There is a maintenance mode in every cell phone that allows it to be remotely turned on, that is, used as a listening device, without your knowledge.

I don't know what authentication is required. I expect that it was designed so that only your cell carrier could enable it, however whatever may have been secret about it, quite likely has leaked out by now.

If you don't want to be listened-to, don't have _any_ cell phones anywhere near you. Not just your own - say you want a private conversation in a public place; the phones of other people in your general vicinity could be switched on to listen to you.

I learned this from a well-known left-wing radical organization known as the United States Air Force, when I applied for the USAF Cyber Command. Their site had a recruiting video, that depicted a couple officers locking their phones into a grounded metal box - a faraday cage - before entering a secure area, that is, a room where secrets were openly discussed.

I've been asking everyone I know questions about this to make them realize how intense the total surveillance possibilities are.

"How many internet-connected microphones are in the same room as you?"

It's astonishing how big that number gets. For me right now, it's ~50. And so many of them are made by different companies, assembled in different countries, etc. The chance that someone, somewhere, can listen to you is nearly 100% if you're in a semi-public space. We're living in a dramatically more invasive surveillance society than 1984 ever predicted (that was just street cameras & one 'telescreen' in your home).

And then, add into this mix that we have new market acceptance for devices that intentionally open this behaviour: XBox One, Moto X, Amazon's...whatevertheycallit. There's not only technical capability, but also increasing consumer desire. It's crazy.

Further edits: There's a lot more at stake here, too, if you extrapolate from their[1] known capabilities and combine with actors who may also have motives at large scale. Take Facebook's mood-altering study, for example. We know that someone/Facebook has the ability to alter the moods and opinions of large groups of populations. The same actors can also listen/watch those people in real time. Dystopian scenarios of totalitarian governments exercising total population thought-control is more and more plausible as we all trade our privacy and security to giant corporations in exchange for mere convenience in our daily lives.

[1]: Who is 'they'? I don't know, but there are many possible 'they's and it might be many of them.

Most notebook computers have video cameras built into the display's frame, at the top. These cameras typically have a light that powers on when the camera is in use.

However there is nothing at all to indicate that the computer has its audio microphone in use.

A quick google search shows that some cameras can be activated without that little LED coming online.

I was once paid specifically to figure out a way to activate a camera without turning on the light.

However in that case it was for a legitimate purpose.

Out of curiosity - what was that legitimation? Can you tell?

One idea: I can easily imagine research studies getting IRB approval for this. The red light could alter the subject's behavior, and video analysis could be part of the metrics (for measuring attention/distraction or gross estimates of gaze, etc).

Really? Because I can't.

I can't imagine an IRB-approved research study that requires a software solution (developed under an NDA) to a hardware problem that couldn't be solved with a one-inch square of black electrical tape.

For the price of a contracted software developer, you could simply buy a model of laptop (or smart phone), in which the bezel can be pried open without substantial damage, and behind the LED's transparent aperture (but obscuring the LED), you fix a tidbit of black tape or whichever opaque material you may prefer.

Or, better yet, for pretty much every situation that doesn't involve eye-movement tracking, simply install a hidden security camera at an opportunistic vantage point.

I wish I could.

It's not just that I am still bound by my NDA, but telling anyone what the application actually did, would result in bad things happening to completely innocent people.

I also have a legitimate reason to snap still photos on a smartphone, without making the shutter sound. On an iPhone, it sounds just like an SLR film camera, and is very loud.

However, it turns out that it is unlawful to do that in such countries as Japan.

Asking how to silence the iphone camera on stackoverflow resulted in 20,000 views of my post, several people saying you can't do that, and several people telling me it's against the law, that it would be a bad idea and so on.

Nevertheless, I have a completely legitimate reason to do so.

I expect Apple would reject it from the App Store. I may do it for Android, as well as for jailbroken iOS devices, but then sell it through the Cydia App Store.

You realise that this just makes it more intriguing. Personally, I wonder if that's not a way of saying "actually my justification isn't really valid". I don't mean to be inflammatory, I'm voicing my concern -- it sounds fishy.

