[00:00.810 --> 00:12.210]  My name is Cooper and this talk is called Your Cell Phone is Covered in Spiders and this is because after I'm done here, I hope you'll be looking at your cell phone as if it were covered in spiders or cockroaches or whatever other bug you don't like.
[00:14.490 --> 00:16.610]  So, how many of you in here have an iPhone?
[00:17.470 --> 00:19.130]  Oh wait, better bring the house lights back up.
[00:19.670 --> 00:20.610]  Just real quick for that.
[00:21.890 --> 00:23.350]  Alright, how many of you in here have an iPhone?
[00:23.510 --> 00:24.050]  Okay, like two or three.
[00:24.190 --> 00:25.490]  How many of you have a Blackberry?
[00:26.830 --> 00:27.570]  Oh, a couple more.
[00:27.730 --> 00:29.550]  How about, I don't know, Windows Mobile?
[00:32.390 --> 00:33.330]  Palm OS?
[00:34.170 --> 00:35.730]  Alright, Android.
[00:36.490 --> 00:37.410]  Yeah, okay.
[00:38.010 --> 00:39.790]  So this talk is mostly going to be about Android.
[00:43.530 --> 00:46.690]  So, we're becoming increasingly dependent on mobile devices.
[00:47.510 --> 00:49.570]  And we're storing more and more data on them.
[00:49.650 --> 00:54.810]  Pictures, videos, contact lists, a record of anywhere you've ever been.
[00:55.050 --> 00:59.230]  And if you watched Steve Rombom's talk earlier today, a record of basically everything you've ever done.
[01:00.030 --> 01:02.710]  And you have about as many gadgets as this guy does.
[01:04.290 --> 01:05.270]  All on your phone.
[01:05.410 --> 01:07.290]  Social graphs, all sorts of interesting things.
[01:08.330 --> 01:13.570]  And as the amount of data that we're storing increases, the amount of complexity on the platform increases.
[01:13.790 --> 01:18.270]  The phone now is obviously a much more complicated beast than it was even five years ago.
[01:19.130 --> 01:26.850]  And as the complexity increases, the desirability of it as a target increases and the number of vulnerabilities in the platform increase.
[01:27.090 --> 01:28.490]  So it's really a perfect storm.
[01:28.610 --> 01:31.490]  And there are a lot of vulnerabilities in mobile devices.
[01:32.990 --> 01:35.430]  So what sort of threat models are we talking about?
[01:36.970 --> 01:46.670]  Random attacks, like malicious applications, which usually aren't really targeting anybody, but just trying to set up botnets, but not targeting anybody in particular.
[01:47.250 --> 01:48.470]  Stolen and lost phones.
[01:48.570 --> 01:49.310]  This happens a lot.
[01:49.430 --> 01:51.130]  It's a little piece of hardware that's in your pocket.
[01:51.230 --> 01:51.770]  Easy to lose.
[01:51.770 --> 02:03.530]  There's also targeted attacks from law enforcement, if you're a person of interest, or corporate espionage, or personal enemies, if you have a jilted ex-lover.
[02:05.070 --> 02:11.250]  And then there's attacks that are somewhere in between, which are things like signal interception.
[02:12.250 --> 02:19.770]  You know, intercepting men in the middling, essentially your phone calls or your data, or your phone company doing essentially the same thing.
[02:22.070 --> 02:25.230]  So, some things to keep in mind before we start this talk.
[02:26.150 --> 02:31.050]  If somebody gets physical access to your phone, you should assume that your phone can and will be compromised.
[02:32.630 --> 02:35.810]  And if you assume anything less, I feel like I'm doing you wrong.
[02:37.010 --> 02:38.890]  Because, honestly, it probably will.
[02:39.670 --> 02:41.330]  A phone is a lot like a laptop.
[02:41.510 --> 02:45.730]  Once a person has physical access to it, there's really no limit to the things they can do.
[02:46.830 --> 02:51.810]  You should also... you're best off assuming that your phone will be compromised at some point.
[02:54.530 --> 02:56.410]  There's a lot of attack vectors.
[02:56.590 --> 03:02.370]  And if you think of your phone as a device that will be compromised, then you'll store less sensitive data on it.
[03:03.350 --> 03:05.390]  Or you'll store that data better.
[03:06.110 --> 03:07.050]  Encrypted, for example.
[03:07.270 --> 03:08.690]  And that's really what I want.
[03:10.850 --> 03:13.050]  So, security is a journey, not a destination, though.
[03:13.230 --> 03:15.130]  And we're never going to have perfect security.
[03:16.070 --> 03:17.790]  But the goal is not to have perfect security.
[03:17.890 --> 03:21.730]  The goal is to put up more hurdles to make it harder for the attacker.
[03:21.730 --> 03:30.310]  The magic equation here is that the time and energy and resources needed to compromise you need to be greater than the determination of your attacker.
[03:30.590 --> 03:34.030]  So, if your threat model is the NSA, that's a lot.
[03:34.190 --> 03:40.390]  But if your threat model is a random person on the street, it's not so much.
[03:41.810 --> 03:45.970]  And just because there are so many threats, doesn't mean that you shouldn't take security seriously.
[03:46.190 --> 03:47.510]  There's a lot of things that you can still do.
[03:51.440 --> 03:52.980]  So, burner phones, real quick.
[03:54.900 --> 03:56.120]  You all know what a burner is?
[03:57.230 --> 04:01.380]  A burner is a feature phone, or the Nokia brick phone, something that plays Snake.
[04:05.380 --> 04:07.080]  These have no encryption.
[04:07.620 --> 04:10.860]  They're trivial to perform forensics on.
[04:11.000 --> 04:12.300]  Trivial to extract data from.
[04:13.220 --> 04:14.460]  Always closed source.
[04:14.960 --> 04:17.100]  And they don't even have a screen lock, oftentimes.
[04:17.860 --> 04:24.340]  The one thing they are good for is if you go buy a disposable mobile phone, it's not actually connected to you.
[04:25.000 --> 04:27.420]  If you pay in cash and blah, blah, blah.
[04:27.960 --> 04:30.140]  So, that's a slight advantage.
[04:30.580 --> 04:35.260]  If you use it once or twice and throw it away, it could be argued that that's more secure.
[04:36.260 --> 04:39.640]  But you don't get things like encrypted conversations or encrypted text messages.
[04:41.120 --> 04:43.680]  So, the iPhone, for the three of you that raised your hand.
[04:45.180 --> 04:48.180]  The bad is its closed source, and it's a walled garden.
[04:49.480 --> 04:58.840]  Micah and Parker, I think, from the EFF, just wrote a really great blog article about Apple's walled garden.
[04:59.380 --> 05:02.600]  And there's not much in the way of security apps, from what I could tell.
[05:03.600 --> 05:06.000]  Again, I don't own an iPhone, so I could be wrong here.
[05:06.180 --> 05:07.560]  But from what I've seen...
[05:08.320 --> 05:10.380]  And the default screen lock is piss poor.
[05:10.580 --> 05:16.260]  A four-digit number is easily guessed, especially since most people choose things like 1-2-3-4 and 1-1-1-1.
[05:16.260 --> 05:20.180]  And the same smudge attacks that I'll talk later also work against the iPhone.
[05:22.700 --> 05:27.120]  A couple of encryption tools that it does have aren't free or open-source.
[05:27.400 --> 05:29.740]  So, of course, we shouldn't trust them.
[05:31.240 --> 05:36.300]  And it does have full disk encryption, but the keys are stored on the phone.
[05:36.300 --> 05:49.660]  And so, it's a fairly trivial matter for a forensic analyst or anybody with Google research skills to figure out how to get that and decrypt your hard drive.
[05:50.260 --> 05:53.980]  The good things about it, you can enable a stronger screen lock on the Apple phone.
[05:54.100 --> 05:56.480]  You can actually enable a full text screen lock.
[05:57.460 --> 06:02.580]  And you can set it so that if you enter the screen lock wrong 10 times, it wipes the phone.
[06:04.760 --> 06:05.840]  So, there's that.
[06:06.020 --> 06:06.800]  You can have stronger...
[06:06.800 --> 06:10.120]  There's off-the-record chat, which is chat secure.
[06:10.460 --> 06:13.800]  And that works with any other OTR client, like Pidgin or JibberBot.
[06:15.140 --> 06:17.980]  There's private GSM, which is encrypted voice over IP.
[06:18.220 --> 06:19.940]  And that seems like a pretty good solution for that.
[06:20.760 --> 06:22.540]  And there is an unofficial Tor app.
[06:22.660 --> 06:25.000]  I haven't been able to ask any Tor folks what they think of it.
[06:25.100 --> 06:27.020]  But it's not from the Tor project.
[06:27.340 --> 06:30.180]  So, again, I wouldn't trust it.
[06:30.760 --> 06:31.920]  And there's less malware.
[06:32.940 --> 06:35.200]  There's less malware on iPhone than there is on Android.
[06:36.700 --> 06:40.600]  So, if malware is a big concern for you, then maybe that's an advantage.
[06:46.420 --> 06:47.080]  Excuse me.
[06:48.140 --> 06:51.800]  Android, in my opinion, is the best phone for security.
