A Device to Grab Data From Cell Phones

what about writes "Apparently there is a quick, simple, and undetectable way to grab all of your cellphone data. CNet reports on the Cellular Seizure Investigation (CSI) Stick, developed for law enforcement but available to the public, which 'connects to the data/charging port and will seamlessly grab e-mails, instant messages, dialed numbers, phone books and anything else that is stored in memory. It will even retrieve deleted files that have not been overwritten. And there is no trace whatsoever that the information has been compromised, nor any risk of corruption. This may be especially troublesome for corporate employees and those that work for government agencies.' I use mobile knox, a secure storage application, for my important data, but I would be very upset if somebody grabbed my telephone list, SMS, or anything else from my locked phone."

Comments

Non free is always this way.

[twitter]

Anyone have any doubts left about the importance of software freedom for all your devices?

Re:Non free is always this way.

[Anonymous Coward]

I think its great. Theres now a way to copy DRM-laiden MP3s and ringtones from your phone.

Re:Non free is always this way.

[davolfman]

It's a failure of security through obscurity. The cell phone companies have concentrated so much on selling the syncing systems for absurd amounts that they never bothered to actually secure the interface.

This only works on SOME phones

[davidwr]

Phones without a data port are immune.

Phones whose firmware will not send a particular piece of data over the data port are immune as long as the firmware isn't updated. Updating the firmware leaves a trace.

This goes to show that in many cases, physical access is ultimate access.

I see a market for "secure" phones where the data part of the data/charging port is disabled unless you plug in a key or type in a code. Many companies will gladly pay for such a device.

Re:This only works on SOME phones

[dotancohen]

I see a market for "secure" phones where the data part of the data/charging port is disabled unless you plug in a key or type in a code. Many companies will gladly pay for such a device.

So long as the data port is not playing double duty as the charging port, take a screwdriver to it. That's what people in sensitive government jobs to the cameras in their cellphones. In Israel, it doesn't even void the warranty under most circumstances.

Re:This only works on SOME phones

[phoenix321]

We're not talking about a stream cipher that encrypts megabytes of data per second but phone number, a string with a maximum of about 15 digits, maybe more.

And then the contents of SMS, again 160 half-bytes at max. I mean, these phone CPUs can decrypt tiny videos at 15fps and not break a sweat, come on, they CAN encrypt less than a dozen kilobytes without killing the battery.

Then again, I'd rather recharge the phone every fourth day instead of every fifth when I can be sure that no one can clone its contents when I look away for a second.

Wait... "troublesome for corporate employees"?

[DrEldarion]

If you're using your employer's phone, you really shouldn't expect the things you do on it to remain private.

Re:Wait... "troublesome for corporate employees"?

[andy1307]

I think they're talking about other companies(in the case of corporate cellphones) and unauthorized people(in the case of govt. cell phones) getting access to the data.

Re:Wait... "troublesome for corporate employees"?

[Hyppy]

You want you data secured? Keep it on a secure server somewhere. Access it in a way that doesn't leave copies on your phone.

So, how does one exactly go about dialing a number without leaving a trace on the phone?

Re:Wait... "troublesome for corporate employees"?

[mikiN]

Sign up with a dialing/switchboard service that uses voice recognition, maybe?

suggestModerate(parent, -1, "D'oh");
this.append(smiley);

Re:Wait... "troublesome for corporate employees"?

[EdIII]

You completely missed the point. This is not about the employee being able to keep their actions private from the world, or even their own employer. It is about the company being able to keep their actions private from the world, which obviously includes the actions of all of their employees.

It is a completely reasonable expectation, and indeed quite desirous by corporations, that an employee be able to maintain some level of privacy (and security) from the rest of the world. So when the article mentions that it is "troublesome for corporate employees" it is really talking about the implications for security for the entire company.

Security Cameras, Data Sucks, I'm Not Surprised

[curmudgeon99]

How can anyone feign surprise at having your entire electronic life be compromised. If you have a device smart enough to keep up with several email accounts and manage them all, of course you've also opened up a pig portal. If you want to have secrets, fill your world with post it notes under desks.

If they can make this

[Anonymous Coward]

Then why is it so hard for me to sync my phone?!

Plot Device Failure.

[GNUChop]

This device will never be used to solve a real crime. Cell phone companies already keep the required records for billing. This will simply allow TSA and other would be snoops to dig into people's private business. I had to laugh when I saw this:

The good news: the device should find wide acceptance by parents who want to monitor what their kids are doing with their phones, who they are talking to and text messaging, and where they are surfing. It could also be valuable in secure areas where employees need to be randomly monitored to insure that sensitive information is not compromised through the use of a cell phone as a memory device.

These will be the real users of this kind of device. Free software for cell phones can not arrive fast enough.

Re:oye!

[plover]

I always knew that cell phones are vulnerable, but to know there is a device which can basically clone your data out, with NO trace, that's downright scary! Even when LOCKED? We should start reading our contracts and our EULAs on our phone, somehow, somewhere, there's got to be something to rely on legally, if this can happen.

Such a device is called a "computer", and many people already own one. By means of a secondary device, called a "USB cable", one can attach a computer to a cell phone and read the contents from it.

