<story><title>Tell HN: Your Android carrier can remotely turn settings on</title><text>My wife is currently in Germany and had cell broadcast warnings disabled on her Android 11 device. Apparently, the local carrier she uses turns them back on remotely. She gets notified of this. &amp;quot;Settings changed by carrier.&amp;quot;&lt;p&gt;(1) Were you aware that carriers can remotely override your settings like this?
(2) Any strategies to keep something like this from happening besides rooting the device?
(3) How do you feel about this type of remote control by a third party?&lt;p&gt;I must say I strongly dislike losing control over my own device. It feels dystopian to me.&lt;p&gt;I also couldn&amp;#x27;t find any mention of this particular power of carriers apart from one lonely Reddit post about someone trying to turn off Amber alerts [1].&lt;p&gt;----------------
EDIT: Additional info for clarity:&lt;p&gt;The settings I am referring to are under &amp;quot;Apps &amp;amp; notifications&amp;quot;&amp;#x2F;&amp;quot;Wireless emergency alerts&amp;quot;. They are about controlling whether to and which alerts one wants to receive on their phone.&lt;p&gt;It&amp;#x27;s an unlocked Android One device. The carrier seems to be able to remotely change these settings (see the referenced Reddit post as well), which I would never expect. It seems to be because of the SIM the phone uses and the network it connects to. No user-controlled software change like updates.&lt;p&gt;----------------&lt;p&gt;[1] https:&amp;#x2F;&amp;#x2F;old.reddit.com&amp;#x2F;r&amp;#x2F;GooglePixel&amp;#x2F;comments&amp;#x2F;zebvs4&amp;#x2F;settings_changed_by_carrier&amp;#x2F;</text></story><parent_chain><item><author>kornhole</author><text>From &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;grapheneos.org&amp;#x2F;faq&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;grapheneos.org&amp;#x2F;faq&lt;/a&gt;:
&amp;quot;Connecting to your carrier&amp;#x27;s network inherently depends on you identifying yourself to it and anyone able to obtain administrative access. Activating airplane mode will fully disable the cellular radio transmit and receive capabilities, which will prevent your phone from being reached from the cellular network and stop your carrier (and anyone impersonating them to you) from tracking the device via the cellular radio. The baseband implements other functionality such as Wi-Fi and GPS functionality, but each of these components is separately sandboxed on the baseband and independent of each other. Enabling airplane mode disables the cellular radio, but Wi-Fi can be re-enabled and used without activating the cellular radio again. This allows using the device as a Wi-Fi only device.&amp;quot;&lt;p&gt;When I am at home, I am WIFI only. When I am out, WIFI &amp;amp; bluetooth are off. This takes some discipline at first but then just becomes habit. I know the spot on my commute home where I switch my settings.</text></item><item><author>jvanderbot</author><text>Your location data. Tower associations can still happen with data &amp;quot;off&amp;quot;, since there&amp;#x27;s plenty of &amp;quot;listen&amp;quot; components. All your home wifi connections are well Geo-located, thanks to other Android users picking up the ESSID as they walk &amp;#x2F; ride &amp;#x2F; drive past your house. Your shopping &amp;#x2F; outings? Forget it, fully known.&lt;p&gt;VPNs hide the content of connections, at least from MITM &amp;#x2F; eavesdroppers, but server-side data scrapes are quite effective at figuring out who you are (or what your phone is ... see below).  Nothing really does a good job of hiding the fact that you are connected to a VPN except TOR, and  where that connection originates (e.g., your wifi network, which is well Geo-located, remember?). And de-anonymization of VPN connections to identify downstream connections are possible, IIRC. Details about your phone are well recorded (MAC, SID, etc)&lt;p&gt;And always remember, your phone can be implicated based on location data, which will implicate you once it&amp;#x27;s discovered you own the phone. And that&amp;#x27;s as simple as looking up the SIM purchase &amp;#x2F; use.</text></item><item><author>kornhole</author><text>I rotate burner SIM&amp;#x27;s. I never make calls with the SIM. Instead I use jmp.chat if I need to use OTA calls or SMS. I am in airplane mode 99% of the time and use WIFI instead of cellular. I never activate cellular near my home. I am always connected to VPN so that the traffic cannot be analyzed. My phone is anonymous without any identifiers. I think all this mitigates the baseband attacks, but tell me if I am missing something.</text></item><item><author>qbasic_forever</author><text>Wait until your learn what a country or local government&amp;#x2F;police can do remotely to the baseband firmware of your phone with a court order...&lt;p&gt;10-20 years ago the FBI was regularly remotely programming firmware to listen in and record cell phone microphones to capture conversations of suspects.  IIRC a mafia case hinged on data gathered in this way so it is not some abstract theoretical or crackpot theory (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.cnet.com&amp;#x2F;news&amp;#x2F;privacy&amp;#x2F;fbi-taps-cell-phone-mic-as-eavesdropping-tool&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.cnet.com&amp;#x2F;news&amp;#x2F;privacy&amp;#x2F;fbi-taps-cell-phone-mic-as...&lt;/a&gt;).&lt;p&gt;It&amp;#x27;s only gotten worse as phones have gotten more capable.  You don&amp;#x27;t own squat about the device in your pocket at all times.</text></item></parent_chain><comment><author>burntwater</author><text>I can promise that airplane mode does not fully disable the cellular radio, at least not on Samsung phones. Repeating a comment above: I can verify they do in fact receive data - I worked an immersive art project that had 100 Samsung cell phones that were in airplane mode, and we found out the hard and noisy way that they were still able to receive emergency and AMBER alerts (U.S. alerts that notify of potential child abductions).</text></comment>
<story><title>Tell HN: Your Android carrier can remotely turn settings on</title><text>My wife is currently in Germany and had cell broadcast warnings disabled on her Android 11 device. Apparently, the local carrier she uses turns them back on remotely. She gets notified of this. &amp;quot;Settings changed by carrier.&amp;quot;&lt;p&gt;(1) Were you aware that carriers can remotely override your settings like this?