[06:52.400 --> 06:53.560]  It's open-source.
[06:53.720 --> 06:55.000]  There's lots of security tools.
[06:55.220 --> 06:56.180]  Lots of encryption tools.
[06:56.600 --> 06:58.240]  There's strong screen locks.
[06:58.560 --> 07:04.080]  And there's amazing organizations behind Android, like the Guardian Project and formerly Whispersys.
[07:06.420 --> 07:08.520]  And so, yeah, I really think it's the best phone.
[07:09.580 --> 07:11.440]  But let's talk about threat models again.
[07:15.810 --> 07:24.870]  So, currently in California and many other states, an arresting officer can search your phone if it doesn't have a password lock on it or if he can get your password from you.
[07:25.890 --> 07:27.670]  They can rifle through your phone.
[07:27.750 --> 07:29.470]  This was decided in the People vs. Diaz case.
[07:30.530 --> 07:37.430]  He can rifle through your phone or he or she can rifle through your phone and use any incriminating evidence against you or against other people.
[07:39.530 --> 07:44.390]  This has been tested in a few states and has held.
[07:44.550 --> 07:47.530]  It's been tested in a couple of other states like Ohio and lost.
[07:47.790 --> 07:53.070]  So, in Ohio, for example, you cannot search a detainee's phone.
[07:53.630 --> 07:58.230]  And currently in New York, case law hasn't been tested yet, as far as I know.
[08:01.250 --> 08:04.210]  So, what are law enforcement investigators looking for?
[08:04.830 --> 08:10.770]  And this is really in the case of forensics or just an officer on the street and you're in a situation where you're being detained.
[08:11.690 --> 08:26.050]  They're looking for subscriber and equipment identifiers, the unique ID that's on your phone, your list of contacts, appointment calendars, photos, maps, where you've been, what you're doing, your text messages, anything that could possibly be incriminating.
[08:26.870 --> 08:29.810]  But none of you are storing anything incriminating on your phones, right?
[08:34.020 --> 08:34.540]  So...
[08:37.280 --> 08:37.800]  Yeah.
[08:39.600 --> 08:44.020]  So, the forensic methods that they use are...
[08:44.020 --> 08:52.500]  Basically, the general forensic technique is to make, for those of you that don't know, is to make a pristine dump of the memory of your phone.
[08:52.500 --> 09:12.200]  And this can be accomplished in a couple of ways, with software forensics tools, by first recovering the screen lock through various methods, either by a phone being on with Android debug bridge turned on, or by booting into recovery mode.
[09:13.000 --> 09:18.860]  And if both of those fail, there's something called JTAG interface, which stands for Joint Test Action Group.
[09:18.860 --> 09:32.560]  And this is a standard in all CPUs that allows you to take apart the phone and solder this little device to it, and it lets you create a dump of the memory.
[09:33.280 --> 09:43.100]  This is possibly a destructive act, so it's possible that it could be ruled that that made the evidence forensically invalid, but it's possible that it could be...
[09:43.100 --> 09:45.720]  Anyway, so those are the forensic methods.
[09:45.720 --> 09:47.240]  So what are the solutions here?
[09:47.880 --> 09:56.640]  One is having a strong screen lock and a short timeout, so that your screen lock is almost always on by the time an officer gets to you, so that they can't just rifle through your phone.
[09:57.300 --> 10:00.580]  Also, turning off USB debugging is super important.
[10:00.800 --> 10:06.160]  If you have USB debugging on, anybody with physical access to your phone has root on your phone.
[10:06.800 --> 10:08.060]  If you have root on your phone.
[10:08.260 --> 10:12.580]  And if not, then they can use a root exploit that you would use to root your phone and root your phone.
[10:15.360 --> 10:18.120]  Turning USB debugging off makes forensics a lot harder.
[10:18.280 --> 10:29.580]  A lot of the forensics analysis documents that I read, a lot of presentations from the FBI that I read, said, they were like, if the person has root and USB debugging turned on, then it's a piece of cake.
[10:29.720 --> 10:31.760]  If not, use a JTAG.
[10:32.240 --> 10:34.500]  So, turn USB debugging off.
[10:34.640 --> 10:37.020]  It's a great way to make forensics a lot harder.
[10:37.020 --> 10:39.920]  And obviously, don't tell them your password.
[10:40.140 --> 10:45.240]  You don't have to tell a law enforcement officer anything other than your name and address, I think.
[10:45.340 --> 10:46.280]  Does that even root
[10:49.930 --> 10:50.130]  out?
[10:50.870 --> 10:55.190]  If it's rooted and you turn off the debugger, the problem then is recovery mods.
[10:56.030 --> 11:02.650]  Because recovery mods can then be used to access the whole of your phone as root, unless you have part of it encrypted.
[11:04.970 --> 11:09.170]  Which is why I said earlier, if somebody does get physical access to your phone, you should consider it compromised.
[11:17.330 --> 11:20.110]  Not telling an officer your password always holds up.
[11:20.290 --> 11:22.590]  A judge can compel you to tell your password though.
[11:23.730 --> 11:27.970]  And that's up to the judge and up to you and your lawyer that you need to talk about that.
[11:27.970 --> 11:29.650]  I'm only saying don't talk to the police.
[11:34.840 --> 11:35.760]  That's... yeah.
[11:36.860 --> 11:38.300]  Really in all cases, yeah.
[11:38.580 --> 11:39.780]  Don't talk to the police.
[11:40.620 --> 11:42.700]  And encryption is a really good...
[11:42.700 --> 11:45.580]  Like, somebody out there was asking about if they...
[11:45.580 --> 11:47.180]  And if you boot into recovery mode.
[11:47.300 --> 11:55.780]  Well, if you have parts of your phone encrypted, then even booting into recovery mode won't be able to retrieve those parts.
[11:55.940 --> 11:58.080]  So, that's a really good thing to do.
[12:01.120 --> 12:02.380]  So, signal interception.
[12:02.820 --> 12:03.720]  How many of you were...
[12:03.720 --> 12:04.880]  Well, I can't see hands anymore.
[12:05.060 --> 12:07.840]  But by a round of applause, how many of you were at the drone talk today?
[12:10.990 --> 12:12.330]  That was a really awesome talk.
[12:13.170 --> 12:19.270]  So, you obviously heard about all the crazy ways that signal interception can happen with little crazy flying planes.
[12:21.190 --> 12:25.750]  And you can even build that yourself with something called USRP and the GNU radio.
[12:25.750 --> 12:29.010]  You can build your own GSM tower for...
[12:29.010 --> 12:33.350]  Well, your own GSM backpack, essentially, for less than $1,000.
[12:34.910 --> 12:40.130]  In addition to drones, there's also companies that offer this as a service to law enforcement agents.
[12:41.070 --> 12:43.830]  And maybe to people that aren't law enforcement agents as well.
[12:44.630 --> 12:45.530]  I don't know.
[12:47.170 --> 12:51.650]  And often, cellular companies will just provide wiretaps and location data.
[12:52.850 --> 12:57.090]  Especially location data and who was at a certain cell site without even a warrant.
[12:58.970 --> 13:00.950]  So, what can we do about this?
[13:01.250 --> 13:06.970]  One thing we can do is make encrypted phone calls using encrypted voice over IP or the ZRTP protocol.
[13:08.110 --> 13:10.230]  We can also use encrypted text messages.
[13:11.030 --> 13:13.690]  TextSecure is a good project for that.
[13:14.250 --> 13:15.670]  Or you can just talk in person.
[13:17.070 --> 13:17.650]  That's great.
[13:17.890 --> 13:18.410]  That's it.
[13:18.570 --> 13:19.590]  Leave your phone at home.
[13:19.730 --> 13:20.250]  Leave it on.
[13:20.510 --> 13:22.090]  Turn on the shower and go for a walk.
[13:22.270 --> 13:24.430]  That's a great way to have a conversation.
[13:26.950 --> 13:28.830]  When they think you're high-tech, go low-tech.
[13:29.950 --> 13:30.730]  Johnny Mnemonic?
[13:30.950 --> 13:31.010]  No?
[13:31.190 --> 13:31.310]  Okay.
[13:35.290 --> 13:37.110]  I've gotten so much applause this talk.
[13:37.250 --> 13:37.690]  It's awesome.
[13:39.870 --> 13:41.230]  So, screen lock.
[13:41.350 --> 13:42.830]  There's four types of screen lock on Android.
[13:43.070 --> 13:44.150]  There's face unlock.
[13:44.590 --> 13:46.250]  There's pattern, pin, and password.
[13:48.250 --> 13:49.990]  Does anybody here use the face unlock?
[13:52.530 --> 13:53.230]  Okay, good.
[13:53.910 --> 13:54.790]  It's the worst.
[13:54.890 --> 13:57.090]  Your phone can be unlocked with a picture of you.
[13:59.590 --> 14:02.130]  Or now, I think they fixed it, so you have to blink.
[14:02.870 --> 14:05.030]  I'm sure nobody can figure out a way around that.
[14:05.990 --> 14:07.770]  It's actually when it doesn't recognize you.
[14:08.030 --> 14:08.230]  Yeah.
[14:09.390 --> 14:11.050]  And then you have an existential crisis.
