I know this is tin-foil hat fodder, but at least one judicial opinion referenced a bug that could track/listen in on the subject "whether the phone was powered on or off," although that may have been a judge misinterpreting the technobabble spouted at him, or an FBI agent overhyping their tech to the judge.


  • 13
  • 1
  • 5
  • 1
  • 2




  • @SamSkuce Not necessarily. It may just require a privilege escalation exploit. – Mark Buffalo Feb 3 '16 at 18:13
  • And now the CIA is using an attack like this in the wild against Samsung Smart TVs. – Sam Skuce Mar 10 '17 at 15:10



  • Sorry, had to update accepted answer because @John Deters pointed out a real demo at Black Hat. Still a good answer though! – Sam Skuce Dec 10 '13 at 19:32




A pretty failproof test would be to:

  1. Fully charge battery, and verify it's 100% before proceeding
  2. Turn your phone completely OFF (Android = long-press on power button, then "Power Off")
  3. Leave it sit in "OFF" condition for as long as possible - at least 1-2 days
  4. When you power it back ON, then observe battery charge condition. If it's more than 1-2% lower than when you turned it OFF, then your phone's OFF isn't really OFF, as there should be zero power drain in that condition.

For any "hidden background processes" to be running and be able to "listen in" (or perform other unauthorized monitoring), you would still need to keep the cellular radio powered ON to listen for a remote "wakeup" command.

The cellular radio is one of the most power hungry parts of your phone. You can verify this by enabling "Airplane mode", which turns off all "radios" in your phone... cellular, Wifi and Bluetooth. If you do this, and leave your phone sit idle for an extended period (12 hours), it will throttle-down the CPU, and use almost zero power... expect to see maybe 3-5% usage over 12 hours of inactivity.

This is very useful for using the alarms overnight, without running the battery down if you don't have access to a charger.

You might think "airplane mode" would be as "safe" as turning the phone OFF... but it's not... because (as others have mentioned) as long as the CPU is still running, malware can still run and force the "radios" back ON at-will... but if the CPU is not turned ON at all (Power = OFF), nothing can happen.

The concept of a heartbeat "wakeup" mode isn't very realistic either... since if the device is truly OFF, loading all of the OS is still required to be able to run any real process... not much happens without loading the OS... which takes quite a while - with respect to a "heartbeat" type hidden process.

Until phones are designed with a "static-state" (whereby the complete state of RAM and CPU's are instantly resumed upon application of power)... so that the OS never needs to load, you can't really use this type of heartbeat process. (this type of design is exceedingly expensive... seriously)

25+ yrs of EE design experience speaking here... and in consumer products, it's just not feasible...



Assuming it's not a "fake" off state (as other posters point out, a relatively easy thing to do if the phone is under control of the attacker), then: probably not. Most phones that are in an "off" state will turn off the radios (cellular, wifi, and bluetooth) to save power.



  • 2

A lot of these attacks exploit the fact that your phone isn't actually a single device; its main application processor is completely separate from its "baseband" processor (the cell modem). Frequently, the two communicate only over a serial line, and the baseband has direct access to the speaker and mic. (This is done for battery reasons; the baseband has hardware acceleration for the specific codecs that cell networks use.)

The baseband runs an OS too, and can be compromised just like the OS on the application processor. The difference, of course, is that when the application processor shuts off and tells the baseband to follow suit, a compromised baseband can ignore that command and continue to relay your mic data to a hacker, usually over a standard phone call (that's hidden from the application processor).

If done this way, the application processor will have no knowledge of what's going on and no control over it, so when you "turn your phone off" it will look and act like it's off, but not actually be off.

protected by Community Apr 10 '17 at 15:36


Would you like to answer one of these unanswered questions instead?
