8 ms·

Mobile Devices Compromised by Fake Secure Messaging Clients

129 points by Dowwie 9y ago

staplers 9y ago
Some pin codes were within their validity window at the time of writing this report. Wew I can't imagine being one of the targets and getting this memo.. "Your device has been compromised for the last 5 years."
AdmiralAsshat 9y ago
I glanced at the report, but I'm not seeing much on how these devices get compromised. Let's say I'm a targeted individual with an iPhone or an Android phone. I've already got Signal installed through the app store, which should be vetting the apps I download. How does my legitimate Signal app get replaced with an infected one?
- tptacek 9y ago
  iPhone users aren't targeted. It's difficult to install trojaned Signal on an iPhone, since you can't sideload them from random websites. You're infected by being phished to a staging server that looks like a legitimate launcher/installer site for secure messengers; that site delivers Android Java applications for WhatsApp, Signal, &c, but those applications are backdoored to ask for all possible permissions and to quietly set up a C&C channel back to the operators.
  - 05 9y ago
    It’s not really that difficult. Just create a clone app, pass the initial store review, then change the icon/description to be close to the official app in an update, and opt out of AppStore search, so that it can only be accessed through a link. It’s just that the payoff is much less impressive than on Android.. although, I guess, you can always try to sneak in a VPN entitlement, and hope the reviewer is extra incompetent that day..
    - tptacek 9y ago
      That assumes that Apple hasn't automated the process of hunting those particular targeted applications out, which is not a safe assumption anymore. To be fair: I'm pretty certain Google also automates detection of this stuff. The problem with Android is sideloading. Apple was right about this.
      - loup-vaillant 9y ago
        > Apple was right about this. I hate it when Apple is right. And I hate that their golden numerical prison has genuine advantages over the alternatives. Assuming users cannot be fixed, what can? Users sideload apps from the web, right? Can't there be an easy way to distinguish trustworthy communications from potentially dangerous ones? Would such a way be systematically worked around by ever cleverer phishers?
        mulmen 9y ago
        With great power comes great responsibility. There is no way to give users more power without also giving them more responsibility.
      - cageface 9y ago
        Making side loading opt-in and warning users of the security risks seems like a better compromise to me than requiring that every app on my phone is vetted by a single gatekeeper. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." and all that.
        geocar 9y ago
        > requiring that every app on my phone is vetted by a single gatekeeper. What are you referring to here? I just installed an SNES emulator on my iPhone without jailbreaking and without paying Apple for a developer account. I don't think Apple knows anything about the app.
  - kuschku 9y ago
    The largest infection vector for Signal are people that don’t use the Play Store. (Well, used to be). For a long time, Moxie refused to offer it on any other store, or official APK downloads, so users then just googled for it, and downloaded the first result. Whenever you make it hard to do something securely, users will find a way around that. And that will usually break all your security precautions.
  - saurik 9y ago
    > It's difficult to install trojaned Signal on an iPhone, since you can't sideload them from random websites. FWIW, you definitely can do this (you go to a webpage and it asks you to install a product) with an "enterprise" certificate, but the idea (true or not) is that Apple then knows who the developer is; so, so if you someone noticed and reports them, Apple is supposed to be able to do something about it (again, that's the theory).
- patrickas 9y ago
  I thought it was interesting that the reports mentions some devices are compromised at the phone repair shop right after being repaired.
tptacek 9y ago
Not a whole lot of new lessons to be learned from this, but basic reinforcement of old ones: * It's easy to get users, even high-profile at-risk users, to install arbitrary applications. Since there's little to be gained from litigating this basic fact, we have to work around it. We recommend at-risk users stick to relatively recent iPhones, not because Android phones can't be made to be asymptotically as secure, but simply because it's more difficult (technically and logistically) to set up a deployment process that gets an application installed on an iPhone that can do as much as these backdoored Android apps can. * The biggest threat facing users on general-purpose computers (Windows or Mac) is email attachments. The most profitable desktop infection vector here seems to have been Word macros. There's no point in litigating whether people should or shouldn't use Word documents; they're going to do that. So we have to work around that. Our recommendation is that users be trained not to view attachments on general-purpose computers by clicking on them. Two options: view attachments on iOS devices, where the viewers are less privileged and less full-featured, or always opening them using Google's office tools. To me, the big lesson of the past few years working with non-technical users targeted by attackers is: general purpose computers simply aren't secure, and can't (for normal users) be made secure. Get people out of computer apps and onto phone or web apps.
- j_s 9y ago
  >as much as these backdoored iPhone apps s/iPhone/Android/ ??
  - tptacek 9y ago
    thx
- niftich 9y ago
  I made this point [1] about the latest side-channel attacks: mixing various kinds of activities -- business and pleasure, familiar and unknown, critical and discretionary -- on the same computer is bad hygiene, at least with the sort of computers that are widespread today, and we ought to lift that conversation into the mainstream to point out the deficiencies of contemporary technology in the light of users' expectations and demands. A robust defense against the likes of Meltdown and the likes of Word macros is to perform the work in an environment from which the context of execution cannot escape, and cannot cause the infiltration of data into itself by exfiltrating it from a sibling or a neighbor. Historically the most successful way of achieving this is to use separate hardware, but that's a burden most users won't accept. [1] https://news.ycombinator.com/item?id=16165942 https://news.ycombinator.com/item?id=16165942
ggm 9y ago
Please, can somebody explain the threat model in android if you don't sideload?
- mattnewton 9y ago
  Just fake play store entries. One example of many: http://bgr.com/2017/11/05/whatsapp-android-google-play-store-fake-app/ http://bgr.com/2017/11/05/whatsapp-android-google-play-store...
  - gtirloni 9y ago
    Additionally, at least on the Play Store, you can have ads showing before search results. Right now, if I search for Signal, WhatsApp, Telegram or Wire, the first result is the official app. If I search for Messenger, an ad for Facebook comes at first and the second entry is something called "The Messenger" from a company I never heard of. There's where user confusion starts enabling these attacks. I remember this being worse in the recent past though.
  - ggm 9y ago
    Thanks. I'm more scared than I was. I think I was naieve enough to believe the automated store checks picked this stuff up. I suspect the T&C were written by competent lawyers but this feels like a situation where if the barriers to entry in the store aren't high enough, then google as the storekeeper has the liability, if they determine trustedness as the 'editor' of what is or is not allowed into the store. When it comes to content, the government seems to take this view: if you publish the kind of material the government forbids in law, you either have a common carrier defence that you publish EVERYTHING or, you have the role of selecting what is published and acquire liability because of that moment of choice. Automatic choice doesn't absolve you of the onus of checking.