[14:11.290 --> 14:11.970]  It's not good.
[14:13.230 --> 14:15.650]  The pattern is not really much better.
[14:16.590 --> 14:19.130]  Grease from your fingers leaves the pattern on the...
[14:19.130 --> 14:21.350]  leaves a trail of the pattern on the screen, oftentimes.
[14:21.830 --> 14:28.450]  And there's only about 360,000 possible combinations, which would be easy for a machine, obviously, to crack.
[14:28.810 --> 14:30.330]  Also, it's easily guessed, again.
[14:30.330 --> 14:35.290]  A lot of people use right angles down the left side and bottom, or right side and bottom, or...
[14:35.290 --> 14:38.150]  There's a few very common ones that are used.
[14:39.630 --> 14:44.010]  And it's stored without a salt in the file system.
[14:44.130 --> 14:48.950]  It's hashed, but it's not salted, so it would be very easy to create a rainbow table, if you wanted to crack it that way for some reason.
[14:50.930 --> 14:52.150]  Numeric pin is slightly better.
[14:52.150 --> 14:57.850]  The smudge attack can be mitigated by doubling up on numbers.
[14:58.130 --> 15:00.850]  So you don't have any idea how many times I pressed a certain number.
[15:03.150 --> 15:05.690]  And not having only four numbers in your pin.
[15:05.890 --> 15:09.550]  10 to the 16 possible combinations with the longest possible pin.
[15:09.930 --> 15:10.970]  So a bit better.
[15:10.970 --> 15:13.810]  And then, of course, password has...
[15:13.810 --> 15:18.130]  Using every possible character and a 16 character password, about 10 to the 30 combinations.
[15:19.490 --> 15:21.410]  So, you know, that's a lot.
[15:21.530 --> 15:34.450]  With only the upper, lower, and numeric, you have about 839 quadrillion possible passwords, which I don't have any sources for these numbers, other than that I swear to God I actually calculated this.
[15:35.950 --> 15:39.990]  So your mileage may vary, but it would take a desktop about 647,000 days to crack.
[15:40.570 --> 15:43.730]  Or with a strong computer, a bit less than 100.
[15:44.030 --> 15:46.210]  Or with an NSA computer, probably like a day.
[15:47.430 --> 15:48.350]  How are those stored?
[15:49.030 --> 15:53.430]  Those are also stored hashed, but they're also stored salted, and they're stored in your data partition.
[15:56.070 --> 15:58.670]  So choose a strong password, and set a password lock.
[15:58.810 --> 15:59.390]  That's my advice.
[16:03.060 --> 16:06.080]  You cannot get the hash if you don't already have access to the file system.
[16:06.080 --> 16:14.460]  So, yeah, I'm dubious as to what merit retrieving the hash would be, but there was a big, long forensics article on it, and I found it interesting.
[16:18.680 --> 16:26.020]  And so, but if an attacker can invent your lock screen without having to guess your password, of course having a strong password is useless.
[16:26.260 --> 16:34.100]  So the ways to do that, again, are physical access to a rooted phone with USB debugging turned on, recovery mods.
[16:35.020 --> 16:39.800]  Again, if you boot into clockwork mod, and I don't know about the stock recovery mod, if this works too.
[16:40.920 --> 16:42.140]  I haven't been able to test that.
[16:42.320 --> 16:46.820]  But if you boot into those, you have access to the phone, or again, a JTAG interface.
[16:49.300 --> 16:57.380]  So the solutions are choose a strong screen lock, turn off USB debugging, and use disk encryption if you possibly can.
[16:59.620 --> 17:04.300]  If you've lost or stolen your phone, this is probably the one that we're almost in danger of here.
[17:05.970 --> 17:11.270]  There's a bunch of phone finding applications, and apps that do remote wipe.
[17:12.040 --> 17:13.490]  Poison Pill is a good one.
[17:13.620 --> 17:15.080]  It's recommended by the Guardian Project.
[17:15.840 --> 17:19.530]  There's Prey, which is, pardon me, which is cross-platform and open-source.
[17:19.990 --> 17:20.700]  That's nice.
[17:21.400 --> 17:22.510]  Lookout also does this.
[17:22.580 --> 17:26.160]  Lookout Mobile Security is anti-virus and remote wipe.
[17:26.160 --> 17:30.360]  And they seem like a pretty good organization, but again, not open-source.
[17:31.690 --> 17:36.300]  And something called Droid Tracker, which I can't remember what it is, so I won't say anything about it.
[17:39.160 --> 17:47.990]  Have a strong screen lock, so that the knucklehead who picked up your phone can't guess it, and look through your pictures, and see your Pokemon porn or whatever.
[17:52.360 --> 18:05.120]  And report it to the provider, not that they'll necessarily give a shit, but for a long time, AT&T and other companies weren't even blacklisting the IMEI.
[18:05.120 --> 18:14.120]  They weren't even blacklisting the serial numbers of stolen phones, so you could just go reactivate it somewhere else, because it was in their financial interest to have new customers and make them sign new contracts.
[18:16.030 --> 18:16.800]  So malware.
[18:19.400 --> 18:23.930]  There have been a couple of talks about malware this con, so I won't go too deeply into this.
[18:25.300 --> 18:27.320]  But has anybody here heard of CarrierIQ?
[18:27.840 --> 18:28.490]  Yeah, we have.
[18:28.640 --> 18:29.290]  Yeah, okay.
[18:29.560 --> 18:36.750]  So they made, for those that haven't, they made spyware that was on practically every Android phone, and who put it there?
[18:36.840 --> 18:37.560]  The phone companies.
[18:38.620 --> 18:39.840]  Every phone company...
[18:39.840 --> 18:41.080]  Basically, it wasn't even spyware.
[18:41.270 --> 18:43.190]  Well, it was spyware, but it was a rootkit.
[18:43.770 --> 18:48.510]  And what it did was send every keystroke back to CarrierIQ.
[18:48.730 --> 18:51.230]  It sent every website you visited back to CarrierIQ.
[18:51.730 --> 18:53.540]  And I think it said some other stuff, too.
[18:54.040 --> 19:03.540]  So it was a rootkit that the phone companies told CarrierIQ to put on there, because CarrierIQ's business model was, we'll give you deep analytics on how people are using your phones.
[19:04.360 --> 19:08.730]  And so a researcher discovered it, and they were very pissed about that.
[19:08.730 --> 19:14.320]  He published the packages and all the documentation he had on...
[19:14.320 --> 19:16.250]  I think he published it on Ars Technica.
[19:17.160 --> 19:18.620]  And CarrierIQ was pissed.
[19:18.820 --> 19:20.120]  They sent him DMCA letters.
[19:20.270 --> 19:21.290]  They sent him takedown notices.
[19:21.710 --> 19:23.690]  They were calling him and threatening him.
[19:24.250 --> 19:27.750]  And then, of course, everybody heard about it, and it got a lot of media attention.
[19:28.540 --> 19:30.860]  And CarrierIQ said, Oops, never mind.
[19:31.060 --> 19:31.730]  That's okay.
[19:32.040 --> 19:34.290]  We're just a friendly company, and you can leave that up.
[19:34.300 --> 19:37.490]  We don't mind, because we have nothing to hide anymore.
[19:41.900 --> 19:45.080]  So there's a bunch of CarrierIQ detectors out there.
[19:48.660 --> 19:51.930]  And I had the name of one of them, and I don't have it anymore.
[19:53.640 --> 20:00.930]  And there's all sorts of other bloatware and spyware, and just really the usual suspects that we see in malware.
[20:00.930 --> 20:09.540]  Anything spyware, Trojans, phishing attacks, bank fraud.
[20:09.730 --> 20:16.040]  Basically, everything you really expect to see in malware on your computer also exists on the phone now.
[20:16.380 --> 20:19.060]  And, of course, the Facebook app.
[20:19.400 --> 20:21.380]  Is it just a giant spyware app?
[20:22.300 --> 20:24.080]  Highly recommend you don't install that.
[20:26.540 --> 20:28.450]  So how can we prevent malware?
[20:28.930 --> 20:32.710]  The first thing is don't download random shit.
[20:34.710 --> 20:40.470]  Don't, you know, other than F-Droid, don't use third-party app stores.
[20:42.880 --> 20:48.230]  And, you know, if your friend sends you a text message with an APK attached, maybe don't install it.
[20:48.990 --> 20:51.290]  And, you know, don't install things off of download sites.
[20:51.510 --> 20:53.270]  Just be careful what you install.
[20:53.470 --> 20:56.320]  And, of course, you can also use antivirus like Lookout or something else.
[20:56.490 --> 20:58.340]  There's no open-source antivirus, unfortunately.
[20:58.600 --> 21:05.100]  So I guess I'll have to recommend Lookout because a respected colleague does work there, and he says that they're all right.
[21:05.270 --> 21:07.930]  So you can take it on my word that this guy's cool.
[21:12.940 --> 21:15.400]  And you can also use permission selection apps.
[21:15.920 --> 21:17.320]  Permissions denied is a good one.
[21:17.490 --> 21:25.190]  It basically lets you select what permissions the app has.
[21:25.300 --> 21:32.600]  And, of course, this can cause all sorts of weird things to happen to an app if it doesn't have the permissions it expects, and the app developers haven't written in exceptions for that.
