How Hard is It to Hack a Phone? Understanding Its Protection Features

[@jmr]

Agree with Rob 100%. I need physical access to hack a phone and even then I have to get lucky. It has to be one of the phones with known vulnerabilities and it has to be behind on security patches.

[@terrydaktyllus1320]

He never said that. There is plenty of malware on the Android Store that can act as a trojan horse to allow your data to potentially be accessed. Not all cyber-attacks are because someone starts attacking you. A piece of malware you install can signal to a command and control server that your phone is available to be exploited, at which point further software can be deployed to get more data from your phone. Most attacks are automated, it's not worth a human wasting time attacking systems unless the target is a well known person or a big corporation from which they can get a lot of kudos in their community.

[@Corteum]

Doesn't it depend on how capable you are as a hacker? The more capable you are, the more you're able to do? Imagine a Super AGI having all the worlds knowledge on hacking and what it could do with that knowledge.

[@jmr]

​​@@Corteum Sure but Rob covered nation state actors. Realistically they are the only ones that have access to a remote exploit. It can take an entire team to find that type of exploit these days. Even then if one other person or group finds it and turns it in the exploit will get patched. If the exploit gets used and someone finds out it gets patched.

[@Corteum]

@@jmr "Realistically they are the only ones that have access to a remote exploit." For now...... But AGI within 3 years. Super AGI within 5 years. It will find all of the holes and exploits in the state's computer systems. Hard to see how they (the inferior intelligence) will be able to defend against it.

[@Corteum]

@@jmr Post-AGI, it wont be just state actors that have the greatest access to, or the ability to create and distribute remote exploits. AGI/SAGI will be able to do a much better job of it than any state actors.

[@linsqopiring6816]

For some people a video like this might be a bit on the technical side but myself I love it when you really get into the nitty gritty and explain the terms. This is my favorite kind of video on your channel! But it's also great that you mix it up. What I've always wondered about and I'm praying you can answer now is how you can have any kind of serious encryption that's based on a pin code that I presume is four digits? You ALWAYS hear security people talking about the importance of long random passwords. Shouldn't it take them about one micro second to crack that by brute force? I feel like I'm missing a big part of the puzzle here and am hoping you can fill me in. Thanks Rob.

[@robbraxmantech]

I'm getting mixed results on the more detailed videos. Sometimes it performs extremely well and sometimes the more simplified videos do better. I can't predict. Maybe it's my titles and thumbnails

[@linsqopiring6816]

Ok I will just give my theory for what this might be. That the OS rate limits login attempts and will lock up if an unusually high number is reached. Is that right? But what I still wonder about that is why couldn't they just make an image of the whole thing for unlimited attempts?

[@robbraxmantech]

The pin code is stored in the secure enclave. Not something you can access externally. It is not accessible via "flashing". So it is not possible to back it up

[@linsqopiring6816]

@@robbraxmantech Thanks for that answer. I'd still like to understand it a bit better though. Whatever SDD or firmware a smartphone uses to store data I don't get why they couldn't just rip that out of the phone and put it into a specially made forensic enclosure to read its data. For example they can do that with your PC ram if you have a fully on the fly encrypted drive. They can pull the ram out and put it into their tool and see what was in the computer's volatile memory before it was turned off. With such advanced techniques for PC's I really don't get why they can't do something similar with smartphones especially considering their dominance these days. Why can't they rip out the hardware where the secure enclave is stored with the phone off, put it into an enclosure and image it?

[@robbraxmantech]

I don't think I've actually gone in super detail on the Secure Enclave. There's a hack for it as well but extremely risky. You could lose the data you're trying to capture. But at least the proof of concept showed it can be done (by accessing RAM)

[@ReefGeoscience]

Great video Rob. You really are providing a public service for users. Any chance you could do one for the Linux desktop: security, vulnerabilities etc?

[@TheJackiMonster]

Would be neat to have permission control as with SELinux on the desktop implemented properly. That could help GNU/Linux based phones as well.

[@Ruzhyn_Ukraine]

Now, tell us how Temu found 30 holes in the security layers and penetrated them in unrooted phones

[@Corteum]

Is that real?