These cameras typically have a light that powers on when the camera is in use.

Yes, typically, but sometimes not when used by parties who want to obscure their use of the camera [1].

[1] http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/18...

Has Apple done anything to fix this yet?

I'm pretty sure that (on my MacBook Air, anyway) you only need to get a kext installed for the camera to not light up.

I know some ways around that.

Please share.

I could tell you but then I'd have to kill you.

Well OK...

More or less like writing any kind of virus.

Apple likes to claim that OS X is more secure. In reality, most of those who write malware own Windows boxen.

You make it sound as if that is some kind of security revelation. In reality, what you are saying is 'the light is controlled in software'. Which is just another way of saying "that light is just a light, and it has only a tenuous connection to the camera being enabled".

Which is of course an utter joke.

The light was not meant to be controlled in software, it was intended to have a “hardware interlock” to the camera.

But they forgot firmware is software too, and is hackable too. (Now that's a 'leaky abstraction' for ya).

http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/18...

Turns out security is hard. Even compared to just 5 years ago, I think a lot more engineers are realizing how hard security actually is.

Turns out this is a really, really trivial problem to solve in hardware. Delegating it to their peripheral microcontroller is not a hardware solution, it's just the same software nonsense.

Security is hard in software because from the undecidable halting problem it immediately follows that any non-trivial property of software (such as "does the micro firmware turn the LED on when the camera is on") can also not be decided.

There is no halting problem in hardware. But I hear they have very, very cheap switches nowadays that could easily control the power to the camera and a parallel LED.

I am curious about your assertion that there is no halting problem in hardware.

I've seen advertisements for automated circuit design tools that will convert a C program into the schematic for a chip that does the same thing, only in hardware.

That leads me to believe that hardware must have the halting problem as well. However I only have a passing understanding of the halting problem. Can you enlighten me?

Many eBook readers will phone home about what you're reading.

It's bad enough that Amazon would know what ebooks I've purchased. The Kindle will tell Amazon what pages I've read and when I read them.

There is a damn good reason I don't even own an ebook reader.

Not even an Android tablet loaded with an AOSP ROM, F-Droid and CoolReader?

http://coolreader.org/e-index.htm

eh, it's 50-50. Some people like that ebook reader picks up from where you left off from another device.

And many people don't know why their battery is getting sucked dried too quickly

There are other reasons that cell phones would not be allowed in such a location. For instance, it makes it more difficult for an insider to remove sensitive information.

While I expect you are correct, the USAF recruiting film specifically pointed out that cell phones aren't permitted in secure areas because of that maintenance mode.

You're not allowed to bring any electronic devices into a secure area. Period.

That means, watches, phones, laptops, pedometer and just about anything that has circuits.

Lots of good reasons for that.

How do you know that a pedometer is really just a pedometer?

That's how Bradley Manning made off with 800,00 diplomatic cables. He used a CD label printer to print CD-R blanks so that they looked like the albums from all his favorite bands, put the CD-R media into a portable player, then burned the CDs at his PC after downloading the cables over the Internet.

Oddly, he was always searched on the way in, never on the way out.

If they did use a user account system with capabilities (CD burning would be one of them) this couldn't have happened. That probably a million other possibilities.

Alternatively, they could crack open an Internet RFC or two.

Internet Protocol packets have a field for the security classification - unclassified, confidential, secret, top secret, there are other classifications that are themselves classified, as top secret ultra once was - as well as the compartment.

I expect Bradley Manning had a top secret clearance, but I doubt he had the same compartment as was required to read diplomatic cables.

Quite likely everyone was using commodity routers, such as one can purchase at Fry's. It must be expensive to purchase routers that enforce what has been in the Internet Protocol since the 1970s.

Internet Protocol packets have a field for the security classification - unclassified, confidential, secret, top secret ...

I'm not sure how these would have helped contain Manning. The access-control part of this infosec failure was on a higher level (Manning's admin access crossed compartments). "Server-side" access control didn't fail, it functioned as expected. Monitoring did fail, but that's another story.

Zooming out a bit to the security bits of IP packets, that I had completely forgotten about - are those actually used/useful in this Layer 7 era? How?

