Slashdot Mirror
Criminals Remote-Wiping Cell Phones
An anonymous reader writes "Crafty criminals are increasingly using the remote wipe feature on the Apple iPhone and other business handsets, such as RIM's BlackBerry, to destroy incriminating evidence, the head of the UK's Serious Fraud Office Keith Foggon has warned. Foggon told silicon.com that the move away from PCs towards using mobile phones was causing a headache for crime fighters who were struggling to keep up with the fast pace of new handsets and platforms churned out by the mobile industry."
I can wipe my blackberry to make data irretrievable? I can do it remotely too? HOW?
...who took one look at this and thought "good."
That just means the police need to work a little harder to make a case. It doesn't make it impossible though. The next hope is that they don't outlaw these devices or something. The Brits are a bit jumpy.
Criminals destroy evidence that could be used against them. News At 11.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Don't forget to view the photos. I thought the photos were more interesting than the article.
http://software.silicon.com/security/0,39024655,39270417,00.htm
If the only evidence the police have on said 'criminal' is a string of bits on his cell phone, they probably didn't have much of a case anyway, and likely shouldn't be arresting this criminal.
I genuinely hope small time 'criminals' continue getting these sorts of victories to the point that our police forces are forced to admit they have failed in the war on consensual acts between adults. The change certainly isn't going to come about while our various wars continue to make a tidy profit for those at the top.
...that could be used against them?
Honestly, if the only case the prosecution has is possible evidence on an iPhone, their case is pretty shaky to begin with. Do REAL WORLD investigation you Nazi-a-holes, not worry about virtual evidence that you might or might not be able to get to!
I'm glad these articles focus on the negative facts that police have trouble with, and not the USEFUL part of remote data wipe so that millions of customers data can be deleted when a device is lost, instead of having that information in the hands of people that could do some damage. I'll take a wipe of evidence for that security any day.
If you are really paranoid, you'll want your laptop or cell phone to:
With this, only experts will be able to copy your device much less decrypt it, and they will have a limited time window to do the copy.
Such a phone or laptop would be good for crossing national borders or any other place where it is subject to search or seizure. If the border guards take it and try to copy it, they may give you back a brick, but at least they won't have anything useful.
Of course, this means you should have your irreplaceable data someplace else for safe-keeping. Think of your phone or laptop as a "convenience copy."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Here's an interesting bit too. Looks like they try simple password protection breaking, but...
The team does not attempt to crack high-grade encryption, relying instead on the threat of a prison sentence for individuals refusing to hand over passwords or decrypted files.
Given that we have crimes which are commited pretty much entirely via communications (eBay scams, 419 scams, harrasment, extortion, stock mischief, etc. etc.) should it be particularly surprising that some forensic scientists are interested in preserving the evidence that the communications took place?
No kidding!!! What do you say at this point?
With this...http://www.lessemf.com/fabric.html
Worked on a project to handle just this problem. Shielding fabric allows you to view and manipulate the phone, while preventing it from connecting to the network. A standard anti-static bag works pretty well, too...just make sure you get a good inside-to-inside seal.
Personally, I'm sick and tired of the government and the police agencies bitching and complaining that they can't keep up with all this technology stuff. The criminals seem to be figuring it out just fine and they usually don't have forensics training.
It's time for the police departments to start hiring some technology professionals to work on tech related crimes and evidence instead of simply trying to outlay any device they can't open up and read like a book.
Bottom Line: You guys are being paid by the people to know how to deal with this kind of stuff, so DEAL!
"Nope, sorry, I plead the fifth."
The UK doesn't have the fifth.
*file "First POST" has been deleted*
*have a nice day*
if the cops had any brains they would shut off the phones (remove battery) the second they get it and then give it to forensics that should have the IQ to operate it in a faraday cage so that it cant be tampered with remotely. Do they take laptops and PC's they capture and hook them to the net and turn them on? Why do they connect phones to the network when they look at them?