[21:34.540 --> 21:43.320]  But then maybe you know that this, you know, maybe need for speed 2 doesn't need a list of all your contacts.
[21:43.320 --> 21:43.820]  I don't know.
[21:45.800 --> 21:57.160]  And, of course, installing CyanogenMod, rooting your phone, or installing any other mod, or installing just vanilla Android is a good way to remove bloatware and carrier-installed spyware and things like that.
[22:01.680 --> 22:04.240]  But even an app with no permissions can do a lot.
[22:04.780 --> 22:17.620]  There was a study by some Android security researcher, whose name again escapes me, where he created an app with zero permissions just to see what he could get.
[22:18.640 --> 22:22.500]  And from an app with zero permissions, you can read all the files on the SD card.
[22:22.780 --> 22:25.840]  You can get a list of all the packages that are installed on the phone.
[22:25.840 --> 22:34.820]  You can access any application files that have poorly set permissions, or world-readable permissions.
[22:35.220 --> 22:36.480]  You can read those.
[22:36.680 --> 22:38.320]  Or if they're world-writable, you can write to them.
[22:39.300 --> 22:41.380]  And this is more common than you'd expect.
[22:41.720 --> 22:45.320]  You can read GSM IDs and SIM vendor IDs.
[22:45.940 --> 22:50.720]  You can read the Android ID, which is an ID that's unique to your phones.
[22:50.720 --> 22:53.840]  You can uniquely identify a person possibly that way.
[22:54.700 --> 23:00.380]  And you can call home with all this information by opening up a browser and sending a GET request to a page.
[23:00.720 --> 23:01.980]  All with zero permissions.
[23:02.420 --> 23:05.720]  So you can really do a lot with nothing here.
[23:06.340 --> 23:10.540]  How do they GET requests without Internet Access?
[23:11.260 --> 23:16.300]  You don't need Internet Access permission to open up a browser intent with a URL.
[23:16.940 --> 23:24.460]  So you're just opening up a browser and passing it a URL, and hopefully the person doesn't notice that a browser is opening, or you put porn on there so they don't care.
[23:27.600 --> 23:28.480]  Or games.
[23:32.880 --> 23:33.320]  Exactly.
[23:33.820 --> 23:34.400]  So, yeah.
[23:37.560 --> 23:39.720]  And other attacks that are unique to the phone.
[23:40.220 --> 23:41.800]  If you have an NFC chip reader.
[23:41.940 --> 23:44.820]  I just discovered this today and was really freaked out.
[23:45.540 --> 23:49.380]  An NFC chip can open up a browser without asking you...
[23:49.380 --> 23:50.500]  So I was reading...
[23:50.500 --> 23:56.800]  One of the hack labs up here had an NFC chip with the troll face guy on it that said scan me for lulz.
[23:56.900 --> 23:59.120]  And of course I was like, okay, that sounds like a great idea.
[24:01.000 --> 24:05.080]  So I scanned it and it immediately opened up a browser window and started loading up a page.
[24:05.080 --> 24:06.720]  At which point I immediately pulled my battery.
[24:09.320 --> 24:12.460]  And so the lesson here is be careful what you scan.
[24:13.420 --> 24:16.440]  Apparently NFC can open up browser without even asking your permission.
[24:16.640 --> 24:17.460]  I did not know that.
[24:20.320 --> 24:22.520]  And another possible attack is...
[24:22.520 --> 24:26.260]  Well, the NFC can trigger an intent which opens up the browser.
[24:26.640 --> 24:27.840]  I mean, it's not...
[24:27.840 --> 24:27.860]  Anyway.
[24:29.620 --> 24:31.220]  And QR code phishing.
[24:31.220 --> 24:42.340]  What if somebody were to put fake QR codes on all the Bank of America subway ads that led you to a Bank of America phishing site?
[24:42.960 --> 24:52.700]  Or what if you were the yes men and you put QR ads on all the Chevron billboards that led you to a Chevron troll site?
[24:53.420 --> 24:55.880]  So there's some cool things that can be done there actually.
[24:56.000 --> 24:57.780]  And I'd really like to see somebody research this.
[25:02.650 --> 25:04.270]  So I've been talking a lot about encryption.
[25:04.550 --> 25:06.270]  And I'm going to talk a little bit more about it.
[25:06.670 --> 25:11.830]  So Android has some full disk encryption built in since Android 3, Honeycomb.
[25:13.770 --> 25:14.170]  And...
[25:16.170 --> 25:16.970]  Does any...
[25:16.970 --> 25:20.530]  No, well, it's Android 3 on tablets and Android 4 on the phone.
[25:20.670 --> 25:21.750]  It's in Ice Cream Sandwich as well.
[25:22.690 --> 25:23.830]  Does anybody here...
[25:23.830 --> 25:25.550]  Is anybody here on like the Google Android team?
[25:26.430 --> 25:28.250]  Because I got a f*cking bone to pick with you.
[25:31.580 --> 25:33.820]  They really screwed up full disk encryption.
[25:34.060 --> 25:35.380]  So I'm glad it's there.
[25:35.560 --> 25:36.040]  And it...
[25:36.040 --> 25:39.200]  I shouldn't say full disk encryption because it's not full disk encryption.
[25:39.440 --> 25:41.180]  It encrypts the data partition.
[25:43.040 --> 25:46.080]  And sometimes it encrypts the SD card partition.
[25:46.460 --> 25:48.400]  Well, only sometimes it encrypts the data partition.
[25:48.520 --> 25:50.380]  On a lot of phones it actually just doesn't even work.
[25:51.480 --> 25:53.020]  But on the phones it does work.
[25:53.120 --> 25:55.060]  On my phone it encrypted the SD card.
[25:55.240 --> 25:56.800]  On other people's phone it has not.
[25:57.020 --> 25:59.640]  So your mileage may vary as to whether it encrypts your phone at all.
[26:01.720 --> 26:03.120]  It uses dmcrypt.
[26:03.220 --> 26:03.840]  That's a good thing.
[26:03.940 --> 26:06.260]  That's the tried and true method of encrypting.
[26:07.400 --> 26:09.840]  It's part of the encryption process for a Linux hard drive.
[26:11.000 --> 26:13.260]  So we know that this is cryptographically secure.
[26:14.360 --> 26:18.980]  But the worst part is that it uses your lock screen as the encryption key.
[26:19.140 --> 26:21.400]  It uses your lock screen password as the encryption key.
[26:21.780 --> 26:27.000]  So you either have a really complicated lock screen or a really shitty hard disk encryption password.
[26:28.120 --> 26:29.460]  It's not a good balance.
[26:29.740 --> 26:34.080]  Nobody wants to pull out their phone and then sit there for a minute entering their lock screen password.
[26:34.580 --> 26:40.600]  But also, if you have a four digit pin for your disk encryption, well, you might as well not even have disk encryption.
[26:43.080 --> 26:44.840]  So what are some other options?
[26:45.360 --> 26:48.180]  Well, there was a whisper core until Twitter bought it.
[26:48.360 --> 26:50.720]  And now there's no more such thing as whisper core.
[26:53.180 --> 26:53.660]  TrueCrypt.
[26:53.740 --> 27:02.560]  There's a TrueCrypt container application called Kryptonite, which will create and read and write to TrueCrypt containers.
[27:02.560 --> 27:08.360]  So you could use that on your SD card, but not on your file system.
[27:10.020 --> 27:19.360]  And there's also Lux Manager, which uses Lux, which can create Lux containers, which Lux is the other part of the system that does hard disk encryption for Linux.
[27:21.200 --> 27:21.980]  Excuse me a second.
[27:26.560 --> 27:29.100]  And so Lux can also be used to encrypt your SD card.
[27:30.860 --> 27:32.520]  And there's something called IO Cypher.
[27:32.600 --> 27:34.210]  This is, again, being written by the Guardian project.
[27:34.210 --> 27:35.410]  It's for devs.
[27:35.480 --> 27:36.190]  It's still in alpha.
[27:36.710 --> 27:41.340]  But basically what it does is it allows you to create an encrypted virtual file system for your app.
[27:41.670 --> 27:48.000]  So your app gets its own file system and it's stored completely encrypted with a password that the user has to enter.
[27:48.300 --> 27:52.240]  And then when the app is done, the file system goes back to being encrypted.
[27:52.500 --> 27:57.360]  So even if you don't have full disk encryption, you can at least encrypt the space that your app runs in.
[27:57.360 --> 27:59.000]  So that's going to be pretty cool.
[28:00.690 --> 28:02.210]  And what about call encryption?
[28:06.620 --> 28:10.220]  OSTN is a project by OSTel.
[28:10.430 --> 28:15.340]  These are a bunch of people that have been doing a lot of really cool work in the...
[28:15.340 --> 28:16.190]  Sorry, what?
[28:16.760 --> 28:16.980]  Oh.
[28:17.540 --> 28:22.190]  In the encryption and Android security field.
[28:22.190 --> 28:26.950]  So it stands for Open Secure Source or Standards Telephony Network.
[28:27.910 --> 28:34.000]  And it uses ZRTP, which is a protocol that Phil Zimmerman, the inventor of PGP, invented.
