 President Trump is continuing to use an off-the-shelf Android phone. A New York Times report on January 25th described aides trying and failing to replace Trump's Samsung device. And a string of tweets in the days since have shown the president continuing to use Twitter for Android. That's a huge security problem, and a huge break from the norm. Finally, this year, they said, good news, Mr. President, we're going to give you a smartphone. I get the thing, and they're all like, well, Mr. President, for security reasons, there's a great phone, state of the art, but it doesn't take pictures, you can't text, the phone doesn't work. So basically it's like, does your three-year-old have one of those Play phones? When President Obama took office, he got a specially secured Blackberry, with no apps, no Twitter, and just a handful of numbers that he could call or text. The problem is, any consumer-grade phone running Twitter is vulnerable to thousands of attacks from all around the world. And if that phone is in the president's pocket, a lot of people are going to try to break in. If they make it through, they can turn the phone into a live microphone, broadcasting everything it hears back to the hacker. To show you how that works, we've connected with Zach Lanier, director of research at Silance, who's going to plant some surveillance malware on our producer Tom's Galaxy S6 Edge. We tweeted Tom a download link for what looks like the Weatherbug app, but alongside the weather predictions, Zach built in some surveillance malware that can turn on the phone's microphone and even the camera. That lets us check in on Tom whenever we want. You are at 40.70408 latitude and it's negative 74011783 longitude. So we're finding Gabby's. Finding the new Gabby's right here. Tonight? Tomorrow? It's tomorrow. They should be in the middle of a meeting. You should be able to hear them talking. But I've already released a few. Oh, that's right. I also can't make it tomorrow, so. Oh, that's so sad. Let's move it. Sweet. Sweet. Sweet. This is amazing. I've got probably seven to ten seconds of audio. I've got their front camera and back camera. Twelve contacts. No SMS messages, unfortunately, or call logs. They should have made some phone calls. It's true. We could have put more there to give you. Okay. So here's what we got for the audio. Okay. Yeah, let's hear it. New Gabby's right here. Nice. Oh, that's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. That's great. Now we're getting the audio. Yeah, that's great. Now we're getting the audio. Yeah, that's great. Now we're getting the audio. All right. Okay. Now part three of the audio. Here we go. Here we go. The audio is actually coming in quite,, mostly ready for this one. What happen? Here we go. This is a threatened voice signal. Or not. We're full. Man, Wow. This activity isNice with a wide!!!! Really. That's just amazing. If you remember. さ​I think it's good.... We went a 놓くしたこと 30. So let me just skew a bit in these notes, yeah. Let's move in. That actually is great. Let's move in to next week. I feel like a lot has happened this week. When do you guys, when do you guys, I can't do it, I can't do it next Monday. Do you guys have a... They can't do it next Monday. Unfortunately both the cameras, well I can see half of his head. So, this was just a demo that Zach put together in his spare time. And the real thing would look different in a couple ways. We were relying on known vulnerabilities in Android, so we had to trick Tom into purposefully downloading the software. But when we see surveillance malware in the wild, it's a lot sneakier. Using undiscovered vulnerabilities to break in through an email attachment, a bad link, or even a silent software update. It takes a lot of time and expertise to carry out an attack like that. And for most users, it's just not a plausible threat. But the president is different. Foreign intelligence agencies are willing to spend millions of dollars and years of work to find out the president's secrets. Right now, some of the best hackers in the world are in rooms in Moscow and Beijing, spending all day, every day trying to hack into the Oval Office. The big takeaway here would be something to the effect of, when you have an open ecosystem like that, it's very hard to really universally maintain some kind of baseline for security. And they've done a good job. And it's hard because you have way more gates. It's just not going to be something that we're going to be able to fix. So when you have older devices like S3, S4, even earlier versions of S5, you're boned. And the fact that certain people in power have those that are more or less unsupported, it's terrifying. If there's an unsecured phone anywhere near the president, those groups are going to find it and turn it into a microphone. That was true for President Obama, and it's true for President Trump. The difference is that so far, Trump seems to care more about tweeting than protecting state secrets. Yeah, who's Ashley Hamburger? Ashley Hamburger? Ellis Hamburger. Is that a real person? That is. He used to work here, and now he works at Snapchat. Is he downloading it? No, no, no. Oh, he's in the contacts of the phone. No, I mean, we're going to call in the drones on that. That's valuable information.
 President Trump is continuing to use an off-the-shelf Android phone.
 A New York Times report on January 25th described aides trying and failing to replace Trump's
 Samsung device.
 And a string of tweets in the days since have shown the president continuing to use Twitter
 for Android.
 That's a huge security problem, and a huge break from the norm.