I can't think of a single use case. I would expect even the sensitive/non-sensitive routing decisions to happen on a per-host/subnet basis (e.g. 30.x.x.x stuff goes through this pipe, other stuff goes through the outside-world pipe)

Do you know in which part of the phones this is supposed to be in?

In every cell phone? Without more details I call BS on this. It might be possible, but stating that every cell phone has it, sounds unlikely to me. I don't think it is part of the GSM specification, so what would be the reason that EVERY cell phone (Also non-GSM phones) has it?

I don't know.

I don't think the Air Force would just make something like that up. It's not just a USAF policy, not to permit cell phones in secure areas. I know lots of people with clearances, none of them are permitted to bring cell phones into their offices.

I applied to the Cyber Command in the Summer of 2008. What kinds of phones were in use at the time, in the United States?

And the video did specifically say "every cell phone".

That seems like a good policy even if most cell phones were immune to hacking.

How do you know that those policies aren't in place to prevent a person from knowingly recording sensitive data with their phone? Was there anything indicating that it was specifically for the reasons that you gave?

This policy is so widespread, and it has been the policy for so long, that I would be quite surprised were such a reason not to have leaked out by now.

People with clearances all know about this maintenance mode. None of them ever explain the error of my ways, when I discuss it with them.

The "real" reason for a policy is always more exciting. Watch:

The real reason you have to turn your phone off on a plane is so that you can't record the takeoff and landing. That way, if there's a crash, there's no evidence to dispute the airline's black box version of the story.

Pretty sick, no?

That's completely bogus. You only need to turn off the broadcasting it does, and even that was declared unnecessary by the FAA recently(iirc). You can record the takeoff and landing all you want, as long as you aren't affecting other passengers.

The people missing the point/satire of this comment are actually airline shills terrified that their secret has just been discovered.

There have been some reports of government-sanctioned malware being installed on smartphones to override the behavior of the power-off switch, making it appear that the phone has been turned off when it's actually not. This could presumably be used for surveillance purposes, and probably has been, given what we've seen in the Snowden disclosures and elsewhere.

However, the idea that an unmodified or unhacked phone can be made to behave this way is sheer tinfoil hattery. You're not allowed to bring anything even vaguely electronic into a SCIF, but that's because the whole idea behind a SCIF is to have a room in an otherwise-unsecure facility where even the vaguest potential security risks are aggressively countered.

Apple, HTC and QualComm say you're blowing smoke:

https://news.ycombinator.com/item?id=8769816

Baseband alone is not enough to act as an eavesdropping device. There's no direct connection between the baseband chipset and the microphone and camera. And if they left the baseband subsystem powered up when the phone was physically turned off (as opposed to in standby), the battery drain would be obvious.

Some of the confusion probably arises from the distinction between power-down and standby modes. If anything but the supervisory processor that monitors the power button were active with the phone turned all the way off, it would be noticed, and give rise to a substantial (and well justified) outcry. Under normal conditions, that can happen only if the phone has been hacked.

In every cell phone that can be legally sold in the United States, I'd assume, at the least. See CALEA: https://en.wikipedia.org/wiki/Communications_Assistance_for_...

Do you know in which part of the phones this is supposed to be in?

The baseband chip.. it runs its own RTOS (separate from Android/ios/etc): http://en.wikipedia.org/wiki/Baseband_processor

Rather than explaining, I think this link is a pretty good example: a chip from qualcomm that was sold at least through 2012:

http://www.osnews.com/story/27416/The_second_operating_syste...

It was demonstrated at BlackHat in 2011 on an iPhone 4 and HTC Dream (android):

https://www.blackhat.com/html/bh-dc-11/bh-dc-11-briefings.ht...

http://www.infoworld.com/article/2625180/smartphones/coming-...

Edit: Slides from a talk at DeepSec:

http://2010.hack.lu/archive/2010/Weinmann-All-Your-Baseband-...

Edit: video: https://www.youtube.com/watch?v=fQqv0v14KKY

edit: I think this is the paper: https://www.usenix.org/system/files/conference/woot12/woot12...