[28:34.500 --> 28:41.460]  And it's a protocol for end-to-end encryption of voice over IP.
[28:42.980 --> 28:47.620]  The goal of OSTN is to have a federated network with no central authority, very similar to Jabber.
[28:49.300 --> 28:54.340]  And you get a real phone number, which is something like 312 at OSTel.me.
[28:58.180 --> 29:03.580]  And they have a client based off of CSIP Simple, which is the gold standard for voice over IP for Android.
[29:03.720 --> 29:05.430]  It's open-source and it's great.
[29:05.960 --> 29:09.240]  But it also works with their own client, which is called OSTel.
[29:09.910 --> 29:16.430]  And it works with a client called Private GSM, which runs on Android, iPhone, and even Blackberry.
[29:16.620 --> 29:20.060]  So you can have encrypted conversations with all your friends, which is great.
[29:20.880 --> 29:22.860]  So definitely check out OSTel.me.
[29:22.860 --> 29:29.060]  And if you want my VoIP phone number for an encrypted phone call later, I'll give that to you.
[29:30.190 --> 29:32.360]  I don't know why you would want to call me, but...
[29:34.120 --> 29:35.380]  What about other encryption?
[29:36.580 --> 29:37.930]  Jibberbot is fantastic.
[29:38.690 --> 29:40.140]  Everybody knows what...
[29:40.140 --> 29:42.880]  Okay, does anybody not know what off-the-record chat is?
[29:43.500 --> 29:47.140]  Not in the sense of Google not logging it, but actually encrypted OTR.
[29:47.880 --> 29:48.620]  Okay, good.
[29:49.020 --> 29:51.740]  So Jibberbot is the OTR application for Android.
[29:52.060 --> 29:52.500]  It's fantastic.
[29:52.710 --> 29:53.740]  You should definitely install it.
[29:54.480 --> 29:57.280]  APG is the PGP application for Android.
[29:57.280 --> 30:03.560]  I don't feel great about having PGP key, private keys, stored on my phone.
[30:03.960 --> 30:09.500]  But there are some solutions to that, like having a master key and only storing a temporary key on your phone.
[30:12.240 --> 30:16.290]  There's Orbot and Orweb, which are not encryption, but anonymity.
[30:16.280 --> 30:18.640]  This is Tor for Android.
[30:19.580 --> 30:23.980]  Orbot is the Tor software on Android.
[30:24.120 --> 30:25.720]  And then Orweb is Tor browser.
[30:27.330 --> 30:28.480]  Android has OpenVPN.
[30:29.340 --> 30:31.320]  So you can have your data partition...
[30:31.800 --> 30:33.040]  Sorry, not your data partition.
[30:33.220 --> 30:40.710]  You can have your 3G connection, or 4G, encrypted all the time, going over a virtual private network, which is really nice.
[30:40.710 --> 30:44.320]  And worth doing, except it makes it slower.
[30:44.670 --> 30:48.560]  And most people's data, most of the time, is already pretty slow.
[30:48.910 --> 30:50.140]  Especially here, for some reason.
[30:55.320 --> 31:00.430]  And something to keep in mind is that OpenVPN encrypts your data connection, but it doesn't encrypt your voice connection.
[31:00.430 --> 31:04.840]  So this is not a replacement for using OSTEL or ZRTP.
[31:06.720 --> 31:11.740]  Somebody could still intercept your phone call or drop you down to 2G and intercept your phone call that way.
[31:12.990 --> 31:21.710]  There's NoteCypher, which is based off of SQLCypher, which is a library written to store encrypted SQLite databases.
[31:22.960 --> 31:30.950]  And then there's TextSecure, which was written by WhisperSys, but is the only project that survived out of there, which is now open-source.
[31:31.190 --> 31:35.620]  And it's end-to-end encrypted text messaging in a fashion similar to OTR.
[31:37.120 --> 31:41.710]  And there's Cryptocat, which is a multi-party chat.
[31:42.190 --> 31:43.520]  And this is an alpha.
[31:43.800 --> 31:45.060]  It's in alpha right now for Android.
[31:45.210 --> 31:46.100]  It's still kind of buggy.
[31:46.520 --> 31:48.300]  But on the web, it's awesome.
[31:48.340 --> 31:49.760]  And I'm sure it'll get awesome on Android, too.
[31:51.000 --> 31:53.210]  Did anybody go to the Cryptocat talk this morning?
[31:53.860 --> 31:54.340]  Yeah.
[31:54.840 --> 31:55.460]  That guy was rad.
[31:59.410 --> 32:00.910]  So some other useful apps.
[32:05.190 --> 32:07.500]  Duck.go is an alternative search provider.
[32:08.260 --> 32:11.600]  Some other results probably aren't as good as Google, but they don't...
[32:11.600 --> 32:15.840]  They say they don't log your IP address, and they definitely don't bubble your search results.
[32:16.760 --> 32:19.580]  So they just show the same results to everybody, which is kind of nice.
[32:20.560 --> 32:29.280]  There's KeePass, which is a great password storage software that runs on pretty much every platform there is.
[32:29.710 --> 32:31.960]  There's AdAway, which is... this thing is cool.
[32:32.060 --> 32:34.690]  It's like ad block plus, but for your entire phone.
[32:34.820 --> 32:37.500]  So it'll block ads for every application you have.
[32:37.850 --> 32:41.580]  And how it does this is by putting a bunch of entries in your host's file.
[32:42.280 --> 32:47.040]  But it is open-source, and you can go look at that host's file and make sure that they're not doing anything shady.
[32:49.060 --> 32:50.100]  There's FDroid.
[32:50.320 --> 32:51.240]  FDroid is great.
[32:51.430 --> 32:53.500]  FDroid is an alternative Android market.
[32:53.690 --> 32:55.320]  It's the only one I recommend you use.
[32:55.910 --> 32:58.240]  They have only open-source software.
[32:59.040 --> 33:05.220]  Either with the GPL or Apache or other open-source licenses.
[33:05.870 --> 33:10.300]  And you can set up your own repositories, much like Debian.
[33:11.580 --> 33:13.190]  So FDroid is really great.
[33:13.320 --> 33:15.580]  I try to install as much software off of it as possible.
[33:15.580 --> 33:17.980]  It's not always up to date with the Play Store.
[33:20.710 --> 33:21.600]  But that's okay.
[33:24.080 --> 33:25.710]  Sometimes we sacrifice usability.
[33:27.260 --> 33:32.710]  ObscuraCam is an app that lets you blur out people's faces in pictures or videos.
[33:33.120 --> 33:35.140]  Blur them or even redact them entirely.
[33:35.430 --> 33:37.780]  So if you're at a protest or other...
[33:39.360 --> 33:43.450]  Or if you're taking pictures of somebody where they're doing something illegal, you can blur out their faces.
[33:43.450 --> 33:49.560]  And then even if somebody like a law enforcement agent does see those pictures, they can't...
[33:49.560 --> 33:50.860]  There's nothing really incriminating there.
[33:51.860 --> 33:57.020]  I mean, there is incriminating things, but they'll have a much harder time actually prosecuting somebody for that.
[33:57.840 --> 34:05.380]  CA SERP manager lets you revoke or install new root certificates or old root certificates.
[34:05.380 --> 34:12.860]  If you don't want to trust GoDaddy and their SSL certificate, for example, you can remove that.
[34:13.380 --> 34:14.300]  There's Firefox.
[34:15.380 --> 34:17.220]  IP tables log is pretty great.
[34:17.700 --> 34:21.600]  It makes a log of all the traffic going in and out of your system.
[34:21.600 --> 34:25.320]  So if you do have malware on there, this is a good way to find out about it.
[34:26.680 --> 34:29.840]  There's Shark, which is Wireshark or a packet logging application.
[34:30.000 --> 34:35.450]  Again, another way to inspect all the packets, network packets that are going in and out of your phone.
[34:36.600 --> 34:39.560]  And ALogcat, which lets you read Android's logs.
[34:39.560 --> 34:44.700]  So these are all ways you can do... these are all ways you can pen-test your own phone.
[34:44.890 --> 34:47.160]  And I recommend auditing your own phone.
[34:47.520 --> 34:54.560]  When you go home or, you know, when you go back to your hotel room tonight, see if you can break into your phone without knowing your screen lock password.
[34:54.810 --> 34:55.350]  Plug it in.
[34:55.430 --> 34:56.520]  Do you have ADB turned on?
[34:56.790 --> 34:59.240]  Or there was a talk on Friday.
[35:00.220 --> 35:04.540]  There's an Android penetration framework... or Android penetration testing framework now.
[35:06.940 --> 35:09.720]  So take that home and run that on your phone and see what happens.
[35:10.720 --> 35:12.600]  I highly recommend auditing your own phone.
[35:12.700 --> 35:15.310]  It's really fun and it's a good way to find out about vulnerabilities.
[35:16.480 --> 35:20.430]  And then switch phones with a friend and audit their phone and have them audit your phone.
[35:23.690 --> 35:27.150]  So in conclusion, again, turn off USB debugging.
[35:27.430 --> 35:27.750]  Do it.
[35:27.870 --> 35:28.430]  Leave it off.
