What if it doesn't work? on chances I don't take (kabcoder.substack.com)

I'm sure we have cybersecurity experts, security researchers, and Infosec pros here at HN. What do you recommend to keep your phone, especially an iPhone, hardened as a brick? Came across the following article, although a bit dated, which suggests not using FaceTime and iMessage. But in another search, I found iMessage is more secure than just plain old SMS/Text. I'm more worried about zero-click exploits.

https://usa.kaspersky.com/blog/how-to-protect-from-pegasus-spyware/26103/

Just a thought - would having a firewall[0] on your phone to block any incoming request or quarantine it for review will work? A response to a user-initiated request is different than an independent request coming to your phone. A clarification to avoid mixing both.

Also, a traffic monitor[1] to watch excessive outgoing traffic or excessive hard drive reads to detect if you are compromised.

I've also been thinking about developing a custom Secure Vault app, more like an isolated Sandbox; I'll share more details about it if I think I can pull it off. Any pointers, books, articles, or videos are greatly appreciated.

Security is a fascinating topic; Let's discuss.

[0] : https://apps.apple.com/us/app/guardian-firewall-vpn/id1363796315

[1]: https://apps.apple.com/us/app/traffic-monitor-with-widget/id482570191

[2]: https://www.youtube.com/watch?v=1p0Xm-Opzjg (Catching NSO Group's Pegasus spyware)

[3]: https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf

[4]: https://www.reuters.com/technology/cybersecurity/governments-spying-apple-google-users-through-push-notifications-us-senator-2023-12-06/

Comments (10)

runjake · 6h ago

This guide for iPhone and Android is a good start. Not all their recommendations are obvious.

https://www.cisa.gov/sites/default/files/2024-12/guidance-mo...

For a deeper guide, check out the CISecurity benchmarks for your smartphone. They go a bit deeper. But the CISA guide will get you most of the way there.

https://www.cisecurity.org/cis-benchmarks

k310 · 5h ago

How about this idea?

Since a great deal of mobile usage is at home, how about a firewall of the home network as an 80/20 kind of solution? (YMMV) You might include a VPN.

This does not help away from home.

I have asked friends to use Signal for its many features, but I'm in low-tech company lately. They need a kick. Signal might address your messaging needs, and TBH, is better than imessage or FaceTime in mixed company. "Green people". Mainly because it is entirely crosds-platform.

mandeepj · 5h ago

Can you please expand on 80/20 rule? 20% of traffic on mobile device or 20% might be suspicious?

I believe Signal is compromised! There are many such articles online https://www.truesec.com/hub/blog/russian-intelligence-compro...

necovek · 4h ago

They suggest you might be at home 80% of the time, thus firewall on the home network would protect during that time.

k310 · 3h ago

That was my intent. Simply that you might be protected 80% of the time, if you spend 80% of your usage at home, and of course, YMMV.

But the 80/20 rule as written about is quite different. Simplified, it states that some 20% of effort or cases can give 80% of the results, whereas the other 20% can take 80% of your time/effort to nail.

Please query Signal about any security concerns. There was a clone of it being used by government officials that had flaws.

2rsf · 3h ago

Who and what are you trying to protect from? ICE/NSA will hack your phone, and all you can do as an amateur is to make their life harder (and raise their suspicion even more)

reify · 31m ago

I alway found that dipping it in some araldite epoxy resin works great

Basically, squeeze both tubes, part A and part B, into a bowl, mix well.

lay your phone on a flat surface and pour the mixed araldite over the phone.

smooth and level the araldite with a plastic tool.

let dry.

sorted!

max_ · 3h ago

At the bare minimum, ditch the iPhone.

Get a pixel

Install grapheneOS

mandeepj · 3h ago

Ordered a Pixel 10 pro XL a couple days ago :-)

You believe GrapheneOS is more secure than Android?

max_ · 2h ago

Stock Android & iOS are literally spyware.

GrapheneOS is very private.