PhoneMyPC = awesome

[Shadowtech]

I have a q-see camera system that I can monitor with any computer with an internet explorer browser. Needless to say, I cannot do so from my android phone. Will this software allow me to connect to the computer at home and view the cameras on the browser?
Pete

Yes, with this app you can control your PC just as if you were sitting in front of it. It won't be exactly the same experience, but anything you can do on your home PC, you can see through this app. You will get a little lag between frames most likely, but you'll be able to view it without much problem.

 

[shrink57]

I have a q-see camera system that I can monitor with any computer with an internet explorer browser. Needless to say, I cannot do so from my android phone. Will this software allow me to connect to the computer at home and view the cameras on the browser?
Pete

You can get a full refund withing 24 hours on anything purchased on the market. Why not give it a test drive? You have nothing to lose.

 

[thericksonebay]

just a few more questions for you all. but first i left my laptop on at my house and got on my droid pulled up phonemypc app clicked on my webcam and bam saw everything infront of my computer this could be used for security or some other awsome things i cant mention and cant think of right now but any ways can i also use a computer instead of my droid to do the same thing? next i asked a few post back is there a way to drag and drop files from droid to computer and vice versa?

 

[Nodders]

Just to clarify and not be a total naysayer without reason, I just wanted to post why I think this app is one to avoid

1) Not open source standards compliant (No use of VNC or SSH)

2) Requires you to sign up for an account and connect through their website. There is no technical reason I should have to route through their website or need an account to use software to control my own PC.

3) Last I looked they had disabled the SSL encryption temporarily for some development reason (this maybe be fixed right now I'm not sure). But for a company to ever leave your data or passwords to control your home PC floating around out there as plain text is truly unacceptable.

Your mileage may very however.

I share you concerns, particularly number 3 (I think it mentions somewhere on their website that it can go peer-to-peer depending on routing). I understand the reason they may have done this and am not particularly interested in seeing it again (which seems to be the standard response on other forums). The word of the author that it is quite safe surely counts for zilch and I would ask them to state why it is safe. the app home website contains no useful information as to why the lack of SSL is OK.

At the moment, given the lack of detail on the security issues I too would not touch this app with a barge pole, which is a shame as it sounds pretty fantastic.

 

[smegoul]

I also would like to see a Mac version.
In the mean time I did this:
Use PhoneMyPC from my Droid to connect to my PC workstation.
Thru that PC I used LogMeIn to connect to my Macbook at home. I can then turn on my camera and see what is happening at home. (or whatever other task I need to perform).
I understand the security issues with both of these programs but they have let me do my job from anywhere I have 3G access.

 

[shrink57]

Am I going to use this program for online banking and accessing other sensitive data? Probably not. But it is great for monitoring file transfers, remotely turning my work station off, messing with people remotely while they are on my computer, and showing of my Droid. We are not talking homeland security here. Despite the security shortcomings (and I do trust the developers), this remains one of my favorite apps.

 

[Nodders]

Hmm. Perhaps then I am a tad confused about the process then, so please educate me as to where I am mistaken in the following fears....

If there is no security (effectively) and passwords and usernames are passed in open text format then surely it is a matter of utter simplicity to intercept and pick up the username and pw by pretty much anyone (in theory), in association with the IP they came from. In other words there is nothing to stop anyone picking up information that gives them access to your PC whenever the server is running.

For this reason I wouldn't touch it with a bargepole at the moment so I'm talking from a hypothetical point of view - please correct me if I am mistaken. If I'm not then, given it is after all not homeland security presumably you wouldn't mind posting your username and pw on the internet on some forum as it effectively amounts to the same thing (I'm speaking rhetorically of course but I would be interested in your view as to how it amounts to anything different).

And why do you trust the developers who are after all utter strangers? If you do I am sure there are a room full of Nigerian Princes with some cashflow problems who would love to make your acquaintance.

Of course all this is potentially easily put aside by some detailed technical information from the developer (rather than a promised white paper sometime in the future) that allays these fears. I note they have posted nothing to do this on any of the forums where this issue has been raised.

Come on developers a simple bit of community interactions other than just plugging the tool 0.0003 seconds after some posts about it and you have another willing customer of this very tempting product. I'm sure you can understand the fears that the sudden lack of SSL raises and provide information about why they are groundless.

