![\"\"](\"https:\/\/world.edu\/wp-content\/uploads\/2024\/01\/security-compromise.png\")
<\/p>\n<\/p>\n
It is quite common to hear about smartphone compromises today: these intrusions allow access to data stored on the phone, or the installation of spyware.\u00a0Today, it is in fact the complexity of smartphones that makes them so vulnerable to intrusions (architecture, operation) and so difficult to completely secure from a technical point of view.<\/p>\n
The\u00a0Pegasus scandal<\/a>\u00a0revealed to the general public in 2021 that telephone intrusions or attacks can be carried out remotely, when they have been used against journalists (from Mediapart in particular) on behalf of foreign governments.\u00a0Even\u00a0Jeff Besos<\/a>\u00a0, the CEO of Amazon, would have been hacked remotely by a simple video sent via WhatsApp messaging.<\/p>\n Conversely, the exploitation of vulnerabilities in secure telephones intended for criminals also allows law enforcement to dismantle major criminal networks \u2013 this is the case, for example, in\u00a0the EncroChat affair<\/a>\u00a0, the trials of which are currently underway. course.<\/p>\n These examples illustrate the ongoing tension between the need to access protected data for investigations carried out to protect citizens, and the need to protect citizens against abuse of this access.\u00a0So, should we make phones as secure as possible from a technical point of view, or on the contrary create \u201cback doors\u201d for the police and intelligence services?<\/p>\n In France, the criminal procedure code and the internal security code respectively authorize the judicial police services and the intelligence services to capture computer data, that is to say to recover information as it appears on a person’s screen (or on external devices), without them being informed.<\/p>\n Since the\u00a0law of March 23, 2019 on programming for 2018-2022 and reform for justice<\/a>\u00a0, it is even possible to use State means subject to national defense secrecy in order to record, preserve or transmit the data as stored in a computer system.\u00a0Added to this is the possibility for the State to commission experts \u2013 in this case specialized private companies \u2013 in order to penetrate said systems.<\/p>\n In 2023, the Government once again attempted to increase the resources available to the police forces by inserting into the\u00a0draft orientation and programming law of the Ministry of Justice 2023-2027<\/a>\u00a0a provision relating to the activation remotely electronic devices without the knowledge of their owner or possessor in order to locate them in real time, activate the microphone or camera and recover recordings.<\/p>\n This very\u00a0controversial<\/a>\u00a0provision was partly censored by the Constitutional Council on November 16, 2023. It considered that the remote activation of the microphone or camera of an electronic device constitutes a disproportionate attack on the right to respect for privacy, in particular because it allows\u00a0third parties to be listened to or filmed who have no connection with the current case<\/a>\u00a0.<\/p>\n Only the possibility of geolocating a person in real time through the remote activation of their telephone or any other computer device such as vehicle dashboards has been declared to be in conformity with the Constitution.<\/p>\n Regardless of the legality of such an action, one can technically penetrate a smartphone by exploiting its “vulnerabilities”, that is, by using\u00a0existing flaws at the hardware or software level<\/a>\u00a0.<\/p>\n The exploitation of vulnerabilities is today protean, as the intrusions are multiple and concern several levels.\u00a0Attacks can be carried out remotely, across the network, or directly on the phone if it is physically accessible, for example a phone seized during a search.\u00a0In this case, attackers use, for example, a\u00a0\u201cside channel attack\u201d<\/a>\u00a0(the power consumption of a phone can in particular reveal information);\u00a0create artificial errors (by\u00a0\u201cfault injection\u201d<\/a>\u00a0), or physically attack smart cards or microprocessors.\u00a0These attacks make it possible to recover the encryption keys which allow access to the user’s data stored on the phone.\u00a0This was the subject, for example, of the European project\u00a0EXFILES<\/a>\u00a0.<\/p>\n If we progress through the\u00a0layers of the phone<\/a>\u00a0, it is possible to exploit the flaws in the phone’s operating systems (their bugs, in other words).\u00a0The more complex and functional a system is, the more difficult it is to secure it, or even to\u00a0define the expected security properties<\/a>\u00a0.<\/p>\n Furthermore, in most cases, an attack alone is not enough to break into the target phone, which is why a\u00a0modern exploit<\/a>\u00a0combines many\u00a0vulnerabilities and techniques to circumvent the present countermeasures<\/a>\u00a0.