Yeah, if this can be done remotely then all smartphones by design are very insecure devices that shouldn’t be trusted to doing card transactions or entrusting with password management and two factor authentication…
I wish they would go into more detail on the how of remote activation is made. Is it a law saying it is okay to do if it becomes possible? Is this through an exploit that was found and requires physical access to the device to initiate, or is it just a setting present on all phones by default.
I’ve seen this news published at a few different places, and IIRC they plan to use already existing exploits. You can read a bunch about what could potentially be used on the grapheneos website, specifically on how the modem and cellular network stack is very highly privileged on android at least, and it is very likely that most cellphones are vulnerable to some kind of code injection via a stingray, for example.
I’m not aware that either iOS or Android support this.
I see two options:
Apple and Google build requested backdoor access, which I don’t think they want to do.
The police get physical access to the phone temporarily to install a hidden app on it. Possibly using an insider.
Bad guys buy pre-backdoored phones from cops. See the ANOM story. https://arstechnica.com/tech-policy/2021/06/fbi-sold-phones-to-organized-crime-and-read-27-million-encrypted-messages/
I have not read the bill but I’ll guess they are legalizing #2.
Yeah, if this can be done remotely then all smartphones by design are very insecure devices that shouldn’t be trusted to doing card transactions or entrusting with password management and two factor authentication…
I wish they would go into more detail on the how of remote activation is made. Is it a law saying it is okay to do if it becomes possible? Is this through an exploit that was found and requires physical access to the device to initiate, or is it just a setting present on all phones by default.
I’ve seen this news published at a few different places, and IIRC they plan to use already existing exploits. You can read a bunch about what could potentially be used on the grapheneos website, specifically on how the modem and cellular network stack is very highly privileged on android at least, and it is very likely that most cellphones are vulnerable to some kind of code injection via a stingray, for example.