The DMZ

forest

03:12

> It pretty much replaces CHECK for government, and it is required for bigger/regulated companies

Is it like the CISSP of the UK?

@BryanRomero Hi

Cody Rutscher

07:39

I have a question regarding mobile security

forest

07:56

@CodyRutscher Shoot.

Cody Rutscher

how would someone gain remote access to my phone with my phone number?

forest

08:46

@CodyRutscher It'd be very, very difficult to do.

Cody Rutscher

there must be a way

forest

In fact, you'd likely need to exploit the baseband processor. Knowing the number would just make it easier to know which device to target.

Cody Rutscher

is there an easier way to do it

forest

Why, what's your goal? Are you trying to root someone's phone?

Cody Rutscher

no im trying to figure out how mine got rooted

forest

08:47

Ah. Well however it was, it wasn't because someone knew your phone number.

It'd be the result of visiting a malicious web page or installing a malicious app.

Cody Rutscher

well they did it not over LAN

and no social engineering was involved

i didnt click anything

forest

Why do you think your phone is rooted?

Cody Rutscher

and i know all they had was my number

forest

@CodyRutscher If you didn't give anyone access to the phone, and if your phone isn't woefully out of date, the chances are that no one rooted your phone.

Cody Rutscher

i know it was rooted because they told me what my searches were

over text

as i was searching them

forest

08:51

What exactly did they say?

Cody Rutscher

whatever i searched

forest

They repeated what you searched verbatim?

Cody Rutscher

doesnt matter the point is they had full access

yes

no they hooked me for sure

but it wasnt a beef hook

forest

Does this happen using Google or another encrypted search engine?

Cody Rutscher

it was chrome

forest

08:53

If you have a Google account and are using google.com for searches, try resetting your password. It's possible that they guessed your Google account password and got access to search history that way.

Cody Rutscher

there must be another way

i guarantee it can be done with just the phone number

forest

It can't, not on its own. A phone number would let someone know who to target, but they would need to be in physical proximity and use an IMSI catcher and exploit the baseband (the wireless chip). Doing that takes significant expertise. Anyone with such a capability would not reveal that fact by telling you what you are searching.

Cody Rutscher

my friends are smart

very smart

im telling you it can be done another way besides hacking google account and brute forcing password

forest

Being smart is not enough. It takes the kind of expertise that would allow them to sell the exploit for quite literally hundreds of thousands of dollars.

Cody Rutscher

theres gotta be another way

forest

08:57

Is this person in physical proximity to you? Like near your WiFi?

Cody Rutscher

no

person is in a different state

and all they have is my phone number, email address, and maybe some other details

forest

And you're 100% sure that you never clicked on any malicious links that could have been sent by them or installed any applications that might be malicious?

Cody Rutscher

no

cause i know not to

forest

Then chances are, they got access to your Google account. You should reset your password and enable 2FA (Two Factor Authentication) for security.

Cody Rutscher

that wouldnt make sense cause i was still logging in with same password

forest

08:59

Do you have a screenshot of the kinds of things they said?

Cody Rutscher

no this happened months ago

i used to have more strong proof

forest

(I meant you should reset your password. They probably guessed it)

Cody Rutscher

i still havent gotten an answer

i changed all my passwords

forest

An answer to whether or not it's possible to attack a phone via number?

Cody Rutscher

yea like in general ive been floating this around different chat rooms

forest

09:01

Some old exploits have used SMS or MMS to exploit a phone.

Is your device fully up to date (security updates)?

Cody Rutscher

yes it is

theres gotta be a way you can remotely connect to it like you would connect to a server in a different state

ip, ssh, ftp

802.11

forest

Only if you exploit the phone first, which is seriously difficult.

In which case you could connect through the internet.

Cody Rutscher

theres gotta be other identifiers

forest

What do you mean?

Cody Rutscher

like IMEI

idk

forest

09:04

IMEI and IMSI are just identifiers, similar to a phone number, but for the mobile networks to use. Abusing those requires you be in physical proximity.

Usually on the same street, or a few miles if you have a really powerful transmitter.

Cody Rutscher

hmm

i will keep thinking

forest

With an IMSI catcher, you can listen on calls and the like because you would be impersonating a cell tower and tricking the phone into connecting to the catcher.

Cody Rutscher

i get that but you have to be in proximity for that

forest

Correct. Otherwise, the only identifier is the phone number.

You can send SMS or make phone calls with the number.

Cody Rutscher

you can code something with c or c++

?

forest

09:06

What do you mean?

Cody Rutscher

to gain access?

are protocols not implemented in those languages?

forest

From only a phone number?

Cody Rutscher

yea

forest

Well here's how an exploit would work, in theory. When you send an SMS, the data is relayed between cell towers to the person you sent to, and stored on their phone. Their phone does a little processing of the SMS data. If the code that does the processing has a bug, then specially crafted SMS data might trigger a security vulnerability and take over the phone.