Thanks for posting that.

I quite commonly experience the phenomenon that when others don't agree with me, they make up reasons that I must be wrong, completely out of the blue.

For example, I'm working on a Conway's Game of Life implementation for iOS. It's taking a long time, so some joker published a web page that lists all the other members of our site, who have already shipped Conway's Life implementations.

So I pointed out that I shipped my own Life game for the Classic Mac OS in 1997, and that it was particularly fast because it set the bit-depth of the screen to 1 (black and white, no color, no greyscale), then drew directly into the video card memory. My old website where I published its source has been available in the wayback machine this whole time.

The response? Two other people pointed out that they knew how to draw directly to the screen decades ago.

No one is willing to acknowledge that I shipped my own Life implementation fourteen years ago, long before that site even existed.

Not sure why the downvotes, its common human behaviour. Its even discussed at length in Carnegie's htwfaip.

As I said I am mentally ill. If I tell my own mother something she disagrees with or does not understand, she regards it as a symptom of my mental illness.

For example I told her that I am a webmaster, and that it costs me money to register my domains and host my sites.

She regards such statements as evidence that I have not been taking my medicine, and will, from time to time, call the police to get me involuntarily held in a psychiatric hospital, whose staff will agree that I must be delusional, because I claim to be a webmaster.

wait, wait ... wasn't there some michael crawford personality on kuro5hin years and years ago ? I never really understood what was going on there, but ... is this related in some way ?

that depicted a couple officers locking their phones into a grounded metal box - a faraday cage

I once tried that using a metal lunchbox, with a tight fitting metal lid - the phone rang anyway.

Anyone else ever tried it?

And as a side note, be sure and turn off (or airplane mode) your phone if you do put it in an effective faraday cage, or you will rapidly drain the battery as the phone constantly tries - at full power - to find a base station.

There is a maintenance mode in every cell phone that allows it to be remotely turned on, that is, used as a listening device, without your knowledge.

Sounds tin-foily, any references? This conspiracy theory has been making the rounds for a long time and there's no evidence for it so far. Some problems immediately come to mind:

- would eat phone battery quickly to keep radio listening for these things

- would be vulnerable to discovery, eg leaks from phone industry engineers, reverse engineering by tinkerers, etc - yet has stayed secret for a long time (assuming this isn't a new thing)

More realistic would be exploiting a bug in the phone baseband firmware to get remote code execution, and then reprogramming the phone to do what you want. And reason enough to treat phones like you observed.

would eat phone battery quickly to keep radio listening for these things

your phone already listens for incoming call signal, this would be just another type of signal.

He was talking about turning the phone on remotely.

Of course we can be sure, that those fellows were not the first to learn about that.

The hack of belgium telco Belgacom sees more light day by day.

This system is broken beyond repair. We need to build it up from the ground, safe.

Someone is making encrypted Android phones in Switzerland, they said they would cost about $600.00, and should be shipping by now.

They can interoperate with regular Android phones if those phones have their app installed. I don't know what happens, if one calls a phone that does not support encryption.

Boeing is, or will soon be making such a phone, specifically intended for classified communication. I don't know whether they will be sold to the public.

Signaling System 7 (SS7) is a big security problem. It's the packet-switched control network for the phone system, and it has very little security. It was designed in 1980 to be run only internally between phone switches.

The main function of SS7 is call setup. All the switches along the route get their switching commands over SS7, not over the circuit-switched channel. (That went out with SS5, the old audio-tone based system). Call setup is preceded by "translation", turning a destination phone number into a route. That's done with query messages over SS7.

This allows outsourced wiretapping. Verisign offers this as a service for telcos, so they don't have to deal with law enforcement themselves.

http://www.verisign.com/static/001927.pdf

Verisign, which also runs much of the US SS7 network (http://www.verisign.com/stellent/groups/public/documents/dat...) is well placed to do this. All they have to do for a wiretap is to have the translations for a source or destination number reroute to a wiretap point, which then records while forwarding to the desired destination. As an SS7 provider, they already have all the call metadata.