Come on, I though they taught the police how to handle evidence. Are you telling me that CSI tv show is a LIE!!!!
Do not look at laser with remaining good eye.
Not to mention right near the top of the ARTICLE ITSELF:
"Because we isolate the devices immediately, and never reconnect them to their network, the remote wiping capability does not present us with much of a problem," he noted.
Um, so the problem is? Talk about sensationalism.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Are these guys terrible at their jobs, or do the iPhone and Blackberry come with a way to remotely execute "shred"? Most of the data that is remotely "wiped" should be perfectly salvageable....
Than leaving incriminating notes or phone numbers written in a book. Instead of flipping through pages they dump your sim card. If you're going to do illegal things then don't leave anything tangible.
Only the State obtains its revenue by coercion. - Murray Rothbard
It was added as part of the 2.0 firmware upgrade.
http://www.apple.com/iphone/enterprise/
eatures include:
* Push email
* Push contacts
* Push calendar
* Global Address List (GAL) support
* Certificates and identities
* WPA2/802.1X
* Enforced security policies
* Cisco logo More VPN protocols
* Device configuration
* Remote wipe
Sorry it sounds like a "In Soviet Russia" thing but it is true.
Symbian/WinMobile smart phones have tools to lock the handset remotely or in case of new Kaspersky antivirus/security or other 3rd solutions, you can remotely instruct phone to delete all personal data irrecoverably and lock itself. I am almost sure Blackberry, being an enterprise focused device must have similar option.
Once the Apple decided not to allow background running processes, they lost that possible solution. Not just they don't allow anyone to implement it, they don't implement it themselves too.
It is a completely fool safe thing. User sends a previously set SMS to device, device locks itself. Or in Kaspersky case, it doesn't just lock itself, it wipes its data and optionally transforms itself to a white hat (for you) rootkit/trojan and sends the number of first SIM card plugged to device to previously set number.
The next step is to demand evidence of business activity -- just to make sure no laws have been broken.
I have a program on there that'll reformat the hard drive and zero everything else out, as well as disabling the SIM card, if I text it a certain phrase. Of course, it isn't all that helpful if whoever gets ahold of my phone just turns the radio off or removes the antenna so it can't receive that message, but I guess I have to count on criminals not knowing much about PalmOS since it's apparently a dying platform or something.
No doubt. They should have said "Remote wipe is useful in situations such as..." and then link to all the stories we've seen about lost laptops in the last year.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
I actually RTFAd, and there's no evidence whatsoever in the article of criminals actually, you know, doing this sort of thing. It's a forensics expert saying that this cell phone feature "could be exploited by lawbreakers." Gee. And he even says it's not a big problem if it actually ever does happen as it's easily countered by any forensics shop: "He added the unit took precautions to guard against the feature being exploited. 'Because we isolate the devices immediately, and never reconnect them to their network, the remote wiping capability does not present us with much of a problem,' he noted." The whole story is pretty empty, a little bit of whining about how new technology is making their jobs tougher, but that's about it.... Welcome to the 21st century.
It seems that law enforcement sees itself as more and more godlike when it comes to assume power over mere mortals they are investigating. This arrogance has to be stopped dead, because if left to themselves, they will expect total compliance and disclosure upon request to anyone without any safeguard whatsoever against abuse.
We have to resist indomitably, in order to drive the point home that our information is not a plaything to be rummaged through at will; if the administration of justice suffers for it, better let a criminal escape than harass an innocent.
A quick history lesson.
Most of the UK's 'cell' tech came from ex Government Communications Headquarters workers.
It was designed on the lessons learned by the UK gov in 1970's in Ireland.
Interception, tracking, impersonation.
The idea that the UK gov ever lost this 'network' is really lol.
The work and deaths of Adamo Bove, head of security at Telecom Italia
and Costas Tsalikides, Vodafone's network planning manager in Greece,
show that all aspects of cell phone use are wide open to all.