The problem is that finding such a vulnerability is very hard and unlikely.

Cody Rutscher

so it would require social engineering to some extent

forest

09:08

It would be easier if you have an older or out of date phone, since then a hacker could just use an old vulnerability against you. But creating a new one is very hard.

Well not necessarily. A malicious SMS could be sent and even be hidden.

But the real reason it's not a likely exploitation vector is how hard it is.

Cody Rutscher

hmm

forest

Hard like: it would be easier to sneak into your house and steal your phone.

Cody Rutscher

damn

forest

Could it be that they're tricking you into thinking they know what you're searching by sending you vague hints? Aka cold reading?

Cody Rutscher

no

ill keep looking around

forest

09:13

Is this still happening, or did it end months ago as you mentioned?

If it's still happening, you should take screenshots.

Chances are, it's really nothing.

I talked to one person who was worried that the same thing was happening. He was talking to someone and they said "XD" (the emoticon face), and they were sure that the "X" was somehow hinting that they knew he was looking at porn (because "XXX").

Not saying that's the case for you, but it's something I see a lot.

Cody Rutscher

no i know they hooked me

im not using my phone much now and dont care really

but id like to know how it was done

not to do it but just for peace of mind

forest

hm

Just to make sure, you reset your passwords for your online accounts and kept the software on your phone up to date, but whoever this is (in another state) keeps sending you messages telling you exactly what you just searched seconds ago?

Cody Rutscher

no no

this happened a while ago

they may still have access

im over it but i just want to figure out how it was done

forest

But that was the case back when it happened?

Cody Rutscher

yea

forest

09:21

Yeah then it's either 1) cold reading, 2) you installed a bad app or extension, or 3) your Google account was hacked. Really couldn't be anything else.

No clue which of those it would be though.

Cody Rutscher

they had google searches going back months

Journeyman Geek

@CodyRutscher without actually knowing what they did.... its impossible to know what they did

Cody Rutscher

yea im speculating

Journeyman Geek

do you have TFA of some sort and/or a password manager?

its entirely plausible they just picked up a password off a leaked account somewhere and tried it

forest

Did they threaten you or anything? Or were they silent, sending nothing except the contents of your searches (no "I hacked you, here's proof" or anything)?

Journeyman Geek

09:26

TFA makes it a little harder, and a password manager helps reduces the value of a 'stolen' password since its unique

forest

(TFA/2FA is Two Factor Authentication, which I mentioned before)

Journeyman Geek

I currently use my phone (boo!) though I'm picking up a U2F/fido key...

granted the latter is also so I can unlock my own systems without a password for maximum laziness

forest

I just don't use a phone. :D

Journeyman Geek

@forest makes creating new accounts 'fun'. And ya, fewer options for TFA

the problem with a phone is you're paring things that need TFA with the thing that generates the autentication....

Cody Rutscher

it was my friend that did it

so no threatening

forest

09:41

If it was a friend, why not just... ask them?

Cody Rutscher

he enjoys knowing he knows how to do it and not me

lol

obviously i asked him

he just tells me hes 100% sure he uses at&t

forest

What does that mean?

Cody Rutscher

hes fucking with me

Rory Alsop

@forest hahahahaha - nope.

forest

@CodyRutscher The specific wireless company you use wouldn't matter.

Cody Rutscher

09:43

i know

its a joke

hes being vauge

vague

forest

Honestly the easiest solution to this is the interpersonal solution. Sit down with him and tell him that you really need to know if your password was leaked, and that you don't find it amusing. That can go a long way and is usually far easier than trying to perform amateur computer forensics for an incident from months ago.

And of course, there's Interpersonal Skills to help with that. :P

Rory Alsop

@CodyRutscher - I'm going to have to support @forest here. The symptoms you describe just don't come from the route you describe. So tyour friend is messing with you. Misdirection is what's going on.

forest

Mhm, and if they do know exactly what you were searching, it's likely because you used a bad password for your Google account and they got access to search history.

Occam's razor is a thing in infosec too. :P

Rory Alsop

At nation state level, sure there are things you can do with just a phone number - it's still not that easy, but the service providers provide the wiretap etc. If you have a read up on the NSA's leaked toolkit there are some fun toys in there.

But it won't be them

Cody Rutscher

hes a good friend hes not going to leak anything

ive changed all passwords

hes just personally fucking with me like a brother

no sit down needed

forest

09:47

Well the problem is that if he could do it, someone else might be able to as well. If your passwords were bad back then, then a spammer might have just as easily gotten in. So even if you trust him, it's vital to know what weaknesses he exploited, if any.

Cody Rutscher

they werent

it was a very specific password

ill tell you now how long exactly it would take to brute force

forest

Still possible to steal the password, e.g. using phishing attacks (IDN homograph attacks make it possible in some browsers to do phishing undetected).

