Channels of communication on a smartphone

And the issues that they present.

Oct 06, 2023

This is an essay that I wrote in 2014, I’m not vouching for quality or accuracy here, it was a difficult time for me business wise and study wise (Computer & Information Science). But it looks ok.

The footnotes have not transferred that well. I’ll fix them later.

It’s likely some (or maybe a lot) of the links are broken.

The first difficulty is to define what a ‘Channel of Communication’ (CC) is on a smartphone. Some sources would have Facebook or Twitter as a CC but I have assumed that these are secondary to the actual CC (which in their case could be via an App or via a Web browser using the telephone network which itself is based on Radio). So for the purposes of this essay I have assumed the following as CCs;

Telephone Network (for phone and web), Infrared, Bluetooth, GPS, Wifi, USB and NFC and/or RFID. There is also a new Apple technology called iBeacon that is based on Bluetooth. With the exception of infrared and USB all these technologies are based on radio. One could probably also consider the SIM card or SD cards as CCs as they are capable of passing information on too.

I have not considered different connection modes as different CCs. For example 3G or 4G are not considered to be CCs nor are GSM and GPRS.

Telephone applications, SMS and MMS Messengers, Email, Apps, web-browsers, Skype, facebook or twitter etc all use one or more of these technologies to connect the user. I will therefore refer to these as a ‘Secondary Channel of Communication’ (SCC). There is some crossover in the SCCs. For example messaging can be via the internet as well as via the built in messaging apps (in fact the phone itself might decide which one to use depending on whether the phone is connected to the internet or not).

There are also various sensors in modern smartphones, these include Accelerometer, gyro, proximity and compass sensors.

These are basically the technologies that smartphones use to connect to other users or other devices, or are technologies that are designed to enhance the user experience but that can also be used to monitor usage. Consequently these are also the features of a smartphone that can, and frequently do, compromise a smartphone users privacy.

The first of the CCs, the Telephone Network, is the most used one and the only feature that is not optional on the part of smartphone makers. It is used by various applications on modern smartphones to make and receive telephone calls and to send and receive SMS/MMS messages. It is also used so as the smartphone can access the internet as well as to send and receive emails. Apps on the smartphone also make use of this feature for various reasons, such as to download information, connect to servers (i.e. email), connect to the internet, to send and receive information and to update databases. The smartphone also uses it to ‘ping’ for the closest connection point at a rate of about 10 times a second passing on a unique identifier in the process².

All of these features are a necessary part of the operation of the smartphone but they are also features that can be utilized by others to track and monitor the usage of any particular smartphone, and whether this is a State Agency or a private entity is of no importance to the smartphone user as the collection of such information is seldom in their interests. An example of the use of locational data available from and about smartphone users comes from companies such as Path Intelligence who claim on their website (www.pathintelligence.com , accessed 2/4/14) that their “proprietary technology detects and locates all mobile devices and analyzes how they move within a physical location, giving businesses access to unique, high-quality customer data at a granular level, that’s never before been possible.” This raises privacy issues but would also seem to be against the law in many jurisdictions. This should make us question exactly what sort of a society we are in the process of building because as Michael and Clarke note “Why should a service-provider have the right to do what a law enforcement agency cannot normally do?³”. Many of us who lived through a more private era look aghast at these changes, but at the same time we are likely to be the last generation that knows such a time.

A good outline of the type of information a Service Provider can collect on its users is available at Zeit Online which has made Green politician Malte Spitz’s use of his phone for 6 months (information which he accessed by suing Deutsche Telekom) available on its website in graphic form. (http://www.zeit.de/datenschutz/malte-spitz-data-retention , accessed 2/4/14)⁴ This information is not restricted to your phone companies though as an article in the Washington Times makes clear when it states that the NSA is gathering nearly 5 Billion worldwide locational mobile phone records a day⁵. And according to another report at the Washington Times the NSA also has the ability to decrypt conversations and messages on any mobile phone⁶. Both of these articles are based on information that has been released via Edward Snowden. In addition there are 3^rd Party organisations that collect date from smartphones by downloading data from the phones directly. One of these companies, operating mostly on Android phones since Apple stopped using it in IOS5, is Carrier IQ⁷. When their activities were published on the internet by Trevor Eckhart using publicly available materials from Carrier IQ’s website at the time it resulted in legal action being taken by the company in an attempt to suppress the exposure of the information by Eckhart⁸. Despite such exposure as this (and these files are not so easily found anymore⁹) it is undoubtedly the case that few smartphone users are aware of such monitoring activity on their smartphones and that even if they are aware of it, it is quite difficult to either monitor or restrict such smartphone activity.