 

[eug]

If there is no security (effectively) and passwords and usernames are passed in open text format then surely it is a matter of utter simplicity to intercept and pick up the username and pw by pretty much anyone (in theory), in association with the IP they came from.

How? Are you connecting over wifi with no encryption set? Is your local area network insecure? Has your ISP been hacked?

One cannot simply pluck plaintext passwords out of thin air. Someone needs to install a packet sniffer on a network somewhere. A network device needs to be hacked first.

Have you ever used FTP to update a website? That's plaintext. Have you ever used your ISP's email through pop3, IMAP, or authenticated SMTP? That's all plaintext - SSL wasn't introduced till more recently, and not everywhere. And until recently, entire gmail sessions were run in plaintext, except for the login sequence, just like Yahoo Mail right now. "Anyone" could have read any email you were reading, if it was that easy to pluck plaintext off your connection.

In other words there is nothing to stop anyone picking up information that gives them access to your PC whenever the server is running.

but I would be interested in your view as to how it amounts to anything different).

I'm interested in your view as to how it's so easy to packetsniff a stranger's internet connection. You make it sound like intercepting packets is as easy as eavesdropping on someone's conversation on a train.

 

[Nodders]

I'm not sure I understand where you are coming from. We are told on a near daily basis that open communication between PCs is potentially readable by anyone. We are told that e.g. we should not send credit card details over open email as they could in effect be read by anyone. We are told to ensure that bank websites occur over secure links. So, yes I know that email is effectively open, that FTP uploads are open. And if it was just that at risk I wouldn't care. But this effectively allows someone to observe my PC at the very least if the server is running. I may happen to have my banking website open, or accessing a spreadsheet with e.g. account details in it. Such things would usually be hidden by more secure access, but the open password/username allowing access to observe the system effectively makes this useless. Yes you could stop the PC server running and I am a bit concerned that the dev hasn't mentioned this anywhere.

At the end of the day, the app currently is of obviously great interest but it seems to me that (assuming a running server) it is a massively weak point on ones system that uses secure links for e.g. banking and so on. We are all free to take our own risks I just find it strange that for this app everyone seems to throw the usual precautions to the wind but that is up to them. I also note that the dev still hasn't responded (to this or any other thread where this issue is raised). This in itself strikes me as massively worrying. If this was my app and I was sure of its safety I would spend just as much time to respond to these (possibly naive) concerns as I did advertising the app. The security of the app basically depends on their say-so and nothing more atm, and that (for me) is frankly not good enough for me to trust it.

 

[eug]

Yes the chance that someone will target your traffic is very low, but it the opportunity is there if not the intent.

But now you are saying that open and unencrypted traffic is not really readable.

That is not what I said, I clearly mentioned that a network device has to be hacked first, before a packet sniffer can be installed.

Banks and sites like Paypal represent an attractive target. Criminals are all about money. If there's no financial gain possible, they're far less likely to bother. Getting someone's bank login details means access to their money.

It's hardly worth the effort to hack someone's phonemypc connection as the market is comparatively so much smaller, the same way Macs are "more secure" than windows - it's only "more secure" because it's a much smaller target that makes it less attractive to hackers (check out the pwn2own hacking contests and charlie miller's comments on mac security).

This can probably be well-demonstrated by the fact that no one's phonemypc connection has been hacked to date; and anyway, from what I've read, encryption will be reintroduced once they're out of beta.

alostpacket mentioned VNC. I think it's safe to assume the vast majority of people would be using a widely-available free version of VNC like RealVNC or UltraVNC without plugins - which has no encryption and has passwords travelling over the net in complete plaintext. No one seems too worried about those.

We are all free to take our own risks I just find it strange that for this app everyone seems to throw the usual precautions to the wind but that is up to them.

Your worries are perfectly understandable, it is definitely not best-practice to do anything in plaintext. But at this very moment I believe this risk is manageable due to the unattractive target it represents, so I use it myself. I wouldn't install it on a server in its present state, but I think my media center PC and desktop are ok. There's plenty more potentially-juicy data out there that travels in plaintext, like Yahoo Mail, Hotmail, VNC, etc. Hopefully the SSL version will be out soon.

I also note that the dev still hasn't responded (to this or any other thread where this issue is raised). This in itself strikes me as massively worrying.

I wouldn't be too worried yet, as this is an independent forum that has nothing to do with their company and they might be busy doing actual work on the program. If they subscribed to this topic they would have received an email about an earlier post that may not be talking about this issue, not knowing that we're talking about this right now. I'd imagine you'd get a much quicker response if you posted about it on their facebook page.