[35:28.730 --> 35:31.650]  Once you turn it back on for some reason, turn it back off again.
[35:32.930 --> 35:34.670]  Keep your phone on you at all times.
[35:35.350 --> 35:36.430]  Don't leave it places.
[35:37.030 --> 35:40.970]  This is really easy and it's, you know, just keep it in your pocket.
[35:41.190 --> 35:42.370]  Don't get drunk and leave it at the bar.
[35:45.520 --> 35:46.740]  I speak from experience.
[35:49.100 --> 35:50.300]  Trust what you install.
[35:50.460 --> 35:53.860]  You know, don't open... don't run random packages.
[35:54.540 --> 35:56.080]  You don't know what they contain.
[35:56.680 --> 35:57.820]  Open-source is awesome.
[35:58.080 --> 36:00.240]  If you can read the source code or if you can...
[36:00.240 --> 36:03.960]  If you have a friend that can assure you that the source code is okay, then that's awesome.
[36:03.960 --> 36:05.920]  And you'll be much more secure.
[36:06.660 --> 36:09.960]  I honestly do recommend rooting and installing CyanogenMod.
[36:10.300 --> 36:11.480]  There are...
[36:12.940 --> 36:17.920]  There are some downsides to rooting in that it's possible for them, for somebody to get root access to your phone.
[36:18.080 --> 36:19.420]  But I think that there's...
[36:19.420 --> 36:29.860]  The advantages far outweigh the downsides in the types of encryption apps you can install and the number of other really awesome features you can get from a rooted phone.
[36:29.860 --> 36:31.700]  And having CyanogenMod is really nice.
[36:33.600 --> 36:35.120]  Use a stronger screen lock.
[36:35.400 --> 36:38.160]  Audit your phone and encrypt everything you possibly can.
[36:38.300 --> 36:41.980]  Because encryption is your last and strongest line of defense here.
[36:43.640 --> 36:44.000]  So...
[36:45.500 --> 36:46.020]  That's it.
[36:46.220 --> 36:47.560]  This presentation is online.
[36:47.720 --> 36:48.160]  It's on GitHub.
[36:48.620 --> 36:51.120]  This is a QR code that I swear goes to GitHub.
[36:52.340 --> 36:53.380]  I don't believe...
[36:53.820 --> 36:54.360]  I don't...
[36:54.360 --> 36:55.780]  I don't know why you wouldn't believe me, sir.
[36:55.840 --> 36:56.860]  We've known each other for years.
[37:00.560 --> 37:01.440]  And there's...
[37:01.440 --> 37:03.420]  I put some resources on there and other things.
[37:05.380 --> 37:09.000]  Unless I had found an Oday for QR codes, it really is safe to scan this.
[37:12.830 --> 37:13.510]  I could.
[37:13.690 --> 37:14.190]  That's true.
[37:14.410 --> 37:15.830]  Maybe my presentation is a rootkit.
[37:16.010 --> 37:17.890]  It is a PDF file.
[37:18.370 --> 37:19.470]  Run this PDF file.
[37:19.530 --> 37:19.850]  It's fine.
[37:21.770 --> 37:23.390]  It says spiders.
[37:23.710 --> 37:24.730]  Will it cover up with spiders?
[37:25.690 --> 37:26.650]  That would be awesome.
[37:26.650 --> 37:27.870]  That would be telling too much.
[37:28.950 --> 37:29.510]  So, yeah.
[37:29.710 --> 37:30.130]  Thanks a lot.
[37:31.070 --> 37:31.850]  What was that?
[37:32.690 --> 37:32.830]  Oh.
[37:34.090 --> 37:34.470]  Yeah.
[37:34.590 --> 37:34.970]  Thanks a lot.
[37:35.110 --> 37:36.150]  Again, my name is Cooper.
[37:37.070 --> 37:40.330]  These are ways you can get in contact with me on Twitter or on Jabber.
[37:40.590 --> 37:42.530]  My OTR and PGP keys are there.
[37:43.770 --> 37:46.070]  And we can sign keys later if you want.
[37:47.050 --> 37:49.050]  And one more thing before I go to questions.
[37:52.180 --> 37:53.140]  All the way back.
[37:54.520 --> 38:00.240]  I'm a co-organizer of an event called Hackmeet, which is an unconference that we do...
[38:00.800 --> 38:02.940]  We're trying to do every year in San Francisco.
[38:03.300 --> 38:06.260]  The next one is happening October 19th through 21st.
[38:06.880 --> 38:09.620]  And you can go to hackmeet.org to find out more information.
[38:10.700 --> 38:11.620]  And it's really cool.
[38:11.760 --> 38:12.420]  It's an unconference.
[38:12.420 --> 38:17.260]  And we talk about a lot of things that are interesting to hackers and activists.
[38:17.680 --> 38:20.320]  We do it at the Noise Bridge Hackerspace in San Francisco.
[38:21.200 --> 38:27.260]  So I definitely recommend you check it out and maybe submit a talk or just come hang out and learn some cool stuff and meet some people.
[38:27.880 --> 38:30.020]  So thank you very much for coming out.
[38:30.440 --> 38:31.640]  I'll take some questions, I guess.
[38:31.800 --> 38:32.840]  I guess we can turn up the...yeah.
[38:41.570 --> 39:00.810]  So I just wanted to note, it's my understanding that with the erase your data, if you fail to log in 10 times feature or whatever on an iPhone, is that if you go through like a connector in the APIs to attempt to log in, it will not trigger the erasure if you do 10 wrong passwords.
[39:00.810 --> 39:05.450]  So you can just blitz it and within two hours, crack any four-digit PIN.
[39:07.030 --> 39:11.770]  I mean, if that's right, then...I mean, I don't know anything about that really.
[39:11.970 --> 39:13.830]  So yeah, that's good to know.
[39:14.070 --> 39:18.050]  And again, it's just another nail in the coffin for iPhone, really.
[39:19.290 --> 39:19.770]  Yeah.
[39:20.250 --> 39:21.170]  Two questions.
[39:21.350 --> 39:24.510]  One is, what might be a way to deactivate the microphone?
[39:24.850 --> 39:29.130]  Either detect that some app has it open or block it from being open?
[39:31.230 --> 39:33.410]  Turn off your...take the battery out.
[39:34.870 --> 39:47.210]  I mean, honestly, say somebody has a rootkit on your phone, and that could inject into any libraries that you would be using to detect the microphone being turned on and override that.
[39:47.350 --> 39:53.690]  So honestly, I think the only way that I can guarantee you that your microphone is not on is if you take the battery out of your phone.
[39:54.250 --> 39:54.730]  Okay.
[39:54.890 --> 39:58.870]  And then you mentioned that the encryption is based on your password.
[39:59.130 --> 39:59.630]  Yeah.
[40:00.050 --> 40:05.390]  So if you change the password, do you actually sit there while it unencrypts everything and re-encrypts everything?
[40:05.610 --> 40:05.950]  No.
[40:06.250 --> 40:13.390]  So the way it actually works is your password is the key for a storage container.
[40:13.690 --> 40:13.830]  Yeah.
[40:13.930 --> 40:15.050]  It's the key for the key.
[40:15.170 --> 40:16.210]  It's a key for a storage...okay.
[40:16.210 --> 40:18.530]  So I'll explain it in a little more detail, though.
[40:18.610 --> 40:18.970]  So it's...
[40:18.970 --> 40:24.030]  Your password is actually a key for a storage container which stores the actual full disk encryption key.
[40:24.190 --> 40:31.450]  So if you do change your screen lock password, it's actually a really quick process because it's only re-encrypting a very small file.
[40:31.450 --> 40:37.630]  But another caveat about encryption is that once you do encrypt your phone, you can't go back.
[40:37.750 --> 40:38.810]  You can't unencrypt it.
[40:38.950 --> 40:40.550]  That would defeat the purpose.
[40:41.110 --> 40:45.810]  So if you want to upgrade or reinstall your OS, you do have to wipe everything.
[40:47.250 --> 40:49.150]  I mean, it can probably do over the air update.
[40:49.410 --> 40:49.730]  I don't know.
[40:50.670 --> 40:54.830]  Does anybody know if it can do over the air updates while still having an encrypted drive?
[40:55.070 --> 40:55.950]  I don't know about that.
[40:56.090 --> 40:57.630]  So your mileage may vary there.
[40:58.230 --> 41:09.710]  Do you have any information about hardware forensic devices like the data slurpers and other things that you can connect to the phone to download all this data automatically that claim they can work around a lot of these restrictions?
[41:11.150 --> 41:13.810]  I mean, I think that they work...I don't.
[41:14.510 --> 41:22.690]  If I had to guess, I would say that they probably work around a lot of these restrictions in the same ways that attackers would, just in automated ways.
[41:22.870 --> 41:27.910]  So they'll probably try to reboot into recovery mode or see if you have ADB turned on.
[41:28.210 --> 41:29.250]  That would be my guess.
[41:31.550 --> 41:35.110]  But there's a lot of...a little bit of Googling will get you a long way.
[41:35.230 --> 41:48.170]  I found a ton of PDFs of presentations from law enforcement conferences about how they're trying to do forensics on smartphones and what are the best ways to do that.