Cody Rutscher

hes an extremely smart kid his dad is a brain surgeon that is one of 5 ppl that can do this one brain surgery

forest

Brains and computers work in very different ways. :P

Cody Rutscher

its would take 34 thousand years to do it

without rootkit or keylogger

neuroimaging

is all on computer

idk a brain surgeon thats not some form of root computer user

not saying hes a dennis ritchie

Rory Alsop

09:49

@CodyRutscher remember, brute forcing time estimates are literally estimates. It is possible (though improbable) that it is guessed on the 1st try

Cody Rutscher

cmon

lets be realistic it would be more probable that he did it with the phone number

that is by far the most probable way givin all of the criteria

forest

I'd say it's less probable. It's more likely to be phishing than a phone number.

Rory Alsop

but yeah - I have had social engineers able to guess passwords with high accuracy after simply looking at a personnel folder and someone's social media

Cody Rutscher

no SE no click bait long password

Rory Alsop

@forest yes. I was just being a bit devil's advocate-y

Cody Rutscher

09:51

it could be he knows my number and does some type of phishing call or text

then gets info that way

forest

I mean, one person I know sold a Chrome exploit that he created for $300,000 USD, but I strongly doubt he could hack a phone just by knowing the phone number.

Cody Rutscher

can you float it around with other hacker friends

Rory Alsop

@CodyRutscher at the end of the day, if he won't tell you then normal best practice is still appropriate: change passwords after suspected compromise, use long ones (or random ones) plus 2fa. No password reuse.

Cody Rutscher

ive changed everything

my passwords are extremely complicated

forest

I assumed it stopped after you changed it all?

Cody Rutscher

09:52

idk cause i havent asked

hes not going to tell me

Rory Alsop

@CodyRutscher that doesn't really matter if the route in is phishing/social eng etc

Cody Rutscher

try asking around

forest

But I mean he hasn't sent you your searches after you changed passwords.

Cody Rutscher

ill pay for answer

Rory Alsop

long password prevents brute force, that's all

2fa prevents remote attack

single use passwords prevent compromise of one service leading to others

forest

09:53

There's no way to get a definitive answer without having physical access to your phone and possibly even records from the phone company. All anyone can do is think up possible attack vectors (the most likely of which is account compromise).

Rory Alsop

and changing them - well, that prevents them being used again

forest

10:20

> This site is certified GIF-free. All images on this site are either JPG or PNG. Unisys are trying to charge all webmasters $5000 for the use of GIF images, which are copyrighted.

I love old websites.

Journeyman Geek

0_0

forest

10:44

@JourneymanGeek It's from rickdangerous.co.uk/main.htm

Nice old site that's been unmaintained since '05.

Journeyman Geek

ah

forest

About 50% linkrot.

But man do I love Rick Dangerous.

github.com/fabiensanglard/xrick/blob/master/src/data.c#L118

Well I can't say the programming is anything but horrible...

Rory Alsop

11:28

I was trying to find any archive of my old geocities and angelfire sites, but couldn't find anything :-/

forest

12:56

:(

boingboing.net/2018/12/05/last-laugh-on-zuck.html

> The documents are incredibly damning. They show Facebookers at the highest level -- up to CEO Mark Zuckerberg and COO Sheryl Sandberg -- conspiring to trick Android users about how much data was being gathered by an update to the Facebook app; to give certain companies "whitelisted" access to user data beyond the access the company had disclosed to its users

> to explicitly productize "friends" data (that is, to allow the trick Cambridge Analytica pulled, when getting a user to grant permission to their own data also allowed a company to access their friends' data); to use the Onavo battery-monitor app to covertly gather data on which other apps users had installed; and anti-competitive targeting of partners' apps.

Holy fuck.

> Facebook knew that the changes to its policies on the Android mobile phone system, which enabled the Facebook app to collect a record of calls and texts sent by the user would be controversial. To mitigate any bad PR, Facebook planned to make it as hard of possible for users to know that this was one of the underlying features of the upgrade of their app.

Xavier59

13:37

Hey, I'm stucking at finding some possible vuln.
So far, I've found an interesting vector but it doesnt seems exploitable.
The back is javascript (prob nodejs). Some test I've been conducting :
search?q[]={hello:1} => results for search '["{hello:1}"]'
search?q[a]={hello:1} => results for search '[object Object]'
search?q[toString]={hello:1} => 500 Internal Server Error

Rewriting the toString function doesn't seem possible as it would be interpreted as a string anyway and not as a function. I'm quiete out of idea here.

Mike Ounsworth

21:40

Question: I've just run into the situation where a post I made (citing publicly-available information, and drawing my own conclusion) differs from the marketing material of my company.
My gut is to re-read the relevant RFC's and edit my post to correct any factual errors, but not necessarily bring it into line with marketing's stance. "Views expressed are my own, blah blah".
Advice / opinions?

Transcript for