 

[Nodders]

Indeed it is an independent forum, however the dev posted very quickly on it advertising the app (20 something minutes after it was created in fact - obviously on the look-out for such threads), and has done similar in other forums, so they obviously know about this thread. I guess I find it a bit disappointing that the dev can find the time to post plugging the app, but not really explaining some of the issues. Ho-hum - guess I'm a tenner richer then.

And I disagree with you re risk. I wouldn't conduct banking in plaintext regardless of opportunity and so I just can't bring myself to suddenly believe an utter stranger that all is OK with having plaintext access to my PC (through their own servers no less thereby presenting them with the potential to simply harvest all this information - something that doesn't necessarily happen with routine web access).

An analogy perhaps is leaving my front door open of my house. The chance that someone will come in and nick everything is very small (round here at least luckily) - doesn't mean I want to leave it open on purpose though, especially if I also have to provide my address and the fact that it is open to a complete stranger who promises they wont do anything with it.

But I think we agree on one fact - it is down to ones assessment of the risks. I do get the impression though that the vast majority of users of the app don't understand the potential risk - another bad reflection the dev IMO who (if they were in any way responsible) would make this utterly clear and e.g. recommend that one shuts down the server when doing anything remotely secure.

I was kind of hoping that someone would be able to tell me that there was no risk really and that my initial impressions were wrong as I really want to use this software, but it seems that my worries were correct, it is simply a matter of how worrying people think they are. I think it is very worrying. You and others think it is not very worrying.

 

[Gremlin256]

The risk is what I am seeing is, they can see what you do .. Like someone said above, it would be foolish of you to use this program now for banking purposes..I do not use same passwords at all. In the earlier posts, yes the dev did come back for ads but he/she came again to answer a few questions.. If you wrae worried about ssl not being present? Wait till it is out of beta, that is it when ssl is going to be present..


to be honest, if you are afraid of being hacked, do not use technology.. anything is hackable my credit card (gas card) was hacked and someone from armenia bought $1000 of groceries .. well sorry to say they did not get any of the groceries ..

 

[Nodders]

But just because anything is hackable doesn't mean you shouldn't take sensible precautions. To continue your analogy you wouldn't write your PIN number on the back of your credit card and give it to stranger just because security is not perfect. To me that is the similar to the situation with this app.

Anyway it is of course up to you. I just find it interesting that some supposedly internet savvy people throw all the usual caution to the wind at the first sign of a cool application. A community ripe for social engineering - which is worrying.

 

[SoftwareForMe.com]

I just stumbled across this thread again, and am amazed how much content has been added since our last post.

It seems the topic has recently centered around security, from worry about why the phones and PC's use our servers, to concern over "clear text" transmission. Let me address those.

Why do the phones go through our servers?
This provides one of the key features of the software, and why it is simpler to use than VNC and RDP, and why it can be used by far more people.

Consider those other protocols. Say you have the software on your phone and want to connect 3 PC's.

You run the software on your phone and enter the IP address for all three PC's. Sounds easy, but for it to work you must:
* Forward ports on the PC's internet-connected router so the phone can reach them
* Monitor your IP so when your ISP changes it, you update your phone

Many people do not know how, and would rather not bother. Moreover, many people cannot do these things, because the computer is in a workplace where they are not given access to forward ports on the router.

So, with PhoneMyPC, your PC's connect to the servers and announce themselves. When you run the app on the phone, it also connects to the servers, and gets a list of your PC's.

Next, you select a PC to use, and it's up to you what happens then.

* If you have forwarded the ports (as with VNC or RDP), PhoneMyPC will connect directly to your PC, leaving our servers out of the loop.
* If you have not forwarded the ports, you can still interact with your PC, through our servers.

In all cases, you never need to know your PC's IP address, nor worry about it changing, because our software does that for you.

This approach significantly improves the usability of the software, and does not effect security in any way. The fact that the data may pass through our servers does not give us the ability to control your PC (see below). Finally, in a future release, the data will be encrypted as it passes through our servers so only your PC and phone could possibly decipher it.


Is my PC in any way vulnerable when the PC app is running?
No. The only vulnerabilities relate to the transmission of unencrypted data in the current Beta product. Read on to understand why.

What are the vulnerabilities exactly?
When you configure your PC and phone, you enter credentials. These credentials are important, because anybody with an Android phone could use them to gain access to your PC.