[@dangercat5844]

Thanks Rob. Does MacOS run apps in VM if installed from Mac App Store, so more secure?

[@TonyAhmedSingh-ih7ix]

Pegasus self opens via an SMS and they then have full control.

[@themetalprincess]

Law enforcement can gain access easily to your phone once it has physical access. Even though they would not call it "hacking" the user likely would. So the common belief that because your phone is password protected and cannot be accessed or hacked is not true. It is very vulnerable with physical access, unless it is physically encrypted via hardcore 3rd party encryption. Braxman is by far the most knowledgable tech guy I have seen to date so I was surprised to hear him praise cell phone security. Im a computer tech myself of 27 years, and Braxmans knowledge dwarfs my own, but your average cell phone is not unhackable. The average law enforcement data forensics lab can gain access to your data in less than 30 minutes.

[@jawilz6043]

very true

[@Jerry-o3p]

Ahh. Stingray. And it's not just their unconstitutional wireless tapping Fourth Amendment constitutional undemocratic powers if we didn't have degoogled smartphones,am I right? Degoogled smartphones are a great way to ensure that we have privacy while on the internet,but it's not bulletproof.

[@utube7917]

Can you comment on the quick charge phone charger product that is supposed to stop planned obsolescence? I do believe that phone companies give mandatory bogus updates that degrade the phones, so that you have to buy a new one sooner. This product claims to stop those degrading updates, but does it actually work? It says it was featured on many mainstream news outlets and there is a legal battle going on behind the scenes. In my opinion, if you buy a product, the company has no right to degrade your product through mandatory updates after purchase. Can you imagine if your car dealer was in your driveway at 5am removing your vehicles exhaust system and putting pvc pipe on instead? You buy these products as is, not as they will be with the secret planned mandatory downgrades that are beyond your control, disguised as "updates."

[@jmr]

What you described is not a legitimate product. The way you charge your phone has nothing to do with software updates. There is a product that has Bluetooth and it monitors your phone charge state and prevents certain types of overcharging.

[@utube7917]

@jmr right, charging is not rela5ed to updates, but that product claims to have software loaded onto the adapter, which is supposed to download to your phone when plugged in and claims to disable the preloaded software / updates for planned obsolescence. I know its possible, it could have software loaded on anything that plugs into your phone by USB, whether it charges or not, which is a common way computers get attacked when someone unsuspectedly plugs a USB into their computer or a work computer.

[@jmr]

@@utube7917 Listen to Rob's hacking phone talk again. They can't override the underlying operating system. That thing is a hoax.

[@utube7917]

@@jmr thank you, haven't heard that episode yet

[@jmr]

@@utube7917 I'm referring to this video you're commenting on. It explains how hard it is to hack a phone. selinux is very secure.

[@FunBotan]

Zero-days may not be a threat for the common folk as long as they use an updated OS on the device. However, a lot of devices are still being used long after their support is dropped by the manufacturer, and for those users, the risk of zero-day-based attacks is no longer negligible.

[@kentallard1881]

You are more right then you know.

[@thekeysman6760]

​@@kentallard1881"than" you know. 👍

[@kentallard1881]

@@thekeysman6760 Then,Than,Thanks for pointing that out,Now please,Eat shit?

[@DarkMetaOFFICIAL]

yah 0days are patched constantly. i have someone telling me phones are so easy to hack, they delete their social medias and think phone service is identical to isp. because they were tricked to thinking they were hacked. smh

[@DarkMetaOFFICIAL]

@@kentallard1881 *than 😂❤️

[@DaddyElfMan]

NO CLICK required, for pegasus, it merely (as far as reports go), needs to be 'SENT' to ones phone, basically, self activating.. .. scary.

[@randsp3c709]

Who uses this stuff ,law enforcement?

[@lyfandeth]

Rob, can you explain what Samsung Knox will do to a phone? Make some things impossible, or just provide an extra security layer? Downsides?

[@robbraxmantech]

It's an ANTIVIRUS. LOL. I had to research that. :)

[@NorthernChimp]

I never activated it, mainly because the TOS are 3km long and only in German (on my phone brought in France), and selecting is disabled when I view them, so I can't use any translating software.

