (and I never have to worry about dust in the bloody slide scanner any more). And it relies, entirely, on the camera (which never goes near any network, it doesn’t have wifi or bluetooth or anything) knowing the time reasonably well.

Turns out knowing the time is a big win.

Finally, on the persistence of RTCs: cameras must be some kind of example. I don’t know how long I can take the battery out of a camera before it forgets the time but … weeks?

Clive Robinson • May 20, 2022 6:29 AM

@ Winter, ALL,

The UK does indeed descend into third world levels, e.g., with defunding such transmissions.

It’s not just the UK.

But such defunding does not occur because the need for the “social good” ends. The defunding occurs because of vanity, stupidity and the inability to understand the depth of measure of a social good.

Long before Covid I pointed out on this blog, that “health care” was a very primary “social good” without which society was not just in danger but ALL were in danger including those who thought they had wealth and power enough to “be above” or in some way issolated from something so common as disease.

Worse such people did not realise that all the medical advances they to were benifiting from only happened because of the size of society eligable to receive such benifits made the research, development and implementation “cost effective”. But more subtly each step gave rise to insight that makes the next step imaginable. So the bigger the number of people with imagination involved the faster inovation developes. The idea of the individual “so free” they have no responsability to others, is a recipie for stagnation, early death and ALL moving backwards to a more brutish, shorter, and much more painful existance.

The thing about a “social good” is it is in effect “defence by offence”, and like all “defence spending” it has an issue… That is you never know when you are spending to much, but you usually find out quite painfully when you spend to little because you are attacked and experience pain, destruction and many an early death.

I can not definately prove that the cutting back of the BBC World Service alowed the current situation to the east of Europe to occure but “joining the dots” is not difficult. Likewise slightly more than fourty years ago the UK Government cutting back on “South Seas Patrols” gave rise to the Falklands invasion and occupation and costly successor events of which some of us remember for good reason the current fortieth anniversary.

The thing about “social goods” are they are “broad in scope” but generally started for a specific reason. Take “free milk in schools” the specific reason it was started was Vitimin D and Calcium deficiency in those who were close to or below the poverty line.

The broad scope was it was an inexpensive way to fix not just the specific deficiency it was brought in to fix, but many other vitimin and mineral deficiencies. It also increased heart protective lipids that also helped neurological development, and as inportantly put nutrition in empty bellies so children would not be destracted by hunger during those all important early years of learning when they make the greatest strides in the shortest time.

Whilst the need for Vit D and calcium appeared to have past in the earl 1970’s after nearly two decades of real growth in everyones economic prosperity the “Milk Snatcher” represented an end and rapid stagnation to real economic prosperity for by far the majority. So here we are back needing “food aid” in such large ammounts that it tells us the real levels of social stagnation and rapid increase in real “food on the table” primary poverty.

The idiot promises to greed of the politicos fourty years ago are the same ones that have put the same moronic idiology back in place today, and we are ALL the worse for it.

Slashing “social good” systems always has many many attendent downsides, and next to no upsides… Because invariably those “slashing” use any minimal savings gained in “Bonfire of the vanity” policies with “fire sale” give away pricing to “the chosen few”…

I’m sure those who have seen all those big emergancy cheques go to favoured few corporates who then used the fake money it to buy up real assets to form “rent seeking” endevors that are truely antisocial and leaving the majority to pay off the debt created for the next three to four generations are not happy.

I could give thousands of examples of this sort of behaviour, but the odd thing is that those who would most benifit from taking note, are the ones out of desperation chasing those “fake-dreams” they are being sold. And they are the ones that will make incoherant or illogical complaint because in effect they will believe I’m “stealing their one chance in life” or similar…

Winter • May 20, 2022 7:02 AM

@Clive

But such defunding does not occur because the need for the “social good” ends. The defunding occurs because of vanity, stupidity and the inability to understand the depth of measure of a social good.

Which is another way of describing Third World countries. It is clear that the UK is not “developing” but the opposite.

It could be said that the UK’s economy cannot bear the cost of a super-power anymore. That is more or less the theme and plot of that world success “The Crown”.

However, the increase in the Gini index belies this simple explanation:
ht-tps://www.statista.com/statistics/872472/gini-index-of-the-united-kingdom/

The same holds for the USA, its decline in world power goes hand in hand with an increase in its Gini coefficient:
ht-tps://tradingeconomics.com/united-states/gini-index-wb-data.html

The pattern for China is interesting:
ht-tps://tradingeconomics.com/china/gini-index-wb-data.html

kari • May 20, 2022 9:30 AM

@ Winter,

As for the security of NTP, there is NTPsec.

That’s a project to improve the security of the software known as “NTP”—the oldest and traditional implementation of the Network Time Protocol (also “NTP”), what you get if you run “apt-get install ntp”. (“NTP Classic has long neglected open-source best practices, and stagnated as a result. The code needed to be fixed, and the development practice around it reformed.”)

There’s also the Network Time Security protocol I linked previously, for authenticating the network connection to an NTP server. The Chrony NTP daemon supports it now, as do a few servers. As Clive notes, however, most servers get their time from insecure sources (often spoofable radio signals, or other NTP servers).

SpaceLifeForm • May 20, 2022 5:12 PM

@ kari, tfb, Clive, Winter, ALL

re: NTP

You may have to think outside the box.

Two dots: Clock Skew. Fingerprinting.

Leon Theremin • May 25, 2022 11:01 AM

What is preventing someone from flashing the U1 chip (ultra wideband) to collect hand/finger gestures data and eavesdrop on someone typing a password?

SpaceLifeForm • May 27, 2022 1:51 AM

@ Leon Theremin, Clive

Good question. Where is the U1 chip in question actually located?

hxtps://www.theregister.com/2022/05/27/apple_airtag_sounds/

The PDF linked to therein, is, well, interesting.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.