90
NSA Warns iPhone And Android Users To Turn It Off And On Again (www.forbes.com)
submitted 5 months ago by Renn@sh.itjust.works to c/cybersecurity@sh.itjust.works
42 comments fedilink hide all child comments
top 42 comments
sorted by: hot top controversial new old
[-] jet@hackertalks.com 49 points 5 months ago

It's actually good advice to periodically restart your secure devices. There are many exploits that can only persist in memory and not on the actual storage device itself. So by restarting you go back into a known good state. And any malicious actor would have to reinfect your phone, which may not be guaranteed

[-] acetanilide@lemmy.world 7 points 5 months ago

This is fascinating to me because I was taught not to restart your computer if you suspected malware because restarting it would basically activate it

[-] RGB3x3@lemmy.world 6 points 5 months ago

You can't activate malware by restarting your system. There's no reason why an attacker would wait for a restart to do what they want to do.

What can happen is that restarting doesn't help fix anything related to malware if the malware has been written to gain persistence. It'll edit the registry so that it can run on startup, so restarting your system makes no difference.

[-] yildolw@lemmy.world 8 points 5 months ago

They might be thinking of malware spread on floppy disk or a usb stick. A restarting computer with sus media inserted might have treated them as a boot device back in the day and run the executable code with higher privileges

[-] CameronDev@programming.dev 4 points 5 months ago

It would entirely depend on the design of the malware. If a malware author wanted to chronologically separate infection from detection, doing persistance and then not activating until next reboot wouldnt be unreasonable.

For example, if a user visits a site, and 10 seconds later their PC gets cryptolockered, they can report the site. If they visit a site, and then a hundred others, and then 10 days later their PC reboots and gets cryptolockered, they will have no idea which site did it.

[-] CameronDev@programming.dev 4 points 5 months ago

Only exploits that require human intervention would be defeated by this though. If you have a zero touch exploit that can privesc, the persistance doesnt need to be anything special, you can just wrap your exploit in an ordinary android app and request it be woken up on next boot.

[-] jet@hackertalks.com 4 points 5 months ago

Not necessarily true. It could be a buffer overflow in text message processing, it's still requires a text message to be sent to the phone.

It could be a Wi-Fi or Bluetooth exploit, which requires locality.

It could be a browser, webview, certificate exploit that requires a sophisticated chain of events with a low probability to intercept a web page and get the user to do something that isn't guaranteed.

The exploit might display itself to a user on the phone, so every time it's applied there's a risk of discovery.

Not to mention many advanced persistent threats do not want their exploits to be analyzed, so they will not leave them sitting around to be collected, just waiting for the device to need a reinfection. That's valuable signals capability that you give to your adversary they just need to analyze it.

[-] CameronDev@programming.dev 3 points 5 months ago

Those all are things that require external human intervention though?

If the malware is persistent, then one way or another it needs to leave an exploit on the device, it can either be a persistance exploit, or a privesc exploit.

[-] jet@hackertalks.com 3 points 5 months ago

Right so the issue here is we are saying for the class of malware that is not persistent restarting the device will take it out of memory. Which is a strict positive

[-] CameronDev@programming.dev 2 points 5 months ago

Yup. Although i'm not sure there are many (any?) malwares that don't have some form of persistence. Exploits requiring human intervention are usually just the first stage, and persistance is the second.

I dont know of any APTs that are purely memory only, but if you know of one please link so I can read up on it.

[-] jet@hackertalks.com 2 points 5 months ago
[-] PipedLinkBot@feddit.rocks 1 points 5 months ago

Here is an alternative Piped link(s):

https://www.piped.video/watch?v=1f6YyH62jFE

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source; check me out at GitHub.

[-] taladar@sh.itjust.works 3 points 5 months ago

It is also a good idea for computing devices in general since not restarting means effectively restarting and finding out that the restart didn't work properly or that you do not have all the information needed to log back in at the worst possible time, one you didn't choose yourself. And if you do it often enough the number of updates/changes that could be the cause is significantly lower than if you keep things running for a long time before a restart.

[-] Emotet@slrpnk.net 3 points 5 months ago

Just be mindful when restarting automatically, as some OS offer. It's neat not having to remember to manually restart every few days, but your pending notifications will get lost and, depending on your setup, your cellular/network connections will not automatically reconnect until you login.

