Woke up to like 100 tags on this iPhone implant. Which is found in this video here: https://t.co/9khbpmUQEH

I don’t speak Russian, but I do have a first grade language fluency in hardware. So lets take a look!
Thread 1/n

So a lot of people have correctly identified it as this GPS & Wifi based location tracker with microphone.
A very common type of device, similar to what is found in those extremely suspicious looking USB cables: https://t.co/uBhi7tRhiW

2/n
The headers are designed to attach a specific USB connector that fits a micro SD card in the tip.
3/n
A repurposed board is very “hobby implant” but... we see the SIM card was removed, which would make this a wifi-only implant. Yet an external GSM antenna is attached and only the ground for power? Cant see the other side though...
4/n
Upon closer inspection, they removed the SIM slot housing and soldered a SIM card directly to the pads. That gains a little more space.

Thanks @dcuthbert

5/n https://t.co/Sq9X6yByPV
You can see an antenna in the upper right. Right on a metal shield which will hurt the range.
There is normally not a convenient place for an implant, but they swapped the battery for a smaller one.
6/n
This feels like a proof of concept done for the video, or a fairly low grade implant done with a tiny budget. It could be done way smaller by not repurposing an existing thumb drive module.

7/n
For many adversaries that want location & mic, I suspect they generally don’t need a hardware implant. But there are always exceptions. That’s not really my area though.
8/n
Looks like @Requiem_fr has a nice visual comparison showing the battery reduction for clearing space.

This is a technique I have also used in power supplies when needing a little extra space for... activities 😈

9/n https://t.co/KjgfREmhZt
If true, this seems almost like it was intended to be found. The work is really primitive for gov work, not to mention the other ways they can pull location & mic.

10/n https://t.co/AwNiFpIE2V
The “shrink the power source” approach was what I used for this project:

11/n https://t.co/gz3cuKC6jb
Here is a previously unpublished picture of the internals. It’s all cannibalized COTS hardware.
This was before I got into hardware design. Not very good, but enough for a proof of concept.

12/n
One plausible idea: this only needed to last long enough to see where the phone went before it was torn open. That would give some valuable info.

13/n https://t.co/M77sGjOmcW
Anyway. I’m just going off a few pictures as I haven’t had the time to properly research it. For all I know, this was created as a stand-in for video demo purposes.
14/n

More from Tech

Recently, the @CNIL issued a decision regarding the GDPR compliance of an unknown French adtech company named "Vectaury". It may seem like small fry, but the decision has potential wide-ranging impacts for Google, the IAB framework, and today's adtech. It's thread time! 👇

It's all in French, but if you're up for it you can read:
• Their blog post (lacks the most interesting details):
https://t.co/PHkDcOT1hy
• Their high-level legal decision: https://t.co/hwpiEvjodt
• The full notification: https://t.co/QQB7rfynha

I've read it so you needn't!

Vectaury was collecting geolocation data in order to create profiles (eg. people who often go to this or that type of shop) so as to power ad targeting. They operate through embedded SDKs and ad bidding, making them invisible to users.

The @CNIL notes that profiling based off of geolocation presents particular risks since it reveals people's movements and habits. As risky, the processing requires consent — this will be the heart of their assessment.

Interesting point: they justify the decision in part because of how many people COULD be targeted in this way (rather than how many have — though they note that too). Because it's on a phone, and many have phones, it is considered large-scale processing no matter what.

You May Also Like