all 30 comments

sorted by: hot top controversial new old
[–] 53 points 5 months ago (9 children)

How do they get it on the phone

  • source
  • hideshow 9 child comments
  • [–] 42 points 5 months ago (7 children)

    Depends. Obviously when they say "secret spyware" that means it is, in fact, secret, and we don't know which spyware they're using, but as the article notes it could be Paragon Solutions.

    They have a system called Graphite, but that primarily targets just instant messaging platforms. If the article is to be believed when it says it could activate your camera, that would signal to me it's more likely something from NSO Group, like their Pegasus spyware that can also access your camera, GPS coordinates, and more.

    All of these are going to be reliant on zero-day exploits, essentially exploits that aren't known to anyone yet and are still unpatched. All exploits will be a little different, but when it comes to mobile spyware, we usually see them delivered either through texts, websites, or email.

    Those attacks can either be someone just receiving the text (even if they don't click on it, AKA a "zero click" attack), or maybe having to actually go to a particular website with the exploit baked in, or running an attachment from an email.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 17 points 5 months ago (5 children)

    Joke's on them, my phone runs GNU/Linux and has hardware kill switches for the mic/camera and for the cellular baseband which I use while at home, instead using Wi-Fi calling

  • source
  • parent
  • hideshow 5 child comments
  • [–] 14 points 5 months ago (4 children)
  • [–] 12 points 5 months ago

    2 phones today ship today with that, the Purism Librem 5 and the PinePhone Pro.

    In addition to an expected eventual 5G re-release of these models, the Liberux Nexx, and I suppose there will be a Brax 4 with it, given that their open slate tablet has them first.

  • source
  • parent
  • [–] 3 points 5 months ago

    Idk if there are laws around this in Canada, but mobile carriers can apparently install shit that you can't fully uninstall, as soon as you put their SIM in there. I discovered that when my carrier installed their "app center" bs on my non-carrier locked phone.

  • source
  • parent
  • [–] 40 points 5 months ago

    Graphene OS for the win

  • source
  • [–] 26 points 5 months ago (5 children)

    Good luck making that stand up in court. They may as well be handing out "get-out-of-jail-free" cards.

  • source
  • hideshow 5 child comments
  • [–] 33 points 5 months ago (3 children)

    They don't use it as admissible evidence, they use it to find out whether someone is worth pursuing in legitimate ways that are more time and effort intensive.

  • source
  • parent
  • hideshow 3 child comments
  • [–] -3 points 5 months ago (2 children)

    That type of investigation would still require a warrant or exigent circumstances at the minimum. Otherwise it's just fishing...which is a violation of Canada's privacy laws. They can't just go rooting through someone's phone looking for a reason to pursue further investigation.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 5 months ago

    But will they use this on Doug Ford's burners?

  • source
  • [–] 8 points 5 months ago (1 child)

    If you turn your phone off when being pulled over would it make any difference or does the spyware still do its thing?

  • source
  • hideshow 1 child comment
  • [–] 4 points 5 months ago

    More than likely yes. It disables biometrics and forces the use of a passcode if you have one enabled.

    On Apple devices and Android devices go into lockdown mode when they are restarted.

    Both of them will when left idle for a select period of time it will reboot. This is called Inactivity reboot. This basically forces the phone into lockdown mode.

    These are new features that have been implemented on Apple and Android respectively fairly recently.

    Apple phones also have the ability to wipe themselves away when left off for too long. You can do this with some versions of android but for the most part the one I know of is Graphene OS.

  • source
  • parent
  • [–] 6 points 5 months ago

    They shall name the tech Harbinger

    ASSUMING CONTROL

  • source
  • [–] 6 points 5 months ago

    They need access to your phone to sideload their spyware?

  • source
  • [–] 16 points 5 months ago (6 children)
  • [–] 8 points 5 months ago* (5 children)

    Buying what? Like you don't believe the police can, will, or has done this?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 3 points 5 months ago (3 children)

    How could they load software on the phone? They could use stingray systems possibly or any man in the middle but what if your network traffic is behind a vpn, what if your device is secured. I doubt they can simply CONTROL your device and how it operates from a distance reliably and en mass.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 11 points 5 months ago (2 children)

    Zero day backdoors without any interaction from the user are proven possible. Look at Pegasus spyware. The majority of data breaches are due to zero day hacks.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 5 months ago

    So there are two ways they can get this so called spyware on your phone. Zero click exploit in some app or through the os itself or the carrier uploads it through the network.

    The latter is probably not going to happen... But the former... Is kinda illegal and would expose multiple corporations in malfeasance.

    Seems like a puff piece. I call bullshit.

  • source
  • 5 comments in c/world view that post
    [–] 19 points 5 months ago (4 children)
  • [–] 6 points 5 months ago (2 children)

    As an iOS user on the fence about switching, can we definitively say that GrapheneOS would protect against this sort of threat? I have a general sense of the containerization, but I'm curious if anything like this specifically has been addressed? If the spyware gives "god mode" access to your device, who's to say Graphene wouldn't fall victim as well?

    I admittedly haven't done my own research, but my best guess is assuming that Google allowed for some sort of backdoor to LE... and that would have been (hopefully) discovered and plugged by the Graphene devs?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 5 months ago

    (GrapheneOS project member here) We are not aware of any organization or software that can hack into GrapheneOS.

    It would be harder for a few reasons. In this case, it would be harder because the baseband is isolated on supported devices so hacking remotely would be harder. GrapheneOS also ports to new Android versions very quickly, which means security patches are applied that other devices/OSes are always far behind on. We also have security preview releases so even more patches are applied for users who enable that. And, finally, there are lots of other hardening things that have been done protect against unknown vulnerabilities. See the website for info about that, but basically the hardened memory allocator + enabling MTE for 8th generation devices and later will catch the most common classes of bugs.

  • source
  • parent