Tag: iphone

  • Watching Your iPhone Work to Protect You from Covid-19

    Much has been written about the Apple + Google Covid-19 Exposure Notification framework. This is the software that is now part of Android and iOS (13.5+) and powers Covid-19 detection apps for Android and iPhone like COVID Alert (much of Canada), COVIDWISE (Virginia) and dozens of other jurisdictions around the world .

    I’m in Ontario and use COVID Alert on my iPhone 8 Plus. The apps are fantastic pieces of work from the Canadian Digital Service and its private sector partners Shopify and BlackBerry. That said, I have always wished for more feedback from the app itself. Something that gives me a sense of it actually working. I’m the first to admit that this isn’t a rational need. When you open COVID Alert here is what you see:


    Great! You’re active! But what does that mean?

    I’m grateful that no exposure has been detected! But the app doesn’t look like it’s doing anything. I know that that’s not the case. I know that it is doing stuff but that’s because I’m a nerd and because the Canadian Digital Service maintains the source for both the Android and iPhone COVID Alert apps on GitHub .

    But how can I see it actually doing stuff?

    Well here’s one way. Both iPhone and Android allow you to see a log showing each time COVID Alert has downloaded a list of exposures from the COVID Alert server.

    On iPhone you can see the log in Settings -> Exposure Notifications -> Exposure Logging Status -> Exposure Checks .

    What I believe this means is that in that one Exposure Check done at 10:09am ET COVID Alert downloaded 246 Tracing Keys (“device IDs”) of devices that had had a positive Covid-19 test reported over the past 14 days. It also determined that my iPhone did not get close enough to any of those phones, for a long enough period of time, to warrant me getting a Covid-19 test. It’s pretty cool to see the app at work.

    What else could it do?

    I would also love the app to help me understand:

    1. How risky is my current behaviour?
      How many devices did my phone see in the past 24 hours? How many rolling proximity identifiers (RPIDs) did my phone log? I know that you are not supposed to be able to derive a Tracing Key from an RPID, but could the system run a function over a set of RPIDs and estimate the number of unique Tracing Keys they represent?
    2. How effective is the app at warning people about potential exposure?
      We had 625 new cases of Covid-19 reported yesterday in Ontario. How does that compare to the 246 Tracing Keys my phone received? Do the time frames line up? Can I compare them? What’s the effective penetration of the app?

    Closing thoughts

    You can’t tech your way out of a policy or political problem. That said, I strongly agree with the what Apple, Google, and the Government of Canada have done here. If the policy decision is to continue to deploy these decentralized, anonymous exposure notification applications on a voluntary basis then we need to keep looking for ways to make them more effective and more compelling to download and use. Sharing more useful information with people could be a way to get more people to use the app and better inform public health authorities on what to do next.

  • Effectively change the hosts file of your iPhone, iPad or Android with ettercap

    Based on “Test web apps on iOS by DNS spoofing your LAN with Ettercap” by Henrique Barosso. Modified to work on a Mac running OS X.

    To access a website or service that uses a virtual host but isn’t in DNS, you need to add it to the hosts file of the machine you’re using for testing.

    Unfortunately, you can’t edit the hosts file of a (non-jailbroken) iPhone or iPad. This makes testing difficult.

    As a work around, we’re going to use ARP spoofing to intercept DNS requests from your iPhone or iPad and respond to those requests with the IP address of your virtual server.

    So, if accessing your development environment requires a hosts file entry like

    192.254.12.1	devserver.mysite.com

    then this process will let you tell your iPhone or iPad to resolve devserver.mysite.com in the same way.

    A few things to keep in mind before you do this:

    • you need to have sudo on your Mac
    • your iPhone or iPad and Mac need to be on the same WiFi network, and
    • you can do a lot of evil, evil things by ARP spoofing on a public network; do not do this, it’s illegal

    With that said, to get this going:

    1. Install ettercap. I recommend using homebrew to manage linux ports on your Mac:
      % brew install ettercap
    2. Find the IP address of the device (iPhone or iPad) you’d like to test with. On iOS 7 you can see your phone’s IP address by navigating to Settings > Wi-Fi > Wireless Network Name . Let’s say it’s 192.168.1.105.
    3. Turn of WiFi on the device you want to test with; this will clear its ARP cache.
    4. Edit /usr/local/etc/ettercap/etter.dns and add an entry for the virtual server you would like to test, e.g.
      # Websites for testing
      devserver.mysite.com   A   192.254.12.1
      
    5. Enable the firewall and IP forwarding:
      % sudo sysctl -w net.inet.ip.forwarding=1
      % sudo sysctl -w net.inet.ip.fw.enable=1
    6. Start ettercap and activate the dns_spoof plugin:
      % sudo ettercap -i en1 -T -q -M ARP:remote -P dns_spoof /192.168.1.105/ //

      Remember to replace 192.168.1.105 with the IP address of your phone or tablet.

    7. Turn WiFi back on on your device.

      If everything worked properly, you should see some output from ettercap, letting you know that it’s intercepted an ARP request on your device.

      % sudo ettercap -i en1 -T -q -M ARP:remote -P dns_spoof /192.168.1.101/ //
      Password:
      
      ettercap 0.8.0 copyright 2001-2013 Ettercap Development Team
      
      Listening on:
         en1 -> XX:XX:XX...
      
      SSL dissection needs a valid 'redir_command_on' script in the etter.conf file
      Privileges dropped to UID 65534 GID 65534...
      
        33 plugins
        42 protocol dissectors
        57 ports monitored
      16074 mac vendor fingerprint
      1766 tcp OS fingerprint
      2182 known services
      
      Randomizing 255 hosts for scanning...
      Scanning the whole netmask for 255 hosts...
      * |==================================================>| 100.00 %
      
      Scanning for merged targets (1 hosts)...
      
      * |==================================================>| 100.00 %
      
      7 hosts added to the hosts list...
      
      ARP poisoning victims:
      
       GROUP 1 : 192.168.1.101 CC:XX:XX:XX:XX
      
       GROUP 2 : ANY (all the hosts in the list)
      Starting Unified sniffing...
      
      
      Text only Interface activated...
      Hit 'h' for inline help
      
      Activating dns_spoof plugin...
      
      dns_spoof: [devserver.mysite.com] spoofed to [192.254.12.1]
      
    8. Try navigating to devserver.mysite.com on your device. If it doesn’t work, then try turning your WiFi on and off again to flush the ARP cache.
    9. Once you’re done testing, press q to exit ettercap.

    That’s it! If you have questions, concerns, or enhancement suggestions please let me know on twitter (@josephby) or join the conversation on Hacker News.

  • Location 2012

    • users are smart and motivated enough to figure this out, and don’t mind sharing all of their location data, all the time, with everyone — this is consistent with Scoble’s belief in the end of privacy
    • carriers will sit back and just let this happen; carriers have been screwing up location based services since the dawn of the mobile web — they could easily interfere and botch this, too, by pushing their own solutions and making it difficult for users to use alternatives
    • device manufacturers and users will continue to let all of the logic move to the cloud; phones are incredibly powerful computers, and will get even more so — why not have my handset decide when to disclose my location, for whom and why?
    Nevertheless, this is the most complete description of the future that I’ve seen to date, and is worth a read.