 Finally, this year, they said, good news, Mr. President, we're going to give you a smartphone.
 I get the thing, and they're all like, well, Mr. President, for security reasons, there's
 a great phone, state of the art, but it doesn't take pictures, you can't text, the phone doesn't
 work.
 So basically it's like, does your three-year-old have one of those Play phones?
 When President Obama took office, he got a specially secured Blackberry, with no apps,
 no Twitter, and just a handful of numbers that he could call or text.
 The problem is, any consumer-grade phone running Twitter is vulnerable to thousands of attacks
 from all around the world.
 And if that phone is in the president's pocket, a lot of people are going to try to break
 in.
 If they make it through, they can turn the phone into a live microphone, broadcasting
 everything it hears back to the hacker.
 To show you how that works, we've connected with Zach Lanier, director of research at
 Silance, who's going to plant some surveillance malware on our producer Tom's Galaxy S6 Edge.
 We tweeted Tom a download link for what looks like the Weatherbug app, but alongside the
 weather predictions, Zach built in some surveillance malware that can turn on the phone's microphone
 and even the camera.
 That lets us check in on Tom whenever we want.
 You are at 40.70408 latitude and it's negative 74011783 longitude.
 So we're finding Gabby's.
 Finding the new Gabby's right here.
 Tonight?
 Tomorrow?
 It's tomorrow.
 They should be in the middle of a meeting.
 You should be able to hear them talking.
 But I've already released a few.
 Oh, that's right.
 I also can't make it tomorrow, so.
 Oh, that's so sad.
 Let's move it.
 Sweet.
 Sweet.
 Sweet.
 This is amazing.
 I've got probably seven to ten seconds of audio.
 I've got their front camera and back camera.
 Twelve contacts.
 No SMS messages, unfortunately, or call logs.
 They should have made some phone calls.
 It's true.
 We could have put more there to give you.
 Okay.
 So here's what we got for the audio.
 Okay.
 Yeah, let's hear it.
 New Gabby's right here.
 Nice.
 Oh, that's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 That's great.
 Now we're getting the audio.
 Yeah, that's great.
 Now we're getting the audio.
 Yeah, that's great.
 Now we're getting the audio.
 All right.
 Okay.
 Now part three of the audio.
 Here we go.
 Here we go.
 The audio is actually coming in quite,, mostly ready for this one.
 What happen?
 Here we go.
 This is a threatened voice signal.
 Or not.
 We're full.
 Man, Wow.
 This activity isNice with a wide!!!!
 Really.
 That's just amazing.
 If you remember.
 さ​I think it's good....
 We went a 놓くしたこと 30.
 So let me just skew a bit in these notes, yeah.
 Let's move in.
 That actually is great.
 Let's move in to next week.
 I feel like a lot has happened this week.
 When do you guys, when do you guys, I can't do it, I can't do it next Monday.
 Do you guys have a...
 They can't do it next Monday.
 Unfortunately both the cameras, well I can see half of his head.
 So, this was just a demo that Zach put together in his spare time.
 And the real thing would look different in a couple ways.
 We were relying on known vulnerabilities in Android,
 so we had to trick Tom into purposefully downloading the software.
 But when we see surveillance malware in the wild, it's a lot sneakier.
 Using undiscovered vulnerabilities to break in through an email attachment,
 a bad link, or even a silent software update.
 It takes a lot of time and expertise to carry out an attack like that.
 And for most users, it's just not a plausible threat.
 But the president is different.
 Foreign intelligence agencies are willing to spend millions of dollars
 and years of work to find out the president's secrets.
 Right now, some of the best hackers in the world are in rooms in Moscow and Beijing,
 spending all day, every day trying to hack into the Oval Office.
 The big takeaway here would be something to the effect of,
 when you have an open ecosystem like that, it's very hard to really universally maintain
 some kind of baseline for security.
 And they've done a good job.
 And it's hard because you have way more gates.
 It's just not going to be something that we're going to be able to fix.
 So when you have older devices like S3, S4, even earlier versions of S5, you're boned.
 And the fact that certain people in power have those that are more or less unsupported,
 it's terrifying.
 If there's an unsecured phone anywhere near the president,
 those groups are going to find it and turn it into a microphone.
 That was true for President Obama, and it's true for President Trump.
 The difference is that so far, Trump seems to care more about tweeting
 than protecting state secrets.
 Yeah, who's Ashley Hamburger?
 Ashley Hamburger?
 Ellis Hamburger. Is that a real person?
 That is. He used to work here, and now he works at Snapchat.
 Is he downloading it?
 No, no, no.
 Oh, he's in the contacts of the phone.
 No, I mean, we're going to call in the drones on that.
 That's valuable information.