If you read the "instruction manual" that comes with your cell phone, you can see plainly that a cable can be connected between the phone and the computer and the contents read from it. No phone manual I have ever read says anything about authentication of the USB cable connection. Therefore you have already been informed of as much as you need to know, legally.

Re:Hmm...

[EdIII]

Do you mean the product should be illegal, or the act of using the product as it is intended?

This is being marketed as a forensic product. The primary user of this device is going to be a forensic technician in the field. That usually implies crime scenes, etc. There are no problems legally in that context as the technician clearly has rights to be there, or is working in a lab on evidence.

So the product itself is legal as any use in a forensic capacity does not violate the 4th amendment. There are quite a number of products that could be used to violate someone's privacy, including a simple video recorder.

Now law enforcement, including intelligence agencies, using this against suspects out in the field should absolutely be working with judicial oversight. I agree there.

Since this is available to the public, most likely people will be using it in a clandestine fashion that would have legal implications. There is your biggest problem with respect to privacy, and it does not come from law enforcement.

Re:Probable Cause and Warrants

[Doc Ruby]

Like I said: we used to have requirements to protect our rights.

Clarence Thomas, as everyone not blinded by Republican loyalty knows, isn't a "Constitutional" justice. He's a rightwing pawn.

Which is why he and his Republican Supreme Courts have tended to throw out the requirements that the government protect our rights. Including the long-understood requirement that a warrant be produced from probably cause to be reasonable.

But hey, if you want a "literal Constitution", let's finally dismiss that standing army and finally get the well-regulated militia instead, that the Constitution requires.

Without due process, like reasonable cause producing warrants as the only legitimate search/seizure, the government can arbitrarily invade us. I bet King George III and his agents would have claimed all their searches and seizures were "reasonable". But that kind of "court" isn't the kind that we replaced with our Constitutional representative democracy.

If you want a Court that operates like a cracker gang exploiting any possible vulnerability in the "operating system" to destroy our rights rather than protect them, well, Clarence Thomas is your kind of "justice".

Re:Only Samsung and Motorola, so far

[Tony Hoyle]

Well it's missing the largest cellphone company in the world - Nokia - and within that the most popular phone in the world - the 3310.

So no, they are not the most common ones. (You'd need Sony Erricson and LG in there as well for the popular ones, even if you limited it to phones in the last year or two).

Possibly easiest to hack.

Re:oye!

[houbou]

Uh.. gee, let's put imagination 101 to the test.. say for example, your phone is:

1. locked, and
2. lost or stolen..

In real life, who the hell would locked their phone and maybe lose it uh? right? can't possible happen, that's way to fictional, going on sci-fi here..

You would THINK your phone numbers and whatever else is stored, at least is somewhat safe, but wait.. not anymore.. if a company sells you a phone and says it's safe when it is locked, only for anyone with the right software to override the locked feature, I think there is something wrong with this picture. That's the problem as I see it, if I'm naive, so be it, but I think there is a point to this, so, call me naive here, but I think you forgot that part of the equation in your comment :)

Re:Troll, mod down

[TheRaven64]

Yes it is. The contents of a mobile device should only ever be stored in persistent storage in an encrypted form, so that it's only accessible externally with the device's cooperation. The software on the device should only cooperate with properly authenticated external software. To avoid bricking the device, you might want to provide a mechanism for externally replacing the entire contents of the device's internal storage, but if you do this without first taking a backup (which you can't do without the device cooperating) then you can't install anything nasty on the device without the owner knowing the first time they try to access their data.

Re:Probable Cause and Warrants

[Xonstantine]

Clarence Thomas, as everyone not blinded by Republican loyalty knows, isn't a "Constitutional" justice. He's a rightwing pawn.

Statements like this is why you're a commie stooge, Doc. Clarence Thomas has been on the side of individual rights far more often than Ginsburg, Souter, Stevens, or Breyer.

Kelo vs Connecticut...who sided with government power and who sided with individual property rights?

Heller vs DC...who sided with government police power and who sided with an individual's right to self defense?

Raich vs US...who sided with personal growth and consumption of marijuana and who sided with the government's prosecution of such under the Commerce Clause?

As for the expectation of privacy when crossing the border, there has NEVER been an implied or explicit right. The US government has always maintained the power to search your belongings on entry. Your allegation that Thomas is somehow throwing out the Constitution with this decision illustrates your basic ignorance on the Constitution, Constitutional law, and Clarence Thomas...in other words, par for the course for you.

you have it backwards

[SuperBanana]

Despite the proliferation of mobile phones & wireless email, no one comes close to the blackberry platform for features & security. Not iphone, not windows mobile, not nokia. Some very smart people at RIM have looked at wireless email from end-to-end.

Um- wrong. Blackberry wanted to get government contracts, so they went through all the government security requirements.

You make it sound like this is some sort of rocket science. It's preposterous to suggest that only RIM has the talent to design a "secure" phone. It's not a matter of talent; it's a matter of whether or not the market demands it. We've seen it with the iPhone; after the initial crazy rush for v1.0, v2 has much more for enterprise users.

What RIM really needs is a good marketing campaign to establish themselves as a "cool" brand.

You incorrectly assume that RIM wants to compete in a "cool" market. Many companies purposefully restrict the market they target.