129 points by Dowwie 9y ago

Some pin codes were within their validity window at the time of writing this report. Wew I can't imagine being one of the targets and getting this memo.. "Your device has been compromised for the last 5 years."

AdmiralAsshat 9y ago

I glanced at the report, but I'm not seeing much on how these devices get compromised. Let's say I'm a targeted individual with an iPhone or an Android phone. I've already got Signal installed through the app store, which should be vetting the apps I download. How does my legitimate Signal app get replaced with an infected one?

tptacek 9y ago
iPhone users aren't targeted. It's difficult to install trojaned Signal on an iPhone, since you can't sideload them from random websites. You're infected by being phished to a staging server that looks like a legitimate launcher/installer site for secure messengers; that site delivers Android Java applications for WhatsApp, Signal, &c, but those applications are backdoored to ask for all possible permissions and to quietly set up a C&C channel back to the operators.
- 05 9y ago
  It’s not really that difficult. Just create a clone app, pass the initial store review, then change the icon/description to be close to the official app in an update, and opt out of AppStore search, so that it can only be accessed through a link. It’s just that the payoff is much less impressive than on Android.. although, I guess, you can always try to sneak in a VPN entitlement, and hope the reviewer is extra incompetent that day..
  - tptacek 9y ago
    That assumes that Apple hasn't automated the process of hunting those particular targeted applications out, which is not a safe assumption anymore. To be fair: I'm pretty certain Google also automates detection of this stuff. The problem with Android is sideloading. Apple was right about this.
    - loup-vaillant 9y ago
      > Apple was right about this. I hate it when Apple is right. And I hate that their golden numerical prison has genuine advantages over the alternatives. Assuming users cannot be fixed, what can? Users sideload apps from the web, right? Can't there be an easy way to distinguish trustworthy communications from potentially dangerous ones? Would such a way be systematically worked around by ever cleverer phishers?
      - mulmen 9y ago
        With great power comes great responsibility. There is no way to give users more power without also giving them more responsibility.
    - cageface 9y ago
      Making side loading opt-in and warning users of the security risks seems like a better compromise to me than requiring that every app on my phone is vetted by a single gatekeeper. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." and all that.
      - geocar 9y ago
        > requiring that every app on my phone is vetted by a single gatekeeper. What are you referring to here? I just installed an SNES emulator on my iPhone without jailbreaking and without paying Apple for a developer account. I don't think Apple knows anything about the app.
- kuschku 9y ago
  The largest infection vector for Signal are people that don’t use the Play Store. (Well, used to be). For a long time, Moxie refused to offer it on any other store, or official APK downloads, so users then just googled for it, and downloaded the first result. Whenever you make it hard to do something securely, users will find a way around that. And that will usually break all your security precautions.
- saurik 9y ago
  > It's difficult to install trojaned Signal on an iPhone, since you can't sideload them from random websites. FWIW, you definitely can do this (you go to a webpage and it asks you to install a product) with an "enterprise" certificate, but the idea (true or not) is that Apple then knows who the developer is; so, so if you someone noticed and reports them, Apple is supposed to be able to do something about it (again, that's the theory).
patrickas 9y ago
I thought it was interesting that the reports mentions some devices are compromised at the phone repair shop right after being repaired.