[@peterkoch3777]

This is snake oil! Avoid like the plague 🤔

[@NorthernCorruptionMonitor907]

They just applied for a warrant to get past my PIN code lock easy peazy rights violated

[@BearBig70]

Where do you live? Commiefornia?

[@neoliberalerneandertaler9347]

​@@BearBig70your a good example how important good education is.and how capitalism destroy human civilisation.ty

[@terrydaktyllus1320]

...and a dinosaur just stood on the roof of my Rolls Royce car and dented it. So what? You could be anyone making up any kind of sh1t, just like me above. Maybe you're just paranoid and just THINK they are out to get you.

[@terrydaktyllus1320]

@@BearBig70 Never-Never-Land by the sounds of it - with Goldilocks and Chewbacca.

[@Roadyheid]

They can force you to hand over your phone, with a warrant, but they can't force you to give them your PIN. Some places, they can force you yo provide your biometrics (face, fingerprint), if that's how your phone is locked, but they can't make you hand over a PIN code. Use a PIN.

[@krollpeter]

Usually I root for the purpose of removing the spam that comes with almost every phone. Often these are apps that harmful themselves, such as by Facebook, shopping apps, or things that try to remote-control me from Google. Therefore, I also like installing firmware that does not use Google services.

[@terrydaktyllus1320]

Then you are very foolish and haven't a clue about how phone security works. You need to watch this video properly. If you don't want spam on your phone, de-Google it with a custom ROM - you don't even need root for that.

[@niveZz-]

​@@terrydaktyllus1320you do need to unlock your bootloader tho I gave the same advice to many people but it's not as easy to do and there are many downsides

[@krollpeter]

@@terrydaktyllus1320 I would not call trying to solve an issue foolish, and I watched the video. There is a lot more "spam" on the phone than displayed as icons on the screen. And also, nowadays most custom ROMs come with Foogle. Mine not.

[@NorthernChimp]

It seems that there is a proper way to root a device, that is reversible. I think Terry is right in principle, but if you need an "official" phone for a reason, maybe this could be a middle ground, locking it back after cleaning it up?

[@krollpeter]

@@NorthernChimp If you de-install Magisk the phone will be automatically unrooted. My recovery can uninstall Magisk. Some banking software and other can still detect that the phone was once rootet. Here in Singapore many government office functions are done via Android or Iphone apps. Most of these refuse to even open on rooted and now un-rooted devices. I personally scan through the content inside the app file of every single app I install, and remove all references to Facebook, Amazon, Google as far as possible, Yandex and other known trackers. My Google dashboard is absolutely empty, since 2013. The Aurora app store displays the trackers each app has. It is not 100 % but a starting point. What we see with our eyes on screen is only a fraction of the actual spyware and tracking. One day I had in 24 h 700 trackers trying to get into my phone, all at my bandwidth and my cost.

[@Bibvock]

Its horrible that we live in a time where people must buy and sell freedom. At the end of the day, i think it'd be even more suspect in the mind of the powers that be, if a citizen is purchasing freedom. A mind would possibly conclude that something important or detrimental may be being concealed. Idk. Its all crazy times🤯 great vid...(couldnt understand it all cause im not so great with tech) but great vid!

[@ssdjaja1]

Hi Rob, what do you think about Sirin Solarin phone? Is it really unhackable?

[@harryvendryes]

What about the security of a Linux desktop computer, that only receives its Internet from the internal SIM of a router (i.e. no landline)? Using a Turris Omnia (with just a SIM) would be a good example of this.

[@girl4632]

What about already the known vulnerability in Android and other applications they could be exploited

[@latetotheparty7551]

Much appreciated series of explanations. I'll definitely have to re-watch it a bit to more fully understand but appreciate the information!

[@WarpedSpeed]

the "security" they continue to push and update etc on phones is not to help the end user, is to ensure that the built in spyware can not be removed.

[@keenanforytube]

My BraxOS was hacked. How would I do a dump to forensic the data?