<\/p>\n Finally, intrusions can target applications installed on the smartphone or communication protocols.\u00a0In this case, critical phases of application use are targeted: such as key negotiation, device pairing or even over-the-air firmware<\/em>\u00a0updates\u00a0.\u00a0For example, in 2019, Google’s “Project Zero”<\/a>\u00a0team\u00a0discovered\u00a0remotely exploitable vulnerabilities on iPhones<\/a>\u00a0(even though they are known for their good level of security), which made it possible to take control of the phone with a simple SMS.<\/p>\n Like this team, many researchers and manufacturers discover and report vulnerabilities simply to have them fixed.\u00a0On the other hand, other companies profit by creating \u201cexploits\u201d \u2013 sets of complex vulnerabilities and techniques, which allow phones to be exploited against their users and are sold to the highest bidder \u2013 including States \u2013 for sums of up to\u00a0several million Euros<\/a>\u00a0.<\/p>\n In 10 years, the level of security has evolved considerably.\u00a0Private operators are increasing technical measures to ensure an increasingly high level of security, with new\u00a0programming languages<\/a>\u00a0\u200b\u200bfor example, or high-level security modes, such as the\u00a0\u201clockdown\u201d mode on iPhones.<\/a>\u00a0, which disable many features, and therefore reduce the\u00a0\u201cattack surface\u201d<\/a>\u00a0.<\/p>\n However, it is impossible to offer complex and 100% secure systems, particularly because the human factor will always exist.\u00a0In some cases, the phone can be compromised in a way that is completely transparent to the user, this is a \u201czero click\u201d attack.\u00a0In others, user intervention is still required: clicking on a link or opening an attachment is considered a \u201cone-click\u201d attack.\u00a0In any case,\u00a0trickery , physical, psychological or <\/a>legal<\/a>\u00a0coercion\u00a0often remains an effective and rapid means of accessing data.<\/p>\n Human weaknesses sometimes represent the weakest link that is easiest to exploit in a cyberattack. xkcd , CC BY-NC<\/p><\/div>\n The increasing difficulties in penetrating smartphones are pushing the police services, notably through the voice of their\u00a0minister<\/a>\u00a0in October 2023, to regularly request the establishment of \u201cbackdoors\u201d\u00a0which<\/a>\u00a0allow privileged access to telephones.<\/p>\n Thus, in the 1990s, the NSA wanted to impose on telecommunications manufacturers and operators an encryption chip, the\u00a0\u201cClipper Chip\u201d<\/a>\u00a0, which included such a back door allowing intelligence services to decrypt communications.<\/p>\n In the same vein, police forces sometimes contact manufacturers to give them access to equipment, which causes tensions with private operators.\u00a0In 2019,\u00a0Apple denied such access to the FBI<\/a>\u00a0, which ended up using a hardware attack on the phone in question.<\/p>\n More recently, in November 2023, many researchers opposed an article in the European eIDAS regulation that would force browsers to\u00a0include certificates imposed by<\/a>\u00a0European governments.\u00a0Such certificates would make it possible to intercept secure communications (HTTPS) of citizens, without browser publishers being able to revoke these certificates if they were used improperly.<\/p>\n We believe that reducing system security by introducing backdoors harms everyone’s security.\u00a0On the contrary, increasing smartphone security protects citizens, especially in countries where individual freedoms are contested.<\/p>\n If\u00a0mass surveillance<\/a>\u00a0and the insertion of\u00a0backdoors<\/a>\u00a0into products are a danger to democracy, would exploiting existing vulnerabilities be a more \u201cdemocratic\u201d way of collecting information for judicial purposes?\u00a0Indeed, these techniques are necessarily more targeted, their cost high… and if these flaws are massively exploited they are quickly detected and corrected.\u00a0With the constant increase in phone security, how long will this be economically feasible for police and judicial services?<\/p>\n Indeed, although the elimination of all vulnerabilities is undoubtedly illusory, is the cost of their discovery and exploitation\u00a0becoming exorbitant<\/a>\u00a0or will the evolution of\u00a0vulnerability discovery techniques make it possible to reduce their cost<\/a>\u00a0\u00a0?<\/p>\nWho has \u2013 and will \u2013 have the right to penetrate smartphones?<\/strong><\/h4>\n
How are intrusions technically possible?<\/strong><\/h4>\n
Should we provide more security or, on the contrary, create \u201cback doors\u201d?<\/strong><\/h4>\n
![\"\"](\"https:\/\/world.edu\/wp-content\/uploads\/2024\/01\/cryptonerd.jpg\")