4 ms·

> I don't just worry about it because of the tracking, but also pushing false over the air updates. Pretty sure OTA updates are signed, and signatures checked,

> I don't just worry about it because of the tracking, but also pushing false over the air updates. Pretty sure OTA updates are signed, and signatures checked, so you'd need to steal a vendor's private key. Those are almost certainly kept on a hardware security module, so it's not an easy task at all.

stuntkite 8y ago
I'd hope for most things on my iphone or newish name brand android, but I don't have the audits to prove it for everything. There were some amazing phishing attacks way back when the iPhone could do a single click jailbreak through the web. While that scene publicly is mostly dead for people that want a Cydia app, there's definitely a big money private game that still exists. I don't think it's a totally safe assumption to just trust that a sophisticated man in the middle at a dense event isn't possible. Unlikely, sure... Maybe I'm not even the best target. My 75 year old uncle with his thrift store Android might be in a common set of outdated devices ripe for picking, and wouldn't be able to catch a phish if it slapped him. Let alone something that didn't need user input. That's a pretty reasonable inroad to all sorts of stuff if your patient and inclined. I dunno, I think it's a reasonable thing to at least ponder in our current world of ubiquitous barely updated pocket linux slabs.
- geofft 8y ago
  