{"id":31944,"date":"2019-10-31T21:44:09","date_gmt":"2019-10-31T18:44:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kogda-shifrovanie-ne-pomozhet-rasskazyvaem-pro-fizicheskij-dostup-k-ustrojstvu\/"},"modified":"2019-10-31T21:44:09","modified_gmt":"2019-10-31T18:44:09","slug":"kogda-shifrovanie-ne-pomozhet-rasskazyvaem-pro-fizicheskij-dostup-k-ustrojstvu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/kogda-shifrovanie-ne-pomozhet-rasskazyvaem-pro-fizicheskij-dostup-k-ustrojstvu","title":{"rendered":"When encryption isn\u2019t enough: we discuss physical access to the device","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In February, we published an article titled 'Not Just a VPN. A Guide on How to Safeguard Yourself and Your Data.' One of the comments<\/a><\/noindex> prompted us to write a follow-up article. This part is a fully autonomous source of information, but we still recommend reading both posts.<\/p>\n

The new post focuses on the security of data (messaging, photos, videos, and all that) in messaging apps and the devices used to work with those apps.<\/a><\/noindex><\/p>\n

Messaging Apps<\/h3>\n

\n Telegram<\/b><\/p>\n

Back in October 2018, Wake Technical Community College freshman Nathaniel Sachi discovered that the messaging app Telegram stores messages and media files on the local hard drive of computers in plain text.<\/p>\n

The student was able to access his own messages, including text and images. He examined the application's databases stored on the HDD. It turned out that the data was hard to read but not encrypted. Access could be gained even if the user had set a password for the app.<\/p>\n

The retrieved data contained the names and phone numbers of contacts that could be correlated if desired. Information from private chats is also stored in plain text.<\/p>\n

Later, Durov claimed that this is not a problem, as if a malicious actor has access to a user's PC, they can obtain encryption keys and decode all messages without issues. However, many information security specialists argue that this is indeed serious.<\/p>\n

\r\n \"Play\r\n
<\/div>\r\n <\/div><\/center>
\nAdditionally, Telegram was found to be vulnerable to key-stealing attacks, which discovered<\/noindex> a user on Habr noted. It is possible to crack local password codes of any length and complexity.<\/p>\n

WhatsApp<\/b><\/p>\n

As far as we know, this messaging app also stores data on the user's computer in an unencrypted format. Thus, if a malicious actor has access to the user's device, all data is also exposed.<\/p>\n

But there is a more global problem. Currently, all backups from WhatsApp installed on Android OS devices are stored on Google Drive, as Google and Facebook agreed last year. However, backups of messages, media files, and so on are stored in plain text.<\/a><\/noindex>It seems that personnel from law enforcement agencies in the USA have access to Google Drive<\/a><\/noindex>, so there is a possibility that they can view any stored data.<\/p>\n

Data can be encrypted, but neither company does this. Perhaps simply because unencrypted backups can be easily transferred and used by users themselves. Most likely, the lack of encryption is not due to technical difficulties in implementation: on the contrary, protecting backups can be done without any effort. The problem is that Google has its own reasons to work with WhatsApp \u2014 the company is presumably analyzing the data stored on Google Drive servers<\/a><\/noindex> and using it to display personalized ads. If Facebook suddenly introduced encryption for WhatsApp backups, Google would immediately lose interest in such a partnership, losing a valuable source of data on WhatsApp users' preferences. This is, of course, merely a speculation, but quite plausible in the world of hi-tech marketing. <\/p>\n

As for WhatsApp for iOS, backups are saved in iCloud. But even here, information is stored in an unencrypted form, as mentioned in the app's settings. Whether Apple analyzes this data is known only to the corporation itself. However, the Cupertino company does not have an advertising network like Google, so we can assume that the likelihood of them analyzing the personal data of WhatsApp users is significantly lower. <\/p>\n

Everything said can be summarized as follows \u2014 yes, your WhatsApp correspondence is accessible not only to you.<\/p>\n