In the days before iPhones, devices such as Palms (made by Palm Inc which has since been taken over by Hewlett Packard) had as one of their main features an infrared (IR) port. This was used to transfer data between phone and phone or phone and computer. It fell out of use after the introduction of the iPhone although a few Android phones have kept the feature over time. Recently though there has been somewhat of a resurgence on some new Android phones¹⁰. Nevertheless the current usage is not for file transfer, as there are better technologies available for that now, but rather to be able to control other devices from your smartphone, such as TV. (this is referred to as an IR Blaster). It is not immediately obvious if this channel can be currently used to transfer data to another device but if it was able to be used for that purpose the receiving device would have to be close by as IrDA has a limited range.

Bluetooth is a technology first released in the late 1990s. It grew out of the cooperation of people working on similar technologies at Ericsson, Nokia and Intel. Its development is now overseen by the Bluetooth Special Interest Group (SIG). Bluetooth is used extensively in the consumer market making it into various different devices from Computers to car radios to heart monitors and printers as well as smartphones. The current version (v.4) goes by the name of Bluetooth Smart or of Bluetooth LE (for low energy). It is the version used in most current smartphones with similar support amongst computer makers. It is easily cracked though. Mike Ryan has made a tool available (Crackle) that makes it a trivial matter to crack a bluetooth connection without the users knowledge¹¹. This possibly comes as no surprise to the Bluetooth SIG as they specifically referred to the weakness of Bluetooth encryption in their specification of the new standard¹².

GPS (Global Positioning System) is a technology developed by the United States Department of Defense who now manage it on behalf of the United States Government. It utilizes satellites so as to be able to locate a GPS user or receiver anywhere on Earth. It has military and civilian uses and although originally degraded for civilian use this is no longer the case. There are alternative systems in use, or in the process of being instituted, in Europe, Russia, India, Japan and China. GPS is useful for anyone wanting to use some sort of mapping application, and is consequently used in car navigation systems, airplane tracking, surveying, astronomy and nature walking amongst others. As a consequence partly of this ability it is also used in mobile phone technology, but this is not totally optional on the part of mobile phone companies as the US Government has mandated that such devices must be able to report their location to 911 Emergency services¹³.

Undoubtedly such a feature is particularly useful to such agencies. But once again it is perfectly able to be abused by other agencies or by individuals or companies as well. And in a 2012 decision in the case of United States v. Jones the majority found that this was the case, and that data obtained from GPS tracking of Jones was a trespass of his rights to privacy outlined under the Fourth Amendment. Nevertheless the Government was able to get around this decision by then applying to have the case heard allowing data retrieved from cell site location data to be presented, citing the Stored Communications Act in support. Eventually Jones was more or less forced to plea-bargain a sentence of 15 years with credit for time already served (in my view plea bargaining undermines the US Justice system but I wouldn’t argue that on the facts of this case). This though was a court case of an American citizen so he had some rights in regards to American Government monitoring of his activity, or at least he had to have the appearance of having those rights.

None of that requirement is the case for those of us who are not American citizens and as this technology is under US Department of Defense control one has to expect that where you have been, possibly for the last several years, is easily available to United States agencies such as the NSA who are as already stated collecting up to 5 billion of such records each day. It doesn’t take a rocket scientist to figure out the potential threats to freedom and democracy this constitutes. For example if you know that a politician spends every Tuesday and Wednesday at his/her girlfriends (or his/her boyfriends) despite maintaining the image of being happily married, then that gives you a bargaining position. There are also undoubtedly abilities to favour one commercial enterprise (let’s say a cleancut un-corruptible US one like Boeing or McDonnell Douglas) over another commercial enterprise (let’s say a corrupt European one like Airbus) with information you have gleaned from your monitoring¹⁴. GPS data is also stored in the metadata of photos taken with the current generation of smartphones and cameras, so the exposure of this information can be via shared photographs as well.

Wifi is reasonably unique in that it is reasonably well known that unsecured wifi is a security risk. The advantage of it for the current generation of smartphones is that it is normally a cheaper and quicker way of downloading data to a smartphone device. Apps and features that take advantage of 3g or 4g networks will normally be able to utilise Wifi networks as well with the exception of some services may be blocked by the provider. But there are many security holes when you use wifi. Google has in the last several years been collecting data, sometimes illegally, about wifi hotspots the world over so one of the first things that you might expose when you sign on to a wifi network is your location, to Google or to whoever they wish to share that location information with. But you are also sharing data with your wifi host as well and this data can be quite detailed.

