I have been trying to prove to someone I love just how innocent I am about a situation that he feels came from me. I'm not a tech person but I am a fact based logic person, and because of that everything has to make sense to me. I know very well what my actions consisted of on that day, and I know people have tried to sabotage us using the internet before, which is why I would think he would know me better than that. Other than what I now have installed on my phone which he can't see because he isn't talking to me, I researched the following online to show him I have no reason to lie about this.
"To successfully "hack" someone's phone, you need to get them to take some action which allows a compromising exploit to be run on the phone. That means you need either physical possession of the phone (at which point, it's a free-for-all), or you need to induce them to take some action.
So, if I wanted to compromise a phone, I'd use a spear phishing variant.Let's say that I'm targeting, oh.... Jonathan Brill. And all I have is his phone number. I'd apply some social engineering and see if I could acquire the phone numbers of say oh, I dunno - someone who he'd trust. Maybe Marc Bodnick or Adam D'Angelo or any of the senior staff at The Q. With that in hand, I'd flange up a software suite, designed to install a dropper when opened in a web browser, from which I'd be able to proceed to take over his phone. Now, how to get it to him? Hmm. Craft a faked-up Quora page, possibly by "stealing" a real Quora page, and then sending a link in an SMS message with fake CallerID making it look like it's from someone he trusts "Hey, Jonathan, read this and consider it for publishing". My link would use the Quora link-shortener, but mis-spelled, he'd miss that, and click on it. And. His. Ass. Is. Mine.Maybe.There's a further supposition in there. That I can figure out how to penetrate his phone from a dropper on a web page. So far, that's not "a thing" except for phones which have been "jail broken" or which have other software installed which make that possible.
So the confidence interval goes from "not at all" if he's rocking a stock iPhone to "pffft. cake" if he's on a older release of Android that's jailbroken.But if I can somehow get him to install an app I've written.... the odds go way up. Same issue, though. Most iPhone users are really good about only installing stuff from the AppStore, which means I either have to be really, really good at this (and have a pile of time to devote to it), or it's not going to happen. Android, on the other hand, where you can just download and run APK files from literally anywhere (you do have to have the user bypass the "are you sure you want to do this?" warning, but hey by this point you're an old pro at that) it's cake, if the user is willing to do what you want them to do. And it all starts with a text message, to a phone number."
I would never do anything to him there is more research out there. but I'm not trying to write a thesis I just want the person I love to know I would never harm him or lie about something like that. I have known about this for awhile because a person who was very close to me informed me about it, I then did the research myself to confirm what was told to me.
Comments
Post a Comment