Domestic spying is now "Benign Information Gathering"
I worked at a high school that was administering standardized tests--standard procedure is that cameras and phones stay in backpacks to keep students from leaking the exams. Makes sense.
Turns out a few students are so phone addicted they put their phone in their pocket, ask to use the bathroom, and whip the phone out the second they enter the hall. The phones were quickly confiscated by a hall monitor.
Being the school's sysadmin, there was insistence that I check every one of these confiscated phones for evidence of trying to leak exam information--page pictures, text messages, etc. Of course, I found nothing.
I explained that, IF the students were in fact doing this, they could easily delete any evidence they were leaking information--picture archive and sent-messages folder. I was looked at as if I had grown a third nipple--I might as well have been speaking Farsi.
BTW, there's a feature I want in a camera phone. Upon pressing one key, the camera phone commits to taking a picture and immediately e-mailing it to a predetermined e-mail address. That way, should a person/police officer take the phone or swat it out of your hand, it's too late, unless they can physically break the phone or remove the battery within the 3 seconds the picture takes to send...
The idea made me curious. I just wrapped my phone (mobile) in a rather large ball of aluminum foil. I then called it. Err... It still rang. I don't have any scientific evidence to say why, how, or all that but it rang. I obviously couldn't answer it.
"So long and thanks for all the fish."
And "Stainless steel mesh shielding fabric hat" just doesn't have the right ring to it; it sounds too woody, not tinny enough!
(More seriously, thanks for the link; I might buy some of this stuff when my passport gets chipped...)
Err... How about kiddy porn on their phone?
"So long and thanks for all the fish."
it used the ball of aluminum foil as an antenna?
This is not the funny you're looking for.
Try a thicker foil (and make sure there exists no holes in it), at some point it would stop ringing because it should shield against the magnetic field.
The Humourous Fraud Office are mostly known as the people you call if you buy a pet which, when you get it home not half an hour later, turns out not to have been just resting at all, but in fact to be stone dead and nailed to the perch.
Real Daleks don't climb stairs - they level the building.
Shred is for HD's, not flash. Learn the difference. It seems you are terrible at your job if you do not know the difference.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
NOT A SCIENTIST... So... I was curious. The dimensions were *about* 8" across with the phone in the center. Since I have had people tell me to drill holes in it. I will try that next.
"So long and thanks for all the fish."
Will ground in the morning.
"So long and thanks for all the fish."
Removal of battery is feasible, since most of the information of interest is stored in flash, but it doesn't work for all phones since a few uses ordinary RAM and a backup capacitor, which effectively will wipe the phone completely if the battery is removed for too long.
So you have to know the phone to take the correct measures to allow the forensic team to have something to work with.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The frequency you are using on your phone is very high, any tiny gaps in the foil will allow the signal in.
Carefully wrap the phone in foil, make all seams double folded, creased and taped and then wrap it again that way and try again.
Do not look at laser with remaining good eye.
Great example! A vivid (if slightly damaging) real-world example.
It's been a while since I learned about CRT deflection coils, and demonstrated my new-found knowledge to my siblings by making pretty patterns with a magnet held up to my parent's TV. I still remember the horror when I removed the magnet and the wild colors didn't go away...
And that's why you don't fix it with another magnet: you buy/beg/borrow/steal or build a degaussing coil and demagnetize it. Which may take a few tries if you've never done it before.
yes, drilling holes in your phone would definitely stop it from connecting to the cell network.
A Faraday cage needs the cage and the object to be electrically separated. Otherwise, you just gave your device a big antenna.
The idea made me curious. I just wrapped my phone (mobile) in a rather large ball of aluminum foil. I then called it. Err... It still rang. I don't have any scientific evidence to say why, how, or all that but it rang. I obviously couldn't answer it.
