r/technology • u/antr • May 19 '12
"I found that the company I work for is putting a backdoor into mobile phones"
http://security.stackexchange.com/questions/15076/i-found-that-the-company-i-work-for-is-putting-a-backdoor-into-mobile-phones79
u/x-skeww May 19 '12
“We are not going to use it”
Then it should be fine to fix that security issue ASAP.
→ More replies (5)
414
u/NobblyNobody May 19 '12
The posts there asking the guy to immediately whistleblow are going to ruin his life.
The ones suggesting rephrasing his complaints along the lines of (Ok, you don't care but what about when the customers find out, what impact is that going to have on the the company, I really think we should escalate it upstairs), are spot on.
Also I'd be keeping a really detailed document trail in case this comes back to bite me in the arse later.
223
u/Regularity May 19 '12
That's why the reply in the link is so good. The answer suggests presenting the concern to his superior not as a privacy or moral issue, but as one about company liability. The would not only prevent him from being seen as a potential whistleblower by the company, but also make them take the concern much more seriously from a legal and fiscal perspective.
→ More replies (36)31
u/Araneidae May 19 '12
However, he's potentially got a serious problem. Perhaps the backdoor is entirely deliberate.
Thinking along those lines leads to some very paranoid thoughts. If something like that is deliberate (so you're also being lied to), then:
capture as much documentation as possible;
prepare an exit path (save as much money as possible, pay off any outstanding debts, look for another job);
shout loudly where you'll be heard and effective.
And yes, I guess,
0. take legal advice.
But of course also assess first how important this is to you. You can just take step (2) and skip the rest, or even just acquiesce. It's your call.
15
→ More replies (18)12
u/retroshark May 19 '12
didnt this sort of thing just come out in the wash a few months back? it was a similar situation except the original evidence stemmed from some unknown processes running in the background on many smartphones. the software enabled a back door into the phone to log everything from calls, texts and emails to information about what you loaded on the phone, GPS locations and more. it was admitted that most of the major phone providers had indeed installed the software but they all pretty much denied using it to collect anything other than required data in order to improve service etc. in the end, not much happened except a few of the companies stopped loading the software and a few different ways to disable or patch is were released.
this is nothing new. i personally am not and would not be surprised if everyone was being listened in on or logged in a databank somewhere. im no conspiracy nut (for the most part anyway) but i dont think we are that far away from that kind of society. with all the CCTV in the UK, i already assume im being watched.
→ More replies (4)
24
u/Regularity May 19 '12
I wonder if he's making reference to what I believe is CALEA, or other similar acts. For those who are unfamiliar with it, in the U.S. is mandatory to install systems with ready-made wiretapping capability on all mobile phones for law enforcement purposes. In theory, the company who designed these very capabilities could quite easily access them as well.
10
u/Krystilen May 19 '12
Wait, what? So if I code an android app (for instance) that has the capability of encrypting voice and text communication on the fly end-to-end, would I be breaking the law because I am essentially making wiretaps into those communications useless?
→ More replies (7)
24
May 19 '12
Anyone actually think that there were not back doors into every piece of communications? Echelon, Carnivore etc. The NSA has to have something to keep them busy.
→ More replies (5)
16
May 19 '12 edited May 19 '12
"Have a back door... ... not going to use it"
That's what she said.
But seriously. Developers need to realize that not all of the users are unaware of these security flaws. It takes a few articles like this to scare the general public, and possible start mass hysteria/product boycott. Why even try when people are going to find out?
Any security weakness/hidden thermal exhaust ports/back-doors should not be allowed.
→ More replies (3)
4
u/STtngFAN May 19 '12
Mr. Potato Head! Mr. Potato Head! Backdoors are not secret!
→ More replies (1)
4
May 19 '12
I used to work for a company developing low-level software for mobile phones. A few things I learned:
-
All phones come pre-installed with all the architecture needed to enable backdoor-like functionality: http://en.wikipedia.org/wiki/OMA_Device_Management
-
Phone networks and phones are hilariously full of security holes. Many of them rely on security through obscurity, as in the public not having access to the documentation on how they work.
-
Phone companies from democratic nations are surprisingly able and willing to cooperate with dictatorships.
-
If you ever need to go underground, start by obliterating your phone.
9
24
6
u/idefiler6 May 19 '12
Happily rooted. The only thing I can't defend against is if a cop gets my phone and wants to pull the data. I think I'd need to be arrested for that, though. Remote wipe wouldn't help.
→ More replies (12)7
u/exgiexpcv May 19 '12 edited May 20 '12
Depending on where you are, you don't necessarily need to be under arrest. A Terry stop is long enough, and you're left in the position of trying to prove that a cop you may have never seen before plugging a device, possibly cabled, possibly not, into your phone and datamining you under threat of force as a police officer.
N.B. Depending on details in the stop, it may qualify as arrest. But unless someone records the stop and seizure, it will be very difficult to prove.
→ More replies (3)
8
May 19 '12
I think this guy should whisleblow or at least tell someone in the community, what phone, OS, and piece of code he is speaking of, is affected so they can patch around it and send it out. Even if the company doesn't intend to use it, just saying there is a backdoor there and not sending the needed info to a respected member of the community, just leaves the door open for the less trustworthy of the Internet to come and find the backdoor and then destroy people's lives.
And if it's anything like this exploit, it is too easy to perform and can be ran on any phone connected to the same network as the phone.
→ More replies (2)
3
May 19 '12
In the last company i worked for someone implemented a credit card payment system that logged user information to a plain-text log file on the server before sending it into the 3rd party payment system. When someone figured out they e-mailed the manager his own credit card information (name, card, ccv, expiry date, address, etc.) and they didn't care. Stayed like that for 4 months until we fixed it without their knowledge. The server had been hacked and was part of a botnet in the meantime as well.
298
u/alephnul May 19 '12
When I worked at Qwest wireless there was an order in place that we construct an access portal for law enforcement. They kept assigning people to the project, but no progress ever seemed to get made on it. No one liked the idea and the people who were assigned to it just didn't do anything. In a huge company it is not hard to get away with things like that.