[@garypaulson5202]

Excellent video, very informative

[@kechekkk]

Malicious links to websites containing javascript that can access android phone location,camera and mic..there are youtube videos demonstrating this on an android phone..it’s still a form of social engineering..but a valid example

[@robyee3325]

You no longer have to be an important person to be targeted by the government. The more people they put on the watchlist the more funding they get. They are incentivized to put you on the list!

[@مقاطعمترجمة-ش8ث]

BTW both Linux SElinux and FreeBSD jail, does provide mobile phone's level of protection, but you have to configure it yourself. 3:08 Java not the only language supported by the apps, but you can build .so library and load it from java

[@devinavant9086]

I have cops that hacked my phone so they can screw with me. Can you help me find the app they installed on my phone.

[@jawilz6043]

They dont need to install an app. Once they have ur simcard number, model number of phone or phone number they can access your phone n monitor everything ur doing on it, n also see all contents u have on it.

[@id104335409]

Just last week I watched a bluetooth hack that is just recently discovered and patched - leaving billions of devices still exploitable since they dont receive updates like PC. The hack only requires that you leave your bluetooth on and the hacker is in range. He can install anything on your phone while its in your pocket. No need of confirmation of connection.

[@manomyth11]

🤔How come you do your videos from an RV? 😁

[@TonyAhmedSingh-ih7ix]

I was hoping to speak with you via the app but it says it's only for older devices. I have a serious issue with Private Detective's sending phone hacking software via SMS, forcing hate messages into my social media, stealing money out of my bank accounts via PayPal purchase's and so much more. I need help.

[@robyee3325]

The sheriff’s office working with Feds to violate your rights. Get ready for new world order

[@peregrinemccauley5010]

Left my phone in the sun by the pool . It's rooted .

[@worldwide.psychoterror]

Hello, my gmx mail account has been hacked. Can you help?

[@christinewoodland5127]

What about adds I have seen about gaining access to “ your children’s phone, to keep them safe “ ( of course) “ text, email, social media, photos, camera, microphone, internet “. “All you need is their number, you don’t need physical access to the phone “ for a monthly fee. I’ve never tried it, so no idea if it actually works .

[@oodles86]

We have to create a login just to browse your store?

[@katehillier1027]

KZbin not letting me subscribe. Previous subscriber.

[@user-ze1bg2dz1s]

What about packet captures?

[@C_note773]

I always wondered how secure the Google Titian security chip is

[@randsp3c709]

What can i do if it has been hacked. Like someone is accessing the mic , and knows texts and location

[@girl4632]

Wht about already installed app by phone maker the bloatware and unnecessary apps with unnecessary permission. In my phone I used adv to remove them and phone maker has kept restrictions on tht too now my settings not open and adb isn't able to access shell

[@POPMOGOMAX-go7mx]

Paying cash for your computer and getting a paper reset help with privacy.

[@aranramirez1772]

Useful information. Thanks

[@teresajackson5859]

I know that all my working phones has been hacked by corrupt cops. I am on constant surveillance even though I am 64 years old and am not a criminal or ever has been. I know they did something to my phones because my new phone battery runs out quickly and I'm always getting a notification that I need to clean my phone. They watch me and listen to my phone calls read all my messages my email messages as well and so much other like interrupt my wifi signal when nobody else is around. they can see everything I do on it including they know all my passwords. I cannot disable the camera their technology they had access to is so advanced that nothing I have been able to do has worked so far not to mention I know very little about codes. What can I do

[@linsqopiring6816]

Sometimes the simplest explanation is the correct one. Could be your phone is just broken. I'd get a new one and see if it happens again. A brax phone will protect you from many types of spying. But no phone is 100% secure so best not to put anything sensitive on it.

[@robbraxmantech]

My friend, perhaps we have conversed before. But just to make it clear, your actual threats are EXTERNAL to the phone. Cops have access to you via CALEA systems. They don't even have to touch your phone. So I'm not countering your fear of a threat, but likely it is not inside your phone. Cops can also do Stingray and other surveillance but all external to the phone itself. Physical manifestations on the phone are not likely hacks because if I hack your phone, you're not going to know it.