But, they are encrypted when they are stored on disk, and they are never sent over the network.

Once your phone and PC begin to interact (regardless whether the interaction is through our servers, or through a direct phone-to-pc connection), the two devices mutually authenticate each other using a challenge-response technique that is very reliable and secure, and that does not require sending credentials over the network.

So, this means than when the PC software is running quietly on your PC, nobody can access your PC unless they have your PhoneMyPC name and password. Period.

But, because of the fact that the data is not encrypted at this time, there are two weaknesses.

1) Data inspection
Someone inside your network could use a network monitor to see your traffic, but only while you are interacting with your PC. To do this, they would have to get access to your network, use a packet sniffer, reverse-engineer our protocol. At this point they could see what you are doing.

2) Session hijack
It is possible that someone could take over a session while you are using your PC. However, this would require:
1) Owning (having control of) a PC inside your network
2) Implementing a DNS takeover so your PC connects to their [hijacked] box rather than our servers
3) Reverse engineering our protocol
4) Changing or turning off any port-forwarding rules you have in place (so the phone doesn't connect directly to your actual PC)

It would work like this:
* Your PC tries to connect to our servers, but because of the DNS hack, it connects to the hacked PC instead
* The hacked PC connects to our servers, forwarding the data coming from your PC
* The hacked PC watches and forwards data in both directions until you are authenticated and in the process of using your PC
* The hacked PC sends commands to your PC

I can't imagine what commands it could send that would be harmful; perhaps using the Action feature to open a browser or attempt to download a file, but this would still require a mouse-click to complete the download, which would be very hard to automate.

Consequently, I could put together similar hijack scenarios for all other remote control products.

Conclusion
I might not do banking with PhoneMyPC (until SSL is available again), unless I were on WIFI at home and knew there were no interlopers on my home network, but otherwise, I personally feel quite secure. There are minor vulnerabilities, but they are hard to do, require very dedicated effort and security failures beyond just PhoneMyPC to make them effective.

Sorry this is so long. We take all customer concerns seriously, and particularly security concerns. We not only want to reassure people, but go the extra mile to be clear where the vulnerabilities lie, even if they are obscure.

When we finish the Beta, our security model will be world-class, and a white-paper will be available on our website describing all threats and the countermeasures we have implemented to address them.

 

[SoftwareForMe.com]

@Nodders,
One last comment. We frequent this and many other forums, not just because we talk about our app, but we're Android fans too.

However, we find most of these threads through Google Alerts. The last alert on this thread was December 22, and then one today. Strange.

 

[Nodders]

Thanks for responding dev. I note your points and they do confirm that at the moment,without SSL, your app is a big security risk (otherwise why would you have SSL in the first place? - genuinely interested in your answer to this question if you think the risk is so low without it). Also I'm not sure you cover all the potential scenarios. We discuss some more in other posts and I'm not about to leave the security of my system up to the rushed imagination of a dev (it didn't work for MS in early versions of XP!). And I keep on coming back to the question - if it is fine, then why bother with SSL at all?

I am interested in your app, but I'm afraid until you switch SSL back on and encrypt the traffic it does represent a weak point on most systems. I'll wait until you do, and I look forward to it.

A constructive recommendation - perhaps you could post your above explanation in some form on your website highlighting the risks that people are taking that you currently do not warn them about. The rather casual dismissal and promises of security do strike me as not becoming of someone who wants to push the security of their solution and was one of the issues that I found uncomfortable.

Re your additional post - perhaps. I hope you understand why it seems suspicious to plug the app literally minutes after its creation but then not chime in when people are seeking advice. Having said that you have responded and thank you for doing that.

 

[SoftwareForMe.com]

Hi Nodders,

Wonder over to DroidForms.net. It's the one we post on the most, and frankly, the only reason is because the forum notifies us any time a thread we've posted in is updated. Even the Google Alerts is pretty quick on this forum, most of the time.

I re-read this entire thread and I don't see any of the other scenarios you mention. You suggested that the name and password used to access your PC was sent over the wire--I corrected that misperception, and went on to explain how it is possible that we do not need to do that. Someone questioned the need to use our servers, and I explained why it is necessary and how you can avoid it (if you so desire).

The need for SSL is obvious, as explained above--your session can be "watched" by someone inside your network without it. The reason for dropping it temporarily was technical, but there's more to it than that.

