Security for FMD Android

This page describes the security considerations that went into designing FMD Android, and what you may want to think about when using it.

Use case

FMD is designed to remotely locate and control your device in situations where you have lost it and an honest person finds it.

FMD Android is NOT designed to protect you against the device being taken against your will (theft, seizure by the authorities, etc.). FMD might help you to lock and/or wipe the device -- if you are fast enough to send the commands. But a malicious thief can shut down your phone or put it in a Faraday cage, thus prevent all remote communication.

With great power comes great responsibility

In order to control your device, FMD requires a great level of access. The broad range of commands comes with a broad range of permissions. FMD is only an app, but in some sense it "extends the operating system" by adding the functionality of controlling your device.

This power comes with responsibility.

FMD effectively becomes an additional gateway into your device (by design!). By granting the FMD Android app certain permissions, you are granting these permissions to anyone who can cause (or trick) the FMD Android app into doing something.

It is important that you trust FMD to only do what it claims to do and not to abuse its access. FMD's code is open source under a free license; you are encouraged to take a look and verify what it does. You can even modify it to your needs, for example to completely remove code for features you don't need, thereby reducing the attack surface.

Access control

info

This text is written for FMD Android 0.16.0. This version split the FMD PIN into SMS passwords and notification passwords.

Every transport channel has its own mechanism for granting basic communication access.

These are the basic requirements for even being able to communicate with FMD. For example, FMD ignores all SMS messages unless they come from an allowed phone number or contain a valid SMS password.

Transport channel	Access control
SMS	Allow-listed phone numbers Any phone number via an SMS password
Notification Reply	Any app on the same device via a notification password
FMD Server	Username and password

Permissions

info

This text is written for FMD Android 0.16.0. This version introduced fine-grained control with FMD permissions.

Being able to communicate with FMD does not mean the requester is allowed to execute any given command. There are two layers of permissions:

1. Android permissions: Most commands require the device owner to grant the FMD Android app certain Android permissions. Without the correct permission, the operating system does not allow FMD Android to access these device features (such as location or camera).
2. FMD permissions: For every access mechanism (phone number, password, FMD Server), the device owner defines which commands this access is allowed to execute. For example, the owner could grant the locate permission to one phone number and ring and flash to another phone number.

warning

Up until FMD Android 0.15.0, anyone who was allowed to access FMD could execute any command! The only way to limit what they could execute was to not grant the corresponding Android permission to the FMD app.

FMD permissions

See the screenshots below to learn how to configure the FMD permissions.

Every time you add a new phone number or password, you should review the assigned permissions.

Screenshots (click to expand)

Android permissions

For each command, FMD Android shows you which permissions are required or optional. Only grant the permissions for the commands you intend to use! Android's permission system limits what the operating system allows the FMD Android app to do, which is a strong line of defence.

Due to Android limitations, some permissions are coupled. Device lock and factory-reset are grouped under Device Admin. Therefore, the delete command needs to be explicitly enabled in FMD's settings, too.

Delete command

The delete command additionally requires a separate "delete password". If this password is not defined by the device owner or not provided by the requester, the delete command is denied. Therefore, to factory-reset the device via Notification Reply, you would send the following command:

fmd <notification-password> delete <delete-password>

Transport channels

When choosing a transport channel, ask yourself whether it is sufficiently secure for your personal threat model. Who can send commands to your device? Who can read the responses? This section gives an overview of what you might consider.

SMS

In FMD Android, you can use SMS either via allowlisting certain phone numbers, or by including an SMS password in the message. When a password is included, the sending number is temporarily allowlisted (for 10 minutes).

Phone number spoofing may be possible, depending on what area you are in and what carrier and phone you are using.

5G is more secure than 2G or 3G. Note that even though your phone may show "5G", it may actually be using 5G NR NSA (that is, using 5G for the data plane and 4G for the control plane). One way to check for this is Privacy Cell.

The password may be brute-forced. You need to choose a password that is strong enough to not be guessed, but that is memorable enough so that you remember it in the high-stress situation of losing your device.

There is currently no rate limiting or other brute force protection in FMD Android. Please follow this issue.

Notification reply

Notification Reply only has password-based access. Thus the same considerations as with password over SMS apply.

Additionally, FMD Android currently has no way to limit notification reply to specific applications (e.g., allow Signal but not E-Mail). That is, commands may reach FMD Android over any app on your device that posts a notification to the system notification tray.

FMD Server

See the dedicated FMD Server security docs.

Transparency

FMD Android gives the user information about what the app is doing:

• Notifications: FMD Android shows notifications of the form "Command 'fmd locate' was executed by +49 152 28817386".
• Logging: FMD Android has logging that shows when, which, and why commands are excuted. The logs can be viewed in the app and can be exported for analysis.