NSA Warns iPhone And Android Users To Turn It Off And On Again

It's actually good advice to periodically restart your secure devices. There are many exploits that can only persist in memory and not on the actual storage device itself. So by restarting you go back into a known good state. And any malicious actor would have to reinfect your phone, which may not be guaranteed

This is fascinating to me because I was taught not to restart your computer if you suspected malware because restarting it would basically activate it
- You can't activate malware by restarting your system. There's no reason why an attacker would wait for a restart to do what they want to do.
  What can happen is that restarting doesn't help fix anything related to malware if the malware has been written to gain persistence. It'll edit the registry so that it can run on startup, so restarting your system makes no difference.
Only exploits that require human intervention would be defeated by this though. If you have a zero touch exploit that can privesc, the persistance doesnt need to be anything special, you can just wrap your exploit in an ordinary android app and request it be woken up on next boot.
- Not necessarily true. It could be a buffer overflow in text message processing, it's still requires a text message to be sent to the phone.
  It could be a Wi-Fi or Bluetooth exploit, which requires locality.
  It could be a browser, webview, certificate exploit that requires a sophisticated chain of events with a low probability to intercept a web page and get the user to do something that isn't guaranteed.
  The exploit might display itself to a user on the phone, so every time it's applied there's a risk of discovery.
  Not to mention many advanced persistent threats do not want their exploits to be analyzed, so they will not leave them sitting around to be collected, just waiting for the device to need a reinfection. That's valuable signals capability that you give to your adversary they just need to analyze it.
Just be mindful when restarting automatically, as some OS offer. It's neat not having to remember to manually restart every few days, but your pending notifications will get lost and, depending on your setup, your cellular/network connections will not automatically reconnect until you login.
It also guarantees you will cycle keys out of memory, which is always a good idea when crossing borders and whatnot.
It is also a good idea for computing devices in general since not restarting means effectively restarting and finding out that the restart didn't work properly or that you do not have all the information needed to log back in at the worst possible time, one you didn't choose yourself. And if you do it often enough the number of updates/changes that could be the cause is significantly lower than if you keep things running for a long time before a restart.

While true and they have a point...

With having to do a restart after installing major programs the headline sounded like it's from a satire site for an article about NSA snooping.

Like, they just did an update and now we all need to reboot lol

I completely thought it was an Onion headline.
I mean this has been a cybersecurity best practice forever. If anything, it's someone at the NSA having a chuckle knowing how the cynics will react to something which is barely a step above common sense.

"have you tried swtching it off and on again" solves 90% of support requests - at least for a little while ;-)

It solves virtually none of them, it is pretty good at destroying all the evidence needed to actually fix the problem for good though.
- I don't have 40 hours to dedicate to a single error message that pops up only on Tuesdays during a full moon and Jeff just needs to print his stupid report.
- I hate when a restart fixes it. It means it will never be fixed.
- we are not talking about backend systems here.
  we are talking about user devices in the wild, likely in an unknown state, with highly variable usage patterns by the user. someone with experience can usually determine how deeply to poke based on 30 seconds of questioning the user.
  "reboot" is absolutely valid when the issue is trivial, non-recurring and the equipment is not sensitive. if a reboot destroys logs then the device was not important to you to begin with.
- Are you a doctor? Coz living beings is the only case I can think of where this is true.
- My experience has been the exact opposite of this.
  Restarting a system gets it into a known state making debugging easier.
  There are times you don't want to restart, if your a software developer and a long lived process is behaving erratically and you haven't been able to figure out why via telemetry and this problem has been super hard to reproduce...... But this is a very niche and rare circumstance. Most scenarios the first priority is to get things working ASAP, so the first thing you do is restart.
  Hell, many production systems restart periodically to just get closer to a known good state as a matter of hygiene.

well clearly there must be someone at that evil organization with a soul then

They are very competent.
National security agency. They understand security.
The problem is usually around incentives... What is good for the national security may not be good for the individual and vise versa.
When the incentives line up, they are the good guys.
So when they talk about defending American infrastructure against state actors in the context of Russia or China, the advice is good.
When they talk about why people don't need end to end encryption or why public cryptography is a national threat... The advice is bad.
That or their root kit requires a manual reboot to start working.
- they don't even need to put shit directly on our devices to get what they want really, they have a wiretap into all the advertising companies and all the internet providers and all the cellphone and land line providers. They have a wiretap into every remotely accessible camera system. They don't need to come up with more invasive ways to get into all our shit but they keep doing it.

wait, you guys don't switch it off during the night?

It has my morning alarm, so, no.
- wait, your phone doesn't switch on to ring alarms? i thought all smartphones do that. all androud phones i have do. they don't do a full boot, just sound an alarm and show options to fully start, snooze or end the alarm
  // edit
  I learned that some brands don't implement that feature. For example: Samsung does not, but Honor does.