Although generally public wifi networks are a security risk a security researcher by the name of HD Moore showed how much more susceptible iPhones were on wifi networks in 2007 stating that every process on the iPhone ran with full root priveleges¹⁵. Although security has undoubtedly improved since then it would be safe to assume that smartphones are no more secure on a wifi network than any other device and that it is probably, based on the information that HD Moore exposed, reasonable to assume that they are less so. It should be remembered as well that anyone can put up a wifi network these days from their smartphone. You could be logging onto a network of a guy (or girl) sitting nearby who is watching everything that you do, there being various tools available for such an exploit such as firesheep, Metasploit or Cain (but in reality there are likely many more tools available as well).

The USB port on a smartphone device is often used to charge the phone as well as to transfer data between one device and another device. Before the iPhone moved to a cloud based syncing service it was also used to sync data between the device and iTunes and other Apple services such as iPhoto. It still has this ability. In his Forensics Manual for law enforcement¹⁶ Jonathan A. Zdziarski states that to be able to access data on an iPhone the user should connect the iPhone to a USB port and then use the iLiberty tool to jailbreak the iPhone and get access to its files by using a tool of Zdziarski's called Forensic-Toolkit which you are easily able to install on a jailbroken iPhone. Although some of the sites referred to in Zdziarski's manual are no longer available there are numerous sites on the internet where you can learn how to jailbreak a smartphone. Of course you need access to the iPhone to be able to take advantage of this exploit. But the USB port can also be used to install malware on to a device and although this is not always simple it has been demonstrated to be possible by six students from Georgia Institute of Technology¹⁷ although Apple has also since taken steps to reduce the possibility of such an exploit. You don't need physical access to the device for this, you just need to able to encourage the user to make use of the charger, which is probably a trivial exercise at Airport and Train terminals. Obviously if you do have physical access the exploit is a lot easier.

NFC (Near field communication) is a growing technology in the smartphone area. It is used by Android phones mostly for contactless payments and does this by enabling bluetooth or wifi on both the smartphone and the device that it is trying to contact with. As bluetooth has already been addressed as being inherently unsafe there is no need to go over this again other than to note that using such an unsafe technology for bank account transactions is asking for trouble. Having NFC enabled on your device is also likely to result in a leakage of information from it as well as the receipt of unsolicited promotions as another feature is that it can be used to activate apps on your smartphone and can even be used to redirect the smartphone to malicious websites¹⁸. The INFOSEC website outlines a few other possible vulnerabilities as well including the possibility of the attacker using your smartphone to make calls¹⁹. Apple seems to have decided to use a different technology to allow its users (and Android users) to be able to take advantage of the same sort of features. This is called iBeacon and its range is a lot further than NFC at 50 metres or so. Apps enabling iBeacon can automatically be activated once in range of an iBeacon which raises the same sort of questions that NFC does although with the current limit that the communication is only to your iPhone and not bi-directional.

SIM cards and SD cards are used by the phone to access networks and to store and retrieve data from. As such they have the potential to be misused and can allow man in the middle attacks or in some cases initiate code execution²⁰.

In today's smartphones there are also accelerometer, gyro, proximity, fingerprint and compass sensors and these help various applications to provide better service and information, for example your web-browser can tell from the gyro whether to display information in portrait or landscape. Although mostly they're not a direct threat to smartphones they can help in attacks for example by recognising your keystrokes²¹ or by providing information to those who have compromised your smartphone elsewhere. The fingerprint sensor on an iPhone may be a potential larger liability though as if it is used or authentication then it has been shown to be relatively easily tricked²².

Although some of the impetus for information collection from smartphones is driven by commercial interests and some from hackers who are also trying to gain financially from your personal information, the majority of todays information is being collected by government organisations such as the NSA. Some very large companies such as Google and Apple (and undoubtedly Facebook) are also collecting very large amounts of data on a substantial number of the worlds population. This data includes your location, who you visit, details of your emails and for organisations like the NSA most likely all your communications.

At the same time wealth is more and more being concentrated in the hands of the extremely wealthy²³. It is unlikely that the two are unrelated and the sheer quantity of information being collected is mostly only accessible to elite groups, it is not accessible to you and me. For example I can't listen into conversations that Barrack Obama has been having in the last week but I'm sure that he could listen to mine. That smartphones are essentially insecure would seem to be a given but with the addition of backdoors that remain undocumented (at least in the public arena) they are likely even more insecure. There is a need to address this issue immediately as it would seem to me that a totalitarian state is able to function in such an environment but I would be extremely surprised if a democratic one can. As Frank on the Chaos Computer Club states “Biometrics is fundamentally a technology designed for oppression and control” and this can be equally applied to any other technology hoovering up all our details currently. As the information is primarily going to the United States in a world where information is king, if you don't want this sort of royalty, as such a world will have, or maintain, deep inequality not just between persons but also between nations, then it is incumbent upon you to make sure that it doesn't come about.