[41:48.270 --> 41:54.510]  And they actually seem really...like they have not figured out really a general set of best practices for how to do forensics on these.
[41:54.610 --> 41:59.190]  Because there's so many ways that the data can be altered after they get it even.
[42:00.150 --> 42:01.130]  Kind of similar question.
[42:01.230 --> 42:02.690]  You mentioned audit your own phone.
[42:02.690 --> 42:08.730]  You know, I've been thinking about that for a little while going...what is in fact on here?
[42:09.210 --> 42:14.190]  You know, is there any like...can you go somewhere and check the hashed values for certain resources?
[42:14.390 --> 42:15.950]  I mean, we've done this in other operating systems.
[42:16.110 --> 42:18.410]  But I mean, you know, there's so many of these dang phones around.
[42:18.550 --> 42:19.550]  They're not being updated.
[42:20.090 --> 42:20.110]  Yeah.
[42:20.170 --> 42:22.810]  The operating systems are now getting so old and so many different versions.
[42:22.810 --> 42:26.370]  So it's like, you know, is there a repository for these things?
[42:26.490 --> 42:30.830]  We know, you know, is there a collection of, you know, known bad malware that's been reversed out there yet?
[42:30.950 --> 42:33.210]  Like is there...where does one go to start?
[42:33.470 --> 42:33.910]  Yeah.
[42:34.190 --> 42:35.550]  Just checking your own stuff.
[42:35.790 --> 42:36.430]  Good question.
[42:37.690 --> 42:47.230]  I mean, as far as collections of malware that are out there, there's a couple of...there's a couple of forensics blogs that list a lot of the malware.
[42:48.930 --> 42:58.510]  And, you know, I think that places like McAfee and Lookout definitely have these sorts of databases of all the Android malware because they're in a very good position to get that sort of thing.
[42:59.350 --> 43:02.170]  Whether they'll release that to you is pretty unlikely.
[43:03.250 --> 43:07.690]  But as far as a central repository of those, I don't think there...there's nothing like that that I've seen.
[43:08.170 --> 43:09.530]  But it'd be great if there was one.
[43:10.190 --> 43:15.050]  And then, you know, you had a second part to that question, but I think I forgot what it was.
[43:16.010 --> 43:17.110]  You kind of got the second part.
[43:17.230 --> 43:19.510]  It's just like, you know, are there any tools for...
[43:19.550 --> 43:20.230]  Oh, right, right.
[43:20.490 --> 43:29.030]  So, I think...I mean, I think just here this weekend, we've seen the first tool for that, which is the Android penetration testing software.
[43:29.410 --> 43:35.650]  And that seems like a good way to go about auditing your phone in a more automated fashion right now.
[43:35.770 --> 43:37.390]  And that's supposed to come in Black Hat, so...
[43:37.390 --> 43:37.690]  Yeah.
[43:37.910 --> 43:38.150]  Yeah.
[43:38.250 --> 43:39.430]  And she'll be releasing that in Black Hat.
[43:39.570 --> 43:41.710]  And I don't remember what the name of it is, but...
[43:41.710 --> 43:42.310]  It's there.
[43:42.410 --> 43:42.570]  Cool.
[43:42.570 --> 43:42.890]  Yeah.
[43:44.110 --> 43:45.890]  She hasn't gotten a cool name for it yet.
[43:45.950 --> 43:46.390]  Oh, okay.
[43:46.530 --> 43:47.610]  That's why I can't remember it.
[43:48.310 --> 43:48.330]  Her names.
[43:48.330 --> 43:50.230]  The name is the hardest part in computer science.
[43:50.390 --> 43:50.510]  Sorry.
[43:50.610 --> 43:51.050]  Sorry, Micah.
[43:51.210 --> 43:51.590]  That's all right.
[43:52.610 --> 43:55.790]  Naming and cache invalidation are the two hardest problems in computer science.
[43:55.790 --> 43:57.690]  And off by one errors.
[43:57.870 --> 43:58.090]  Yeah.
[43:58.470 --> 43:58.530]  Yeah.
[43:58.970 --> 43:59.190]  Yeah.
[43:59.190 --> 43:59.650]  Those are the worst.
[44:01.330 --> 44:02.650]  That's the other part of that joke.
[44:02.650 --> 44:03.330]  I remember now.
[44:05.230 --> 44:13.010]  So, if I root my phone and install Cyanogen, I think I have to install like clockwork mod or some recovery mod, right?
[44:13.530 --> 44:13.690]  Yes.
[44:13.690 --> 44:13.790]  Correct.
[44:13.790 --> 44:20.570]  So, I can turn off USB debugging, but anyone can boot into recovery mod and turn USB debugging on.
[44:20.770 --> 44:23.510]  So, do you have any good way of keeping it off permanently?
[44:23.830 --> 44:26.570]  Can I remove the debugging mod or...?
[44:26.570 --> 44:27.590]  I don't.
[44:27.850 --> 44:29.010]  And I've...
[44:29.010 --> 44:29.770]  I've...
[44:29.770 --> 44:34.310]  This has been like a... actually a cause of major stress for the past week.
[44:34.830 --> 44:37.930]  Because I realized that if you...
[44:37.930 --> 44:38.190]  Okay.
[44:38.310 --> 44:38.610]  10 minutes.
[44:38.750 --> 44:38.950]  Thank you.
[44:39.210 --> 44:40.250]  Or was that a rating?
[44:40.430 --> 44:40.590]  No.
[44:40.750 --> 44:40.870]  Okay.
[44:40.950 --> 44:41.950]  I'm stealing Jason's...
[44:41.950 --> 44:44.350]  I'm stealing Jason Scott's jokes now.
[44:44.990 --> 44:45.110]  Okay.
[44:45.990 --> 44:46.250]  Um...
[44:47.130 --> 44:47.650]  Yeah.
[44:49.030 --> 44:50.310]  I'm just archiving them.
[44:50.390 --> 44:50.690]  It's okay.
[44:52.330 --> 44:52.850]  Um...
[44:52.850 --> 44:54.770]  So, recovery mod.
[44:55.210 --> 44:55.730]  No.
[44:55.730 --> 44:56.470]  And it's...
[44:56.470 --> 45:05.450]  And so, for about a week, I've been looking into this and trying to find a solution to this problem of being able to boot in a recovery mod, because it's a huge gaping hole.
[45:05.650 --> 45:07.230]  You just gotta press the right buttons and you're...
[45:07.230 --> 45:07.390]  Yeah.
[45:07.570 --> 45:07.870]  Exactly.
[45:08.210 --> 45:10.070]  And I mean, it takes two minutes of Googling.
[45:10.350 --> 45:15.210]  I mean, and really the solution is to encrypt as much of your phone as possible, which is why even...
[45:15.210 --> 45:19.270]  You could build a recovery mod that has USB debugging feature removed.
[45:19.630 --> 45:20.030]  Yeah.
[45:20.730 --> 45:20.890]  Yeah.
[45:21.050 --> 45:21.730]  You could do that.
[45:21.870 --> 45:24.350]  Or, you know, a recovery mod that was password protected.
[45:24.690 --> 45:24.830]  Yeah.
[45:24.830 --> 45:24.910]  Yeah.
[45:24.990 --> 45:26.690]  That'd be a really great project.
[45:26.870 --> 45:29.630]  And if somebody wants to write that, I would be happy to cheer you on.
[45:31.010 --> 45:36.510]  But don't you mean, it was going to debug and actually do everything okay,
[45:40.030 --> 45:40.590]  because it's not...
[45:40.590 --> 45:41.050]  Yeah, yeah.
[45:41.490 --> 45:41.890]  It's...
[45:43.230 --> 45:43.630]  It's...
[45:43.630 --> 45:44.330]  Well, you would...
[45:44.330 --> 45:46.090]  You could remove it just in...
[45:46.090 --> 45:46.170]  Yeah.
[45:46.450 --> 45:47.030]  In the...
[45:47.030 --> 45:49.170]  Ideally, you could remove it just in the bootloader.
[45:49.170 --> 45:56.090]  The question was, you need USB debugging to do cool things like root your phone and write app...
[45:56.090 --> 45:57.630]  Develop Android applications and stuff.
[45:57.870 --> 46:02.230]  And yeah, I mean, if you removed it entirely, then yeah, you wouldn't be able to do that.
[46:02.330 --> 46:06.050]  So I think the goal would be just to remove it from the bootloader and not remove it entirely.
[46:06.050 --> 46:07.110]  If they don't block the bootloader...
[46:07.830 --> 46:08.330]  What's that?
[46:08.490 --> 46:10.430]  If they don't block the bootloader on you...
[46:10.430 --> 46:10.910]  Yeah, yeah.
[46:11.090 --> 46:11.750]  Well, in...
[46:11.750 --> 46:11.930]  Yeah.
[46:12.190 --> 46:12.770]  I don't know.
[46:13.990 --> 46:15.110]  I really don't...
[46:15.110 --> 46:15.190]  Yeah.
[46:15.530 --> 46:20.630]  I mean, encryption is really the only solution I have to the problem of being able to boot into recovery mode.
[46:25.330 --> 46:25.770]  Uh...
[46:26.350 --> 46:26.790]  Wait.