[-] Socsa@sh.itjust.works 3 points 5 months ago

It also guarantees you will cycle keys out of memory, which is always a good idea when crossing borders and whatnot.

[-] givesomefucks@lemmy.world 33 points 5 months ago

While true and they have a point...

With having to do a restart after installing major programs the headline sounded like it's from a satire site for an article about NSA snooping.

Like, they just did an update and now we all need to reboot lol

[-] Hobbes_Dent@lemmy.world 18 points 5 months ago

I completely thought it was an Onion headline.

[-] Socsa@sh.itjust.works 3 points 5 months ago

I mean this has been a cybersecurity best practice forever. If anything, it's someone at the NSA having a chuckle knowing how the cynics will react to something which is barely a step above common sense.

[-] qprimed@lemmy.ml 11 points 5 months ago

"have you tried swtching it off and on again" solves 90% of support requests - at least for a little while ;-)

[-] EmperorHenry@infosec.pub 5 points 5 months ago

well clearly there must be someone at that evil organization with a soul then

[-] jet@hackertalks.com 21 points 5 months ago* (last edited 5 months ago)

They are very competent.

National security agency. They understand security.

The problem is usually around incentives... What is good for the national security may not be good for the individual and vise versa.

When the incentives line up, they are the good guys.

So when they talk about defending American infrastructure against state actors in the context of Russia or China, the advice is good.

When they talk about why people don't need end to end encryption or why public cryptography is a national threat... The advice is bad.

[-] Anticorp@lemmy.world 8 points 5 months ago

That or their root kit requires a manual reboot to start working.

[-] EmperorHenry@infosec.pub 4 points 5 months ago

they don't even need to put shit directly on our devices to get what they want really, they have a wiretap into all the advertising companies and all the internet providers and all the cellphone and land line providers. They have a wiretap into every remotely accessible camera system. They don't need to come up with more invasive ways to get into all our shit but they keep doing it.

[-] Anticorp@lemmy.world 3 points 5 months ago

It's so blatantly unconstitutional, and yet they keep renewing the programs. We're never getting our constitutional right to privacy back without extreme measures.

[-] EmperorHenry@infosec.pub 2 points 4 months ago

It’s so blatantly unconstitutional,

Careful, someone called me a fascist for saying that about this issue.

[-] Anticorp@lemmy.world 1 points 4 months ago

That person doesn't know what they're talking about.

[-] EmperorHenry@infosec.pub 1 points 4 months ago

I was once called a "right winger" and a "trump supporter" over on reddit because I talked about how awesome self-governing local communities would be.

Who better to decide what happens in a town than the people who actually live there?

There's paid trolls and bots that muddy the waters about everything.

[-] Anticorp@lemmy.world 1 points 4 months ago

You've got to remember that these are just simple farmers. These are people of the land. The common clay of the new West. You know... morons.

[-] lurch@sh.itjust.works 1 points 5 months ago

wait, you guys don't switch it off during the night?

[-] VindictiveJudge@lemmy.world 16 points 5 months ago

It has my morning alarm, so, no.

[-] lurch@sh.itjust.works 2 points 5 months ago* (last edited 5 months ago)

wait, your phone doesn't switch on to ring alarms? i thought all smartphones do that. all androud phones i have do. they don't do a full boot, just sound an alarm and show options to fully start, snooze or end the alarm

// edit

I learned that some brands don't implement that feature. For example: Samsung does not, but Honor does.

[-] VindictiveJudge@lemmy.world 5 points 5 months ago

I have never heard of that feature. If I turn my phone off before going to bed, it's because I want it to not ring the alarm at the usual time. Telling it to turn off makes it do a complete shutdown. What you're describing would require some sort of hibernate mode.

[-] lurch@sh.itjust.works 2 points 5 months ago

it's not like hybernate on a PC. it's more like the circuits in the phone (probably the BIOS) still have the clock running when off and know the time when to boot into that special mode. my newer phone even has a checkbox "keep alarm active" on that shutdown screen where you confirm the shutdown.

this post was submitted on 31 May 2024
90 points (97.9% liked)

Cybersecurity

5601 readers
97 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !cybersecurity@lemmy.capebreton.social !securitynews@infosec.pub !netsec@links.hackliberty.org !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 1 year ago
MODERATORS
kid@sh.itjust.works
Lanky_Pomegranate530@midwest.social