No no no, you have it wrong. You are supposed to wear the tin foil hat on YOUR head.
that the world isn't completely a police state, yet. Let them figure out how to fix their 'problem'.
"Because we isolate the devices immediately, and never reconnect them to their network, the remote wiping capability does not present us with much of a problem," he noted.
So, law enforcement is deliberately keeping my company from protecting it's customers' data? Great. My customers will feel much more secure knowing that their data is safe in some random evidence locker in some random town than having it be gone.
"We reject as false the choice between our safety and our ideals." --The American President (20.1.2009)
Automatic wipe when certain *signals* aren't received periodically???
Maybe the crooks already thought of it...
If not - don't read this - my idea has been stored in printed form, in a sealed mason jar, under the front porch.
Who is general failure, and why is he reading my hard drive?
I suppose if you are an organized crime syndicate, yes, they are interfering with your business plan. Perhaps you should inform all of your employees, er... henchmen, to please refrain from leaving their iPhone at any crime scenes they have created.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
186s? That will come in very handy if they happen to catch a criminal mastermind happens to be carrying around a BBC Master 512, Tandy 2000 or Wang Office Assistant in his pocket.
Show me how to easily take the battery out of an iPhone. Please.
Do not fold, spindle or mutilate.
If it's truly a proper Faraday cage for the frequencies involved, it doesn't matter if the object and the cage are electrically separated or not -- it'll still work. This is a function of Gauss's law.
In this case, either the aluminum foil wasn't thick enough, or the gaps in it were too large. A cell phone is generally pretty sensitive, so even if you reduce the signal by a factor of one million, it may still be able to pick it up.
Since every time something like this comes out all kinds of FUD pops up about data erasure, etc...
A classic paper on secure data deletion & recovery:
http://www.cs.cornell.edu/people/clarkson/secdg/papers.sp06/secure_deletion.pdf
Enjoy
Shop smart, Shop S-Mart.
Your ball of foil was NOT a faraday cage. Or rather it was a very poorly constructed one. You need a fully conductive enclosure with very tight seems. In professionally constructed enclosures you will notice things like copper gaskets and closely spaced bolts, doors where a copper knife edge is forced by a cam into a narrow slot. Even after the enclosure is built it must be tested and small air-gaps found and repaired.
In your case, a foil to foil joint is likely not conductive. Oxide coating on the Al foil acts as an insulator and you get a few ohms of resistance, at least.
Try another test using copper or brass pipe. Put the phone inside a length of pipe and screw end caps over each end of the pipe. Tighten until the bare metal on metal threads from a gas tight seal.
How about making the aluminium foil into a hat shape before putting the mobile phone in it? It works for me.
Gentoo Linux - another day, another USE flag.
That makes me curious, is there any way to remote wipe an iPhone without being part of the Enterprise program? (You can wipe it on the iPhone settings menu itself already)
Or maybe THEY programmed you to spread that disinformation.
"Because we isolate the devices immediately, and never reconnect them to their network, the remote wiping capability does not present us with much of a problem"
Sounds like they have the problem under control. Still must be a slow news week.
Don't most phones have an airplane mode, to turn off the radio...?
Wrapped carefully and it did not ring. :)
"So long and thanks for all the fish."
I wrapped it, instead of balling it up, and it didn't ring. It didn't ring in a microwave either. :)
"So long and thanks for all the fish."
Nope, didn't ring in the microwave. (Then I put a lightbulb in water into the microwave. That's another story for another day.) I also wrapped it carefully (not balled) and folded all the seams over that I could and it no longer rang. Yes, I have no life and my wife thinks I'm insane.
"So long and thanks for all the fish."
That worked just wonderfully - it didn't ring. Nor in a microwave either. Yeah... I really need a life.
"So long and thanks for all the fish."
Interesting. I put mine in my Microwave (switched off obviously), and called it.
It rang.
It was on the glass turntable, so it couldn't have used the walls of the microwave as an antenna.