This is the part where you repeat the same comment and substitute in modifying the software, opening the device and putting in listening hardware, putting a microphone under your skin, attaching a microcontroller to their outside walls to analyze vibration patterns, etc. Luckily, the world doesn't operate on pedantry. They care about removing 99% of attack vectors, the remaining 1% is covered by you being on the line. If your office permits outside recording hardware, someone 'forgetting' that their device was recording is a mishap. But if it only approves certain devices and finds out you did James Bond-level gadgetry to circumvent their measures, guess what image that'll paint on you.
I imagine this is why Apple has kept the mic array and camera as separate removeable components in their devices when pretty much everything else is integrated.
If it’s an Apple device, it’s pretty easy to verify, if you’re not getting into the realm of spycraft. Open the stock recording app from the store and try to record after verifying the preferences allow recording. This is sufficient for catching bad actors who don’t have immense resources behind them. Even easier if it’s a managed device.
If you’re worried about legit espionage, you hold the meeting or do the work in a SCIF, zero devices go in or out period, metal detectors and patdowns on both entry and exit.
It’s the other way around - for secure environments there is an approved device list. If your device is not on that list, it does not go in.
There is also an approved human list. And the approved humans carry responsibility and consequence when going into the space.
My device is listed model XYZ. Promise.
How would you verify?
Look at it.
This is the part where you repeat the same comment and substitute in modifying the software, opening the device and putting in listening hardware, putting a microphone under your skin, attaching a microcontroller to their outside walls to analyze vibration patterns, etc. Luckily, the world doesn't operate on pedantry. They care about removing 99% of attack vectors, the remaining 1% is covered by you being on the line. If your office permits outside recording hardware, someone 'forgetting' that their device was recording is a mishap. But if it only approves certain devices and finds out you did James Bond-level gadgetry to circumvent their measures, guess what image that'll paint on you.
1 reply →
Some services offer modified devices without a camera or mic for high-security environments. https://www.gadgetreview.com/the-iphone-with-no-camera-and-w...
I imagine this is why Apple has kept the mic array and camera as separate removeable components in their devices when pretty much everything else is integrated.
I have not readded those components. Promise.
How would you verify?
If it’s an Apple device, it’s pretty easy to verify, if you’re not getting into the realm of spycraft. Open the stock recording app from the store and try to record after verifying the preferences allow recording. This is sufficient for catching bad actors who don’t have immense resources behind them. Even easier if it’s a managed device.
If you’re worried about legit espionage, you hold the meeting or do the work in a SCIF, zero devices go in or out period, metal detectors and patdowns on both entry and exit.
4 replies →