Secure Phones: OpenSource, and FBI's Fake Encrypted Honeypots
https://www.vice.com/en/article/n7b4gg/anom-phone-arcaneos-fbi-backdoor The original article. Researchers might find some AN0M's for sale on darknet markets. If they were still intact, more exploit disclosure could be done. They could then be reflashed into SW development units. But as with all closed HW and SW, and anything from untrusted sources, they couldn't really be trusted for critical use without threat modelling and risk management. Doing more... buy one of each of the "secure phone" brands that are out there. Publish a comparison on what they are doing in HW and SW to be "secure". Then to the extent it's just SW, integrate whatever they're doing that you missed, into your own opensource ROM project on github, or into any of the other existing secure ROM projects. https://en.wikipedia.org/wiki/List_of_open-source_mobile_phones https://en.wikipedia.org/wiki/Comparison_of_open-source_mobile_phones https://www.xda-developers.com/android-phone-linux-distributions/ https://tuxphones.com/list-linux-mobile-devices/ https://tuxphones.com/all-linux-distributions-for-smartphones/ Any cheap ARM64 phone can run a Linux or BSD with a strong passphrase, optional USB/NFC/RFID TFA / boot key. Since Baseband and WiFi HW and FW are compromised from the factory [1], you're sort of carrying a brick anyways. Phones are just computers with HW radios built in. They can talk over WiFi / USB / Serial to external Cell and WiFi HW radios. And both Cell and WiFi can be done in GNURadio. Pine64 Pinephone and Purism Librem5 might still be the only ones doing Baseband over Serial. Too bad they don't have a fast battery cut or instant hard reboot or crypto blacken and wipe switch. [1] See Apple's recent WiFi SSID exploit. For that matter, did Apple ever say that they could not (as in the phone architecture totally prevents anyone from breaking in), as opposed to Apple would just refuse to break into their own phones.
participants (1)
-
grarpamp