Vulnerabilities come in because more parties now have SS7 access. Cellular roaming and VoIP to landline routing are managed over SS7. So a large number of computers other than dedicated telco switches now have SS7 connections. A break-in at any of those points has wiretapping potential.

A bit of a plug. If anyone is interested in playing with (doing research on) SS7 vulnerabilities, a few years back (five) I've participated in building a pretty cute test toolkit that allows one to sent/receive/parse/play scenarios using SS7/C7/3G/CDMA/.../SCTP/SS7 over IP/... packets on any level of the network. The list of supported protocols is available here: http://www.linkbit.com/platforms It follows standards and usually implements 100% of the protocol (including conditional constraints, etc). But also allows one to 'break' stuff and send custom/unsupported/broken fields.

It is pretty cute, you can do most of the stuff just in the visual packet editors / flow editors and where necessary revert to python snippets.

To get the feel of it, and see some pics: http://docs.linkbit.com/

edit: and basically yes. as a protocol engineer and somebody very familiar with SS7/C7/GSM/.., once you have the access to the network (which can be done over IP!) I wouldn't be at all surprised, you could misuse it.

As someone that used to be more interested in this stuff, it seems I missed the part where SS7 access became generally available. The first I saw mention of it, I think, was on an SMS provider's web site under a "Contact Us" type banner. Which makes me wonder, what changed to allow more businesses access and more importantly where do I sign up? :)

SS7 is one of those revered buzzphrases from my teen years, even getting to play with it for a weekend would really sweeten my Christmas.

In Turkish Ministry of Foreign Affairs it is forbidden to bring cell phones in to meetings. However it is totally okay to bring tablets and laptops into the meetings. Source: my friend works there.

Edit: phones are forbidden due to the recent spying events.

Do they allow 3G tablets or anything that falls in the not-a-phone-but-has-a-SIM/baseband proc?

I'm assuming a GSM (or equivalent) baseband is the only thing separating smartphone from smartablet and smartlaptop nowadays, correct? If they allow 3G tablets, then this is a security-theater kind decision, aimed to appease "management", and we must make fun of them.

If they ban all baseband-carrying devices, then this is a consistent policy that is paranoid about a very specific thing that, quite frankly, invites a lot of healthy paranoia.

I wonder what it'll take to open up those baseband processors.

"anyone" can not listen to your cell calls. Only people that have access to inject commands into the SS7 network that your call is routed through can do that.

Or those that can create a pico cell that your phone connects to and then MITM your call. I gather the equipment is pretty accessibly priced now.

The expertise to do these things is the domain of well outfitted organizations, who have other simpler methods of making you talk. Indeed, electronic surveillance of is often used to protect agents from dangerous work.

The technology to do these things is open source and available here:

http://osmocom.org/

I'm not sure how to hack a mobile phone using this software? The expertise to find these kinds of exploits is hard to develop individually.

The expertise to find these kinds of exploits is hard to develop individually.

Yes, but numerous people participating in the Osmocom projects have that expertise. Fortunately, they're interested in building an open-source baseband processor (among other cool things), and not in hacking into anyone's private communications.

It is well know that GNURadio is used by the US navy. I could easily see Osmocom, being used for good or bad - the most important thing being human resources. Although in the case of Osmocom, I'm still not sure how it is related to this kind of hacking.

A couple of random thoughts on potential applications/uses:

1. Alexandria needs to communicate with Bilbo. Alexandria has the privilege of being trusted by whatever organization she belongs to (be that her country, company, etc) and as such is unmonitored AFAsheKs. Biblo on the other hand is some fugitive-type and is unable, or perhaps unwilling, to enter direct communication with Alexandria for fear of compromising himself or his beloved Alexandria. Bilbo could then monitor Alexandria's calls for an encoded message via a protocol they predetermine. This protocol could take the form of linguistic or audio steganography. One could image all sorts of information being leaked by Alexandria.

2. More realistically this could be tool for bribery. Monitor a set of vulnerable targets, wait until they reveal something, take a bribe to stay quite.

3. Or, for the Machiavellian-minded leak information that was supposedly confidential between two parties.