NSA whistle-blower Edward Snowden and noted hacker Andrew “Bunnie” Huang on Thursday published a paper on their collaboration to design a smartphone case that will protect user privacy.
The pair developed a prototype compatible with the 4.7-inch iPhone 6, as it’s “driven primarily by what we understand to be the current preferences and tastes of reporters,” the paper states. “We assume any platform … can and will be compromised by state-level adversaries.”
That’s good thinking, observed Rob Enderle, principal analyst at the Enderle Group.
“There are some really nasty rootkits in China that self-install when you go to a compromised website and pretty much open your phone up to complete remote control,” he told TechNewsWorld, “and this malware came from an identified and otherwise legitimate firm. You can imagine what a government could do.”
The CIA has been hacking iOS for years, and the FBI paid a tech expert to hack the iPhone of one of the perpetrators of the San Diego massacre earlier this year, ending a legal battle with Apple.
The Project’s Goal The project aims to measure the radio activity of an iPhone using a tool called an “introspection engine.” Introspection tools enable a user in the field to “observe and investigate the status of the phone’s radios directly and independently of the phone’s native hardware,” according to Snowden and Huang.
The introspection engine, which will be housed in the phone case, will be able to alert the user of a dangerous situation in real time.
If the phone’s radio is supposed to be off, the introspection engine will sound an alert when it’s turned on by anyone other than the user.
Turning off radios by entering airplane mode is no defense, as GPS has been active in airplane mode since iOS 8.2, the two noted. Further, airplane mode is a soft switch, meaning the graphics put up on the screen have no correlation with the hardware state, and readily available malware packages can activate radios without any indication from the user interface.
The introspection operations will be performed by an execution domain separated from the phone’s CPU. It will be difficult to trigger a false positive or induce a false negative, even with signed firmware updates. The system should be passive and difficult to detect by the phone’s OS, and it should be usable on a daily basis with minimal impact on workflow.
The introspection engine will be completely open source and user-inspectable; users will be able to field-verify whether the introspection system is working properly.
“This is a relatively simple fix to what’s a massive problem right now,” Enderle remarked. “McAfee has demonstrated repeatedly that phones can remotely be turned into spying devices without the users’ knowledge.”
The idea “seems obvious, but that’s the mark of good innovation,” said Michael Jude, a program manager at Stratecast/Frost & Sullivan.
“Once you see an innovative solution, you ask why someone hasn’t thought of it before,” he told TechNewsWorld.
Project Challenges
It is possible to manufacture affordable cases based on their design, according to Huang and Snowden.
However, “the market for this is pretty small at the moment,” noted Enderle, “so producing enough to make it [affordable] would be difficult.”
Also, size would be an issue, he suggested. “You don’t want it to be obvious, as some governments might arrest you for just having it. It wouldn’t be just reporters that would want this — criminals and terrorists would as well.”
On the other hand, mass producing this case “would probably be no more complex than [making] the smart battery packs one can buy right now,” Frost’s Jude pointed out. “It could simply be an added chip to such battery packs, so that the device not only watches over your phone’s security but also maintains its charge.”
Loading ...