[@LynyrdSkynyrd.4Ever]

You should get rid of your smart phone and go back to a simple flip phone that it's main purpose is making phone calls. No Internet access, no data on it, and not worth the effort to hack. It sounds like you have a virus infestation of some kind, which is another problem you won't have with a flip phone

[@NorthernChimp]

If while browsing you see a notification telling you that you need to clear your phone, it does not come from your phone but from the website. If you click on it, that's when malware is installed. Just leave the rogue site forever. If you ever once agreed to "clean your phone", I'm afraid that's where all that comes from.

[@robyee3325]

@@LynyrdSkynyrd.4Everold flip phones are the least secure because they operate on 2g/3g. With the move to 4g/5g most flip phones are just as vulnerable as smart phones anyway. Only difference is they don’t have wifi. Sheriffs office is working with Feds to hack your phone through cell network

[@donquihote6023]

How about a text message from someone you know?

[@elainec2577]

How about someone that accesses your speaker ??

[@Zephyr9521]

Rob Braxman, which smartphone brand has the most privacy? I have a Samsung Smartphone and when I try to remove a permission from an app, for example the app: "Google Play Services", this message appears: "Device requires this permission to operate" and I can't remove it, this also happens in other apps, Samsung apps require a lot of permissions, sometimes unnecessary, my Smartphone Discharges very fast, I suspect that it is being tracked by Big Techs and other companies, but what do you think about all this?

[@robbraxmantech]

You have no ability to restrict Google code

[@robbraxmantech]

The only privacy choice for the typical consumer is a de-Googled phone

[@Zephyr9521]

What is a de-Googled phone? A regular cell phone that you install an operating system free of Google code?

[@chazzlidell1492]

@ I do, because I spend hours looking for exploits and found rwo in 48 hours. Not bad MR Braxman.

[@lyfandeth]

Samsung has "baked" these applications into the phone for their own profit, and there's no way for the common user to remove them. When Rob suggests one of the few available deGoogled phones, that's the only reliable way--and even then there's collateral damage.

[@jesss539]

@robbraxmantech a question regarding backing up and phone wipe. If someone managed to corrupt the device, if you back up before wiping the device would the rogue software be also backed up and reinstated afterwards?

[@c.s.963]

Hello👋 so I seen on TikTok where people was putting a certain code into their phone to see if they had been hacked. As though someone was listening in on our phone calls. Was just wanting to know how true it is😳🤔

[@robyee3325]

That is simply to see if your call forwarding is enabled. Won’t tell you if you are hacked or not

[@stevebarnes8976]

Rob can a chrome back be hacked...?

[@etziowingeler3173]

great work, love this channel

[@katehillier1027]

KZbin seems to have unsubscribed me from numerous channels.

[@mlevif]

Is there any Linux version that supports this? I don't think SELinux does, does it?

[@fipfip3331]

What about non rooted linageos devices for example?

[@terrydaktyllus1320]

You don't need to root a device to install Lineage OS (or any of the others) on it - you need to unlock the bootloader which is completely different. Rooting a phone removes an entire security layer that protects your data, it is a STUPID thing to do on your daily driver devices. Sure, go get a burner phone or two and have fun rooting them and trying out some cool security tools to learn something new - but keep any personal information off of them because rooting creates a big security hole on any device.

[@linsqopiring6816]

@@terrydaktyllus1320 Doesn't rooting just put it to a similar situation to windows where apps have greater control? In fact even a rooted phone would be safer than windows because of SELinux. So do people who say rooting a phone is stupid say that using windows is super stupid? If not I don't see how you can reconcile that.

[@robbraxmantech]

LOL on Windows being stupid! Fact is that was the only way software was made originally. Mobile apps is a new way. Good news and bad news there. Depends on what the programmer wants to accomplish

[@terrydaktyllus1320]

@@linsqopiring6816 No, SELinux does not directly defend against root access permissions being granted by enabling the root account. Have you never heard of "Defence In Depth" where the concept of security is to apply multiple layers that need to be breached before access might be achieved? Do you not understand that SELinux acts as one security layer, and leaving root disabled is another one? Just because one exists does not negate the need for the other to exist.