tptacek 9y ago

Not a whole lot of new lessons to be learned from this, but basic reinforcement of old ones: * It's easy to get users, even high-profile at-risk users, to install arbitrary applications. Since there's little to be gained from litigating this basic fact, we have to work around it. We recommend at-risk users stick to relatively recent iPhones, not because Android phones can't be made to be asymptotically as secure, but simply because it's more difficult (technically and logistically) to set up a deployment process that gets an application installed on an iPhone that can do as much as these backdoored Android apps can. * The biggest threat facing users on general-purpose computers (Windows or Mac) is email attachments. The most profitable desktop infection vector here seems to have been Word macros. There's no point in litigating whether people should or shouldn't use Word documents; they're going to do that. So we have to work around that. Our recommendation is that users be trained not to view attachments on general-purpose computers by clicking on them. Two options: view attachments on iOS devices, where the viewers are less privileged and less full-featured, or always opening them using Google's office tools. To me, the big lesson of the past few years working with non-technical users targeted by attackers is: general purpose computers simply aren't secure, and can't (for normal users) be made secure. Get people out of computer apps and onto phone or web apps.

j_s 9y ago
>as much as these backdoored iPhone apps s/iPhone/Android/ ??
- tptacek 9y ago
  thx
niftich 9y ago
I made this point [1] about the latest side-channel attacks: mixing various kinds of activities -- business and pleasure, familiar and unknown, critical and discretionary -- on the same computer is bad hygiene, at least with the sort of computers that are widespread today, and we ought to lift that conversation into the mainstream to point out the deficiencies of contemporary technology in the light of users' expectations and demands. A robust defense against the likes of Meltdown and the likes of Word macros is to perform the work in an environment from which the context of execution cannot escape, and cannot cause the infiltration of data into itself by exfiltrating it from a sibling or a neighbor. Historically the most successful way of achieving this is to use separate hardware, but that's a burden most users won't accept. [1] https://news.ycombinator.com/item?id=16165942 https://news.ycombinator.com/item?id=16165942

ggm 9y ago

Please, can somebody explain the threat model in android if you don't sideload?

mattnewton 9y ago
Just fake play store entries. One example of many: http://bgr.com/2017/11/05/whatsapp-android-google-play-store-fake-app/ http://bgr.com/2017/11/05/whatsapp-android-google-play-store...
- gtirloni 9y ago
  Additionally, at least on the Play Store, you can have ads showing before search results. Right now, if I search for Signal, WhatsApp, Telegram or Wire, the first result is the official app. If I search for Messenger, an ad for Facebook comes at first and the second entry is something called "The Messenger" from a company I never heard of. There's where user confusion starts enabling these attacks. I remember this being worse in the recent past though.
- ggm 9y ago
  Thanks. I'm more scared than I was. I think I was naieve enough to believe the automated store checks picked this stuff up. I suspect the T&C were written by competent lawyers but this feels like a situation where if the barriers to entry in the store aren't high enough, then google as the storekeeper has the liability, if they determine trustedness as the 'editor' of what is or is not allowed into the store. When it comes to content, the government seems to take this view: if you publish the kind of material the government forbids in law, you either have a common carrier defence that you publish EVERYTHING or, you have the role of selecting what is published and acquire liability because of that moment of choice. Automatic choice doesn't absolve you of the onus of checking.