[46:27.210 --> 46:27.650]  Uh...
[46:27.650 --> 46:27.790]  No.
[46:28.110 --> 46:28.310]  No.
[46:28.490 --> 46:31.450]  Can you...
[46:31.450 --> 46:32.250]  Oh, wait.
[46:32.430 --> 46:32.510]  No.
[46:32.690 --> 46:32.810]  Wait.
[46:32.990 --> 46:34.470]  After the phone is rooted?
[46:34.650 --> 46:34.990]  Yes.
[46:36.070 --> 46:36.510]  Yes.
[46:36.710 --> 46:38.870]  You can remove root and go back to stock firmware.
[46:39.190 --> 46:39.710]  Oh, yeah.
[46:39.890 --> 46:40.110]  Yeah.
[46:41.370 --> 46:41.810]  Uh...
[46:41.810 --> 46:43.110]  Well, I don't know.
[46:43.230 --> 46:46.590]  I think the stock recovery mod still allows you USB debugging.
[46:46.730 --> 46:47.050]  Does it not?
[46:47.210 --> 46:47.390]  Yeah.
[46:47.910 --> 46:48.350]  Yeah.
[46:49.450 --> 46:50.010]  So, yeah.
[46:50.010 --> 46:51.070]  So, it's...
[46:51.070 --> 46:54.170]  I mean, putting the stock recovery mod on there doesn't help the situation at all.
[46:54.610 --> 47:02.890]  The whole point is that recovery mode is a huge gaping f*cking security hole in physical access and somebody really needs to fix that.
[47:03.310 --> 47:05.610]  And that's unfortunately not gonna be me.
[47:06.270 --> 47:11.910]  I think you could also do a hardened SU binary or remove that.
[47:12.150 --> 47:17.270]  And Cyanogen's been talking about, you know, enabling it just for certain things or turning that off.
[47:17.470 --> 47:20.230]  Because it's that lethal combination of ADB plus.
[47:20.470 --> 47:20.910]  Right.
[47:21.110 --> 47:21.270]  Sue.
[47:21.710 --> 47:21.810]  Yeah.
[47:22.870 --> 47:23.430]  Um...
[47:23.430 --> 47:29.550]  Anyway, I just wanted to pitch the open secure standard source telephony network talk tomorrow at five.
[47:29.890 --> 47:34.770]  The really cool thing about Austin is it's all about you running your own instances of the server.
[47:34.930 --> 47:36.130]  So, your own telephone box.
[47:36.430 --> 47:36.650]  Yeah.
[47:36.650 --> 47:41.670]  So, we have like a 12 step script to run your own instance of free switch ready to go.
[47:42.010 --> 47:45.270]  So, we don't even want you to use our, the austell.me site.
[47:45.550 --> 47:46.290]  Like make...
[47:46.290 --> 47:49.350]  We want a hundred secure switches to bloom.
[47:49.630 --> 47:52.070]  So, please come tomorrow at five to learn how to do that.
[47:52.450 --> 47:53.390]  Thanks for coming, man.
[47:54.110 --> 47:55.850]  Thank you for doing this talk.
[47:56.010 --> 47:56.170]  It was great.
[47:56.370 --> 47:58.590]  Thanks for doing it so we could sit in the back and drink beer.
[47:58.750 --> 47:58.870]  Yeah.
[48:00.490 --> 48:01.370]  Any other questions?
[48:01.890 --> 48:02.850]  Oh, one more.
[48:03.190 --> 48:03.270]  Yeah.
[48:04.250 --> 48:05.510]  How much time do I have left?
[48:06.030 --> 48:06.170]  Time guy?
[48:06.870 --> 48:07.650]  Sorry, I don't know your name.
[48:08.050 --> 48:08.210]  Five.
[48:08.410 --> 48:08.530]  Okay.
[48:09.550 --> 48:20.890]  So, in your experience, besides carrier IQ, which is probably on a lot of phones, are there any other, anything from Google that is tracking your location, text calls, anything like that?
[48:20.890 --> 48:21.790]  I mean, all of it.
[48:22.570 --> 48:25.990]  I mean, you opt in on your phone to be tracked by Google.
[48:26.350 --> 48:29.470]  Now, is that when you log in with your Gmail account?
[48:29.630 --> 48:30.910]  Like, oh, I want my Gmail logged in.
[48:30.910 --> 48:31.290]  Yes, yes.
[48:31.290 --> 48:32.030]  If you don't provide Gmail.
[48:32.030 --> 48:33.190]  If you don't have...
[48:33.190 --> 48:34.190]  If you never do it.
[48:34.310 --> 48:34.510]  Yeah.
[48:35.230 --> 48:36.850]  I wasn't looking for the file.
[48:37.170 --> 48:37.710]  Yeah.
[48:37.990 --> 48:39.350]  If you don't install...
[48:39.350 --> 48:46.110]  Like, if you install Cyanogen and don't install Google Apps, the phone is not phoning home to Google.
[48:47.030 --> 48:47.570]  Good.
[48:48.150 --> 48:50.310]  So, you can remove Google from your Google phone.
[48:51.250 --> 48:52.570]  And I encourage that.
[48:53.730 --> 48:55.070]  I don't do it myself.
[48:55.350 --> 48:56.830]  But I encourage you to do it.
[48:58.850 --> 49:04.510]  So, my question is about any security whole implications of the system update process.
[49:04.710 --> 49:06.730]  And in particular, let's say you get some phone.
[49:07.030 --> 49:07.210]  Yeah.
[49:07.210 --> 49:13.750]  How do you know if you're getting an update from the carrier, from the manufacturer of the phone, or directly from Google in the case of Google Experience phone?
[49:13.750 --> 49:14.230]  Right.
[49:15.430 --> 49:16.310]  I mean...
[49:17.770 --> 49:20.230]  I can't tell you whether those packages are signed or not.
[49:20.530 --> 49:22.890]  So, I don't know if...
[49:23.710 --> 49:24.590]  I mean...
[49:24.590 --> 49:25.210]  Yeah.
[49:25.350 --> 49:26.370]  I don't know that you can.
[49:27.990 --> 49:29.790]  I mean, like, often times...
[49:29.790 --> 49:36.690]  I mean, like, I think that there's been cases where, like, Microsoft Patch Tuesday has been compromised with, like, weird patches.
[49:36.950 --> 49:37.610]  And I think...
[49:37.610 --> 49:39.910]  I'm sure that the same thing could happen with over-the-air updates.
[49:41.390 --> 49:44.750]  I mean, if you had a 3G tower, I bet you could do it pretty easily.
[49:46.090 --> 49:47.070]  Or a 3G backpack.
[49:47.310 --> 49:48.310]  Yeah, or a 3G backpack.
[49:48.310 --> 49:48.830]  If you had...
[49:48.830 --> 49:52.470]  That was actually done at Defcon either last year or a couple years ago.
[49:52.490 --> 49:52.790]  Yeah, yeah.
[49:52.790 --> 49:53.230]  Yeah.
[49:54.030 --> 49:57.550]  Intercepted a large number of 3G connections and actually sent out system updates.
[49:58.290 --> 49:58.830]  And there's...
[49:58.830 --> 49:59.450]  That did happen.
[49:59.470 --> 49:59.670]  Yeah.
[49:59.910 --> 50:00.990]  It's definitely...
[50:00.990 --> 50:03.890]  There have definitely been malware OTA updates.
[50:04.750 --> 50:11.070]  But as far as detecting whether those are malware before you install them, wait till you get home from the HackerCon to do it.
[50:13.670 --> 50:14.470]  Yeah, I don't know.
[50:14.870 --> 50:19.190]  So, can you remove the, like, DigiNotar certificates that are on the Android phone?
[50:19.770 --> 50:20.090]  The...
[50:20.090 --> 50:22.130]  Because I found, like, on mine, I can't, like, get rid of them.
[50:22.270 --> 50:23.630]  So, I'm trying to figure out how to do that.
[50:23.730 --> 50:24.190]  So, the...
[50:24.190 --> 50:25.030]  What kind of certificates?
[50:25.250 --> 50:27.730]  So, the DigiNotar, they got compromised a few years ago.
[50:27.830 --> 50:28.750]  They were using, like, serial...
[50:28.750 --> 50:30.030]  Oh, this is an SSL certificate?
[50:30.270 --> 50:30.490]  Yeah.
[50:31.830 --> 50:32.090]  Pardon me.
[50:32.150 --> 50:33.690]  Yes, you can, with CA Cert Manager.
[50:34.130 --> 50:36.530]  This allows you to...
[50:37.250 --> 50:39.130]  Did you try doing it with CA Cert Manager?
[50:39.290 --> 50:41.210]  I think I did, but...
[50:41.650 --> 50:41.970]  Yeah.
[50:42.490 --> 50:45.890]  I mean, I think you have to have root to run CA Cert Manager.
[50:46.250 --> 50:51.570]  But, yeah, this lets you install and remove certificates at your will.
[50:53.330 --> 50:53.770]  So...
[50:53.770 --> 50:55.010]  Any other questions?
[50:56.070 --> 50:57.350]  Thank you all for coming out.
[50:57.570 --> 50:58.130]  Go to HackMe.