[@linsqopiring6816]

@@robbraxmantech So a Brax phone is the best of both worlds, it has no google spyware and the security bonuses of AOSP?

[@Lionelmeng-vu3rw]

Thanks for the information 😅

[@gordo8189]

Rob, I think I missed something. How, by adding his son's iPad (presumably living with mom) to his own Apple ID, does dad gain access to anything on mom's iPad? I understand that dad could spy on the son, maybe even "listen in" but surely mom's texts are on her iPad, on a totally different Apple id?? Wouldn't this allow mom to spy on dad?

[@yuka-youtube]

land tele was so robust safe

[@rebokfleetfoot]

i'm shocked i did not know this

[@deborahwalden8067]

Hi Rob! You are looking good. ❌♥️Deborah

[@robbraxmantech]

Thank you my friend. Good to see you're still here!

[@DarkMetaOFFICIAL]

a girl is swearing to me she knows how hacking works yet tells me they have my phone ip! omg she will not listen

[@robyee3325]

Who cares you’re a police informant anyway

[@joseluisvazquez5126]

The paper Bitcoin I fear is the one we might end up having if we ever need to onboard people at a rate over 7 per second, opening s LN channel per newcomer. Once you have billions of people onboarded, for all to be peers, unlike in the Fiat world, everybody needs to have some kind of ownership proof on sats on the layer 1. If we do not solve this problem, most people will end up onboarding on pure Bitcoin IOUs, and be second class citizens on this new money. That looks a lot like the gold weaknesses that lead to its demise. I think we should be able to figure it out, but it is still pending. Somehow we should be able to split UTXO ownership without bloating the blocks nor requiring weird protocol extensions.

[@GaryLive-f1d]

What about tablets?

[@robbraxmantech]

Same protections. But the good news is that tablets without cell do not have a baseband modem so that attack vector does not exist

[@gordo8189]

That's easy, take 2 tablets before every meal..

[@Ed-ty1kr]

Well this video certainly ended on a bad note...

[@Perry_Neum]

As Apple releases another patch for IOS back doors😂

[@teresajackson5859]

I can see a light that blinks in my phone that is not a camera light. I disabled my camera but the light is still blinking

[@OPOS-el7tj]

Ghost of Jobs

[@robbraxmantech]

Depending on the phone model there are alert lights which a programmer can use for various purposes (like to indicate a phone alert, battery status, charge status). Hacks have to have a purpose. For so much effort to hack, flashing a light doesn't really do much. If I wanted to instigate fear into a person, I'd send a message with personal data only you know...that's real proof of a hack.

[@teresajackson5859]

@@robbraxmantech my phone also beeps this loud sound when I'm on the phone I can't hear the other person talking it's so loud and don't police surveillance use this blinking light. My ex has the same phone and his phone does not have a blinking light that is not the camera

[@NorthernChimp]

@@teresajackson5859 A beep is a notification, isn't it? Did you look in your received notifications, and in your notification settings?

[@_Auroswim._.Ocean_Swimming]

If Android is so secure, why don't you open untrusted links in a mobile browser?

[@robbraxmantech]

Did you try it? What did it do to your phone? Seriously.

[@LynyrdSkynyrd.4Ever]

I do it everyday on my Android phone

[@_Auroswim._.Ocean_Swimming]

@@robbraxmantech Wasn't it you who said, "I don't open links"?

[@rozbehmozafari783]

can someone teach me how to hack a phone with medium serurity through sms ?

[@chazzlidell1492]

I can hack it. just kidding I don't even know how to tie my own sneakers. I think the best way to hack a phone or application is to dive deep and see what makes it tick.

[@SG003]

People are just paranoid

[@vargasbj]

Hello Bob. Please gives your thoughts whether a YUBYKEY can prevent BIG-TECH telemetry to each of us. Greeting from Costa Rica

[@DaddyElfMan]

question is this, how does one bypass or DENY an app (for android), these requests for access to ones phone. MOST, but not all, apps, REQUIRES one to ACCEPT their terms of service WHICH includes this level of access, if you decline, then NO APP. FRUSTRATING!!

[@DaddyElfMan]

PEGASUS