We could put SSL back (which we will, soon), I could install 2048 bit SSL certificates on the phone and on the PC's, perform mutual authentication and bidirectional encryption with them, and write a wonderful article detailing all the ways in which our software is more safe than your bank.

However, we're not business or sales people; we're engineers, and the best solution isn't that easy. For example, if I install a certificate on your PC along with the software, I cannot be sure there is a registered domain name for your IP address, so I cannot use a signed, trusted (VeriSign) certificate. That means I cannot use the certificate to verify that your PC is your PC. That means the exact same man-in-the-middle attack I described above could be done on your network. So what will it have solved?

As someone rightly pointed out, nothing is "un-hackable." The goal is simply to make the system so hard to hack that people won't bother unless there is an equally high return for the effort. That statement holds true now: it takes "fair" effort to watch your [non-encrypted] traffic, and for this effort you get what you see, but no control. It takes "great" effort to actually gain control and is hard to do, and only lasts as long as your session does.

Naturally, some people would like it to be more like "impossible," and so would we. This is why we have tied the re-addition of SSL with our Remote Login feature, because you will need to enter PC credentials on the phone which will have to be sent to the PC. Of course those must be highly secured. However, it's not as simple as some might think, for the reason I just explained: adding SSL doesn't really solve all of the problems inside your network. We are still finalizing those solutions.

In the end, I appreciate your interest in security, and for raising the questions and issues you have, giving us the opportunity to discuss it. We really are working as hard as we can to get the remaining work done (Login, Sound, for example), and done right.

Oh, and Nodders... if you would like to be notified when any of the forthcoming developments occur (SSL used, Login available, Sound, or the end of Beta), drop us an email and we'll put you on a list and let you know.

 

[pinn]

Anyone know how to setup the actions?
I want to do [winkey] + P to switch monitors from my sofa.

 

[SoftwareForMe.com]

Anyone know how to setup the actions?
I want to do [winkey] + P to switch monitors from my sofa.

Unfortunately there is no trivial way to do this at present with Actions. Actions work well to start programs, but not to send keystrokes. We have a list of utilities (such as keystroke simulators) that we want to release for use in Actions, but we're still too focused on key features.

For now, you can select Control Mouse + Keys (or Interact Live) and send a [Win]+P from there.

* Press Menu, Mod Keys
* Press Menu, Keyboard
* Press the Win key in the key-palette at top
* Press the P key on the keyboard

 

[pinn]

Yep,that's what I had been doing. Thanks anyway.

 

[SoftwareForMe.com]

Yep,that's what I had been doing. Thanks anyway.

We get feedback all the time from people doing very specialized things with PhoneMyPC. There are so many requirements for special key behavior that we will most definitely beef up our support for customization in that area. Soon.

 

[shrink57]

Just to clarify how PhoneMYPC originally got involved in this forum. I, just a neophyte end user bought the application after reading a positive review (in my skepticism expecting to get a quick refund), found it more than exceeded my expectations, and started this thread (I have started threads on a bunch of programs that I have found useful). As people posted questions that were over my head, I emailed the developers and suggested they jump in and they did, which is what the medium is for. They have always responded to any questions I have had and helped me through some early issues when access my PC remotely. I have never questioned their intentions and forwardness. I continue to appreciate their help and support.

 

[SquirrelSlax]

For some reason I couldn't get this App to work on Windows 7.
When I try to connect from phone I get message "No Host Available."
Not sure why that is since I followed all instruction on setting up the PC software. Maybe I don't have a required Windows Feature installed to us VPN.

Its rather annoying.

 

[eug]

For some reason I couldn't get this App to work on Windows 7.
When I try to connect from phone I get message "No Host Available."
Not sure why that is since I followed all instruction on setting up the PC software. Maybe I don't have a required Windows Feature installed to us VPN.

Its rather annoying.

I didn't have to do anything special on my W7 x86 and W7 x64 machines. Do you have a firewall that may be blocking it?

 

[SquirrelSlax]

I didn't have to do anything special on my W7 x86 and W7 x64 machines. Do you have a firewall that may be blocking it?

I have a firewall, but I thought that might be causing issues So I disabled it, also made sure the Windows Firewall (which auto enables when my perfered firewall is disabled) it was disabled too. I also disabled my router/modem firewall aswell. (yes I know two firewalls in not needed, but oh well)

Anyways, even with firewalls disabled the app would still not connect or even find available hosts.