TikTok and other messengers<\/b><\/p>\n

This short video exchange service could have quickly become popular. The developers promised to ensure full data security for their users. It turned out that the service used this data without notifying users. Worse, the service collected personal data from children under 13 without parental consent. Personal information of minors \u2014 names, emails, phone numbers, photos, and videos were left exposed.<\/p>\n

The service was fined<\/a><\/noindex> millions of dollars, and regulators also demanded the removal of all videos made by children under 13. TikTok complied. Nevertheless, other messengers and services use personal data for their own purposes, so one cannot be sure of their security.<\/p>\n

This list can go on indefinitely \u2014 most messengers have some vulnerability that allows intruders to eavesdrop on users.a great example<\/a><\/noindex> \u2014 Viber, although it seems to have all been fixed) or steal their data. Moreover, almost all top 5 applications store user data in an unprotected manner on the hard drive of the computer or in the phone's memory. And that's not to mention various countries' intelligence services, which may have access to user data due to legislation. The same Skype, VKontakte, TamTam, and others provide any information about any user upon request from authorities (for example, in the Russian Federation).<\/p>\n

Good protection at the protocol level? No problem, we break the device<\/h3>\n

\nA few years ago a conflict erupted<\/a><\/noindex> between Apple and the U.S. government. The corporation refused to unlock an encrypted smartphone that was involved in the case of terrorist attacks in San Bernardino. At that time, it seemed like a real problem: the data was well protected, and hacking the smartphone was either impossible or very difficult.<\/p>\n

Now the situation is different. For instance, the Israeli company Cellebrite sells a software-hardware complex to legal entities in Russia and other countries that allows them to hack all models of iPhone and Android. Last year, a advertisement brochure was published<\/a><\/noindex> with relatively detailed information on this topic.<\/p>\n

\"When
\nMagadan investigator Popov hacks smartphones using the same technology as the U.S. Federal Bureau of Investigation. Source: BBC<\/i><\/p>\n

The device is relatively inexpensive by state standards. The Volgograd department of the Investigative Committee of Russia paid 800,000 rubles for the UFED Touch2, while Khabarovsk paid 1.2 million rubles. In 2017, Alexander Bastrykin, head of the Investigative Committee of Russia, confirmed that his agency uses solutions<\/noindex> from the Israeli company. <\/p>\n

Such devices are also purchased by Sberbank \u2014 although not for conducting investigations, but for fighting viruses on devices running Android OS. \"In case of suspicion of mobile devices being infected with unknown malicious code, and after obtaining mandatory consent from the owners of the infected phones, analysis will be conducted to detect continually emerging and evolving new viruses using various tools, including the use of UFED Touch2,\" \u2014 was announced<\/a><\/noindex> in the company.<\/p>\n

Americans also have technologies that allow them to hack any smartphones. Grayshift claims it can hack 300 smartphones for $15,000 (that's $50 per unit compared to $1,500 with Cellbrite).<\/p>\n

It's quite possible that similar devices exist among cybercriminals. These devices are constantly being improved \u2014 their size is decreasing, and their performance is increasing.<\/p>\n

Right now, we are talking about relatively well-known phones from major manufacturers that are concerned about protecting their users' data. However, when it comes to smaller companies or no-name organizations, data can be extracted without any issues. The HS-USB mode works even when the bootloader is locked. Service modes are typically a 'backdoor' through which data can be extracted. If not, one can connect to a JTAG port or even extract the eMMC chip and insert it into a cheap adapter. If the data is not encrypted, everything can be extracted from the phone. You can pull out<\/a><\/noindex> everything, including authentication tokens that provide access to cloud storage and other services.<\/p>\n

If someone has personal access to a smartphone with important information, it can be hacked if desired, regardless of what manufacturers might say.<\/p>\n

It's clear that all of this also applies to computers and laptops running various operating systems. If advanced protective measures are not taken, and one relies on basic methods like a username and password, the data remains at risk. An experienced hacker with physical access to the device can obtain virtually any information \u2014 it's just a matter of time.<\/p>\n

So, what should you do?<\/h3>\n

\nThe topic of data security on personal devices has been discussed multiple times on Habr, so we won't reinvent the wheel. We will only mention the main methods that reduce the likelihood of unauthorized access to your data:<\/p>\n