kheldan's Journal: Ask Slashdot: Is it even possible to secure a smartphone?

AT&T has forced my hand: They're decomissioning 2G towers, so my otherwise perfectly working phone doesn't always connect to their network. For the time being they gave me a cheap LG phone for free, but it's annoying to use because it's so limited even compared to the Razr2 v9 I was using. Every non-smartphone I've seen seems to be too limited and too annoying to use; I may have no choice but to get a smartphone. The question is: Is there a way to properly secure a smartphone against outside attacks? I have no plans to have a dataplan with AT&T because I think it's a ripoff, so that'll be disabled and I'll use wifi (if I use it that way at all). I won't be downloading and installing any apps. All I really expect from a phone is that it's good at being a phone, accept a microSDHC card (or have enough internal memory that I don't need one), support stereo bluetooth, and have a decent music player built into it -- and, of course, it needs to not be like a swisscheese, security-wise. What do you say, Slashdot? Is there firewall and/or antivirus/antimalware for smartphones? What's your plan for securing a smartphone?

what kind of answer do you want?

[eyenot]

the quickest and most likely correct answer is probably, no. that answer also covers the most liability as well, so if you act as if that answer's the truth then you'll probably enjoy the greatest amount of security.

then there are longer answers where somebody who's a professional in cellular technology (and how to sell it) convinces you that there's "no way" a "hacker" can attack your phone or take advantage of any vulnerabilities, as long as you keep your phone off the internet.

there is sort of a final, c

Re:

[kheldan]

I am no Luddite. I work for a major worldwide corporation responsible for most of the desktop and laptop microprocessors and chipsets on the planet; I'm sure you can figure that one out yourself. AT&T employees can't 'convince' me of anything because I know better; also, it took two weeks, three different AT&T employees, two incorrect SIM cards, and one correct SIM card, for them to get their story straight ("oh, we're shutting those towers off for good, that's why your phone won't work anymore"). B

Re:

[greenfruitsalad]

the problem is that any phone is practically 2 separate computers. there's the modem part that's controlled by a closed source firmware only manufacturer/NSA/Chinese know how to activate remotely and abuse, and then there's the computer part that you interact with that everybody knows how to abuse.

if you want to secure the 2nd, user facing computer, there are projects to take care of you, like the recently mentioned copperheadOS or blackberry with grsecurity patches. i personally like cyanogenmod, which giv

Re:

[dpilot]

Three computers - you forgot about the SIM card.

On the good side, there is also Replicant, that attempts to replace everything they can with Open Source. Unfortunately I don't believe they are able to replace the baseband firmware, however I'm under the impression that they have been able to secure phones from interference by the baseband processor.

Re:

[kheldan]

For the umpteenth time, I'm starting to wonder if I should just go back to having a landline with an answering machine, and just get a dedicated personal music player that isn't networked into anything. :-(

Re:

[eyenot]

*SEMI BACK MASK REVERSE
PLAY BACK
REWIND THE TAPE
LISTEN*

REEEVEEERRRR ME REEERVEE REWAEEERVAY

SKIMMONNE

BLAH BLIHBLU**

-- crackle --

Yes I am the child of a bunch of weird immigrants with weird fucking, like, black and white clothing and bonnets and aprons and scythes and sickles and shit like bibles catching on fire everywhere, and then there was that time they sacrificed all the town's children to the transdimensional being who exists only in between rows of regularly planted corn stalks. Well beggars can't be c

Re:

[eyenot]

all of this hardware is *SUPPOSED* to be operating on a civilian level so that it is usable by PROPERLY LICENSED CIVILIANS.

in other words, if you can put aside about $3,500 into a secure bank account with a tax ID, connect it to a DBA and then declaration of company business, go ahead and write up articles of incorporation and get ready for the wild and whacky world of "do anything you want as long as you are really good with disposing of random numerals followed by engineering-style groups of three zeroes

Re:

[kheldan]

I have neither the time, money, or internal wherewithal to engineer my own phone, or even embark on a lengthy reverse-engineering of an existing phone; 20 years ago, maybe, but 20 years ago I still shunned the place called Outside, and the Flaming Ball of Doom in the sky for half of one rotation of this gravity well we call Earth, so sitting inside all the time tinkering with this bit of silicon or that bit of binary code was what I did, when I wasn't fixing arcade games -- but that was a different time, wh