(2) Any strategies to keep something like this from happening besides rooting the device?
(3) How do you feel about this type of remote control by a third party?&lt;p&gt;I must say I strongly dislike losing control over my own device. It feels dystopian to me.&lt;p&gt;I also couldn&amp;#x27;t find any mention of this particular power of carriers apart from one lonely Reddit post about someone trying to turn off Amber alerts [1].&lt;p&gt;----------------
EDIT: Additional info for clarity:&lt;p&gt;The settings I am referring to are under &amp;quot;Apps &amp;amp; notifications&amp;quot;&amp;#x2F;&amp;quot;Wireless emergency alerts&amp;quot;. They are about controlling whether to and which alerts one wants to receive on their phone.&lt;p&gt;It&amp;#x27;s an unlocked Android One device. The carrier seems to be able to remotely change these settings (see the referenced Reddit post as well), which I would never expect. It seems to be because of the SIM the phone uses and the network it connects to. No user-controlled software change like updates.&lt;p&gt;----------------&lt;p&gt;[1] https:&amp;#x2F;&amp;#x2F;old.reddit.com&amp;#x2F;r&amp;#x2F;GooglePixel&amp;#x2F;comments&amp;#x2F;zebvs4&amp;#x2F;settings_changed_by_carrier&amp;#x2F;</text></story><parent_chain><item><author>kornhole</author><text>From &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;grapheneos.org&amp;#x2F;faq&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;grapheneos.org&amp;#x2F;faq&lt;/a&gt;:
&amp;quot;Connecting to your carrier&amp;#x27;s network inherently depends on you identifying yourself to it and anyone able to obtain administrative access. Activating airplane mode will fully disable the cellular radio transmit and receive capabilities, which will prevent your phone from being reached from the cellular network and stop your carrier (and anyone impersonating them to you) from tracking the device via the cellular radio. The baseband implements other functionality such as Wi-Fi and GPS functionality, but each of these components is separately sandboxed on the baseband and independent of each other. Enabling airplane mode disables the cellular radio, but Wi-Fi can be re-enabled and used without activating the cellular radio again. This allows using the device as a Wi-Fi only device.&amp;quot;&lt;p&gt;When I am at home, I am WIFI only. When I am out, WIFI &amp;amp; bluetooth are off. This takes some discipline at first but then just becomes habit. I know the spot on my commute home where I switch my settings.</text></item><item><author>jvanderbot</author><text>Your location data. Tower associations can still happen with data &amp;quot;off&amp;quot;, since there&amp;#x27;s plenty of &amp;quot;listen&amp;quot; components. All your home wifi connections are well Geo-located, thanks to other Android users picking up the ESSID as they walk &amp;#x2F; ride &amp;#x2F; drive past your house. Your shopping &amp;#x2F; outings? Forget it, fully known.&lt;p&gt;VPNs hide the content of connections, at least from MITM &amp;#x2F; eavesdroppers, but server-side data scrapes are quite effective at figuring out who you are (or what your phone is ... see below).  Nothing really does a good job of hiding the fact that you are connected to a VPN except TOR, and  where that connection originates (e.g., your wifi network, which is well Geo-located, remember?). And de-anonymization of VPN connections to identify downstream connections are possible, IIRC. Details about your phone are well recorded (MAC, SID, etc)&lt;p&gt;And always remember, your phone can be implicated based on location data, which will implicate you once it&amp;#x27;s discovered you own the phone. And that&amp;#x27;s as simple as looking up the SIM purchase &amp;#x2F; use.</text></item><item><author>kornhole</author><text>I rotate burner SIM&amp;#x27;s. I never make calls with the SIM. Instead I use jmp.chat if I need to use OTA calls or SMS. I am in airplane mode 99% of the time and use WIFI instead of cellular. I never activate cellular near my home. I am always connected to VPN so that the traffic cannot be analyzed. My phone is anonymous without any identifiers. I think all this mitigates the baseband attacks, but tell me if I am missing something.</text></item><item><author>qbasic_forever</author><text>Wait until your learn what a country or local government&amp;#x2F;police can do remotely to the baseband firmware of your phone with a court order...&lt;p&gt;10-20 years ago the FBI was regularly remotely programming firmware to listen in and record cell phone microphones to capture conversations of suspects.  IIRC a mafia case hinged on data gathered in this way so it is not some abstract theoretical or crackpot theory (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.cnet.com&amp;#x2F;news&amp;#x2F;privacy&amp;#x2F;fbi-taps-cell-phone-mic-as-eavesdropping-tool&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.cnet.com&amp;#x2F;news&amp;#x2F;privacy&amp;#x2F;fbi-taps-cell-phone-mic-as...&lt;/a&gt;).&lt;p&gt;It&amp;#x27;s only gotten worse as phones have gotten more capable.  You don&amp;#x27;t own squat about the device in your pocket at all times.</text></item></parent_chain><comment><author>MengerSponge</author><text>BTW habitually switching at the same time and place is terrible opsec. It leaks a ton of information.</text></comment>