How can the NSA remotely turn on your iPhone?

Question

If the iPhone is actually off and not in sleep mode, how can it be remotely turned on if no software is running and network communications aren't even activated until the device boots?

Answer 1

You make some wrong assumptions : "how can it be remotely turned on if no software is running and network communications aren't even activated until the device boots".

There are two computers in your average smartphone, the one that you more or less control, running e.g iOS or Android, and a second one, the Baseband Processor, handling radio communication with the carrier network. It has its own processor, its own memory, its own operating system and what its exact capabilities are is usually a trade secret. You have no reason to think it is actually off if it actually has access to a DC source, in this age of non removable batteries it should be at all time unless the battery is completely drained. Presumably the NSA got a good relationship with the american makers of such chips (e.g. Qualcomm), with the expected consequences, but they will deny it vehemently. They also possibly planted or found exploit for many chips whose maker are less susceptible to direct influence (e.g. Korean and Chinese ones). Your cellphone (well, the part that you control) is never talking directly to the carrier network, it talks to its baseband processor.

There have been some attempts to reverse engineer some chips, see e.g. Reverse engineering a Qualcomm baseband but you are unlikely to find an obvious backdoor here, more likely a subtle, well hidden vulnerability waiting to be exploited but being plausibly deniable.

WTS, Faraday cage, good price.

Answer 2

Paralleling Bruno's comment ... you have no way of knowing that the phone is actually off, unless you physically take out the battery or attach an oscilloscope to measure draw.

If it is infected with an appropriate malware, the phone could fool you into thinking it is off by turning off the screen and ignoring input (except the power button), while still listening to your microphone or the like.

Answer 3

Because your question is broad, I will answer it broadly.

As with any system, there is never* complete security. For the sake of completeness, I will call the NSA 'hackers' (albeit a form of ethical hacking).

There are so many threat vectors that a hacker can exploit on a modern smartphone. Iphones in general are usually better protected than their brothers (Android, windows, etc phones) because of two main reasons:

1. IOS does a better job at locking down key functions of the phone.
2. Apple has a relatively small market share overall.

For all phones, there is a serious issue of supply chain and third party attacks because so much is delegated and decentralized. For instance, an Iphone (and all Apple products) are assembled in China. China as you may know has been accused of some serious cyber espionage in the past. Huawei for example has been alleged of installing backdoors to phones and pcs (read about it here). However, Hauwei retorts by accusing the NSA of the same (read here). Nevertheless, there is a third concern in these cases as it is possible that either 'spying' side could have been compromised as the NSA claims here. Furthermore, the recent target breach has brought some more awareness to supply chain threats in regards to third party vendors. Learn more about supply chain threats here.

What does this mean for mobile security you ask? Well a lot! When you talk on your phone, you have very little control over the custody of your phones integrity. The manufacturer may have intentionally or unintentionally installed maleware or a backdoor or any manner of things. Additionally, the manufacturer could have been breached themselves and if quality control does not detect the malware, the end user gets a hacked phone.

Additionally, your network provider could be intentionally 'spying' on your data as it's transmitted via their network (or more likely just passively collecting data). Also note that because most every data provider uses shared resources (like cell towers) ATT or Verizon may be able to 'see' your data even if you have a Sprint contract. There are so many threat vectors here but just like the supply chain, it is very possible that an 'honest' mobile carrier could suffer a breach and inadvertently disclose your data.

Now putting all of this together, you can see that hackers have many tools/vectors to operate on. With the resources the NSA has at its disposal, it is possible that they could hack into any* system -even your mobile phone.

Moreover, under various legislation and executive orders, the NSA could conceivably 'legally' request much of this data without having to resort to 'hacking'.

To answer the question of how a phone could be turned on remotely:

As previously mentioned, you -the end user, have very little ultimate control of your phone. With IOS especially, the user has only access to none-vital components and pretty much none of the physical (device level) components such as the kernel (what starts before IOS starts).

What this means is that Apple reserves the right (and has the technology/knowledge) to access these more key areas. With what I mentioned about how the NSA can hack into your phone, it is not that much of a stretch to think a hacker could gain access to these key levels.

A follow up question you might consider looking into may be "How does one adequately protect against sophisticated mobile threats like supply chain attacks".

update Technically speaking, it's not that difficult to turn a device on remotely. There are apps out there that perform what's called "Wake on LAN" functions or conceivably a talented hacker could create a malware version. As far as I know the IOS makes this very difficult, but not impossible.

To clarify, if your device is truly powered off, then there is no physical way for it to receive messages/commands nor can it run internal processes (like a wake timer). However, virtually no modern device ever completely turns off (under normal use) because there is usually at least some small internal power supply to help aid in 'starting'. Further, unless you designed/built your phone and have complete control over its software, there is no way to secure against possible backdoors (malicious or otherwise).

p.s. Do not despair, cyber security is like encountering a bear -you just have to run faster than everyone else and in today's world, there are still people that click on those Nigerian scams if you know what I'm saying ;)