<story><title>Ask HN: How would French police locate suspects by tapping their devices?</title><text>I just found a news article regarding a law that passed in France allowing police to remotely activate GPS, camera, microphone on a user&amp;#x27;s device [0]. This was posted before on HN [1], but without traction, but I am not all that much interested in the civil aspects of it, I am more interested in the technical aspects of it. I&amp;#x27;m curious if there is someone with know how about how such a thing would be achieved.&lt;p&gt;Would they base it on exploits? Would they have to require manufacturers to add police APIs on the devices? Would a remotely activated camera &amp;#x2F; microphone &amp;#x2F; location get the active camera &amp;#x2F; microphone &amp;#x2F; location indicator?&lt;p&gt;55 minute edit: 
It seems like for simple stuff, like coarse location they can get it through the carrier; I assumed as much and it&amp;#x27;s relatively easy to get it done. For other stuff, rootkits and exploits are developed by some intelligence agencies which require manufacturing consent or physical interception. Then there&amp;#x27;s also groups that sell OS levels exploits such as the NSO group.&lt;p&gt;I&amp;#x27;m guessing in the case of software exploits, the indicators would appear for camera &amp;#x2F; mic &amp;#x2F; gps. But maybe for hardware exploits they could bypass the circuitry? Seems like a lot of work for non-high-profile targets.&lt;p&gt;Later edit:
Keyword &amp;quot;baseband&amp;quot; seems to be the most likely attack vector&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;apnews.com&amp;#x2F;article&amp;#x2F;france-surveillance-digital-devices-suspects-6018bdb2aee36ef373209555f5ec0019&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;apnews.com&amp;#x2F;article&amp;#x2F;france-surveillance-digital-devic...&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=36779568&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=36779568&lt;/a&gt;</text></story><parent_chain><item><author>musha68k</author><text>Open source &amp;#x2F; homebrew hardware will be the only way out of this.</text></item><item><author>FFP999</author><text>To expand on this, you should assume that basically any significant device or microprocessor you buy comes pre-compromised by one or more intelligence agencies, by the simple expedient of them asking manufacturers to put them in. Devices from US companies will be compromised by Five Eyes agencies, those from Chinese firms will have Ministry of State Security backdoors, etc.</text></item><item><author>runjake</author><text>Software implants (“RATs” or “rootkits”) or baseband access (“backdoors”).&lt;p&gt;The baseband is an embedded computer inside the phone that controls the device’s sensors and radios. It runs off of its own OS and is separate from the consumer-facing OS. The phone’s OS then talks to this embedded system.&lt;p&gt;All phones do this, even the iPhone whose baseband OS was some variant of L4 Linux, IIRC.&lt;p&gt;Various Intelligence Community people and documents have made statements that they can remotely activate the baseband to interact with a target device.</text></item></parent_chain><comment><author>BobaFloutist</author><text>Would it not be easier to find the backdoor and use it to patch itself?&lt;p&gt;Basically rooting the phone but on a firmware level?</text></comment>
<story><title>Ask HN: How would French police locate suspects by tapping their devices?</title><text>I just found a news article regarding a law that passed in France allowing police to remotely activate GPS, camera, microphone on a user&amp;#x27;s device [0]. This was posted before on HN [1], but without traction, but I am not all that much interested in the civil aspects of it, I am more interested in the technical aspects of it. I&amp;#x27;m curious if there is someone with know how about how such a thing would be achieved.&lt;p&gt;Would they base it on exploits? Would they have to require manufacturers to add police APIs on the devices? Would a remotely activated camera &amp;#x2F; microphone &amp;#x2F; location get the active camera &amp;#x2F; microphone &amp;#x2F; location indicator?&lt;p&gt;55 minute edit: 
It seems like for simple stuff, like coarse location they can get it through the carrier; I assumed as much and it&amp;#x27;s relatively easy to get it done. For other stuff, rootkits and exploits are developed by some intelligence agencies which require manufacturing consent or physical interception. Then there&amp;#x27;s also groups that sell OS levels exploits such as the NSO group.&lt;p&gt;I&amp;#x27;m guessing in the case of software exploits, the indicators would appear for camera &amp;#x2F; mic &amp;#x2F; gps. But maybe for hardware exploits they could bypass the circuitry? Seems like a lot of work for non-high-profile targets.&lt;p&gt;Later edit:
Keyword &amp;quot;baseband&amp;quot; seems to be the most likely attack vector&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;apnews.com&amp;#x2F;article&amp;#x2F;france-surveillance-digital-devices-suspects-6018bdb2aee36ef373209555f5ec0019&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;apnews.com&amp;#x2F;article&amp;#x2F;france-surveillance-digital-devic...&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=36779568&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=36779568&lt;/a&gt;</text></story><parent_chain><item><author>musha68k</author><text>Open source &amp;#x2F; homebrew hardware will be the only way out of this.</text></item><item><author>FFP999</author><text>To expand on this, you should assume that basically any significant device or microprocessor you buy comes pre-compromised by one or more intelligence agencies, by the simple expedient of them asking manufacturers to put them in. Devices from US companies will be compromised by Five Eyes agencies, those from Chinese firms will have Ministry of State Security backdoors, etc.</text></item><item><author>runjake</author><text>Software implants (“RATs” or “rootkits”) or baseband access (“backdoors”).&lt;p&gt;The baseband is an embedded computer inside the phone that controls the device’s sensors and radios. It runs off of its own OS and is separate from the consumer-facing OS. The phone’s OS then talks to this embedded system.&lt;p&gt;All phones do this, even the iPhone whose baseband OS was some variant of L4 Linux, IIRC.&lt;p&gt;Various Intelligence Community people and documents have made statements that they can remotely activate the baseband to interact with a target device.</text></item></parent_chain><comment><author>FFP999</author><text>On a technical level, sure. In the bigger picture, I&amp;#x27;m concerned that that is simply too esoteric an interest for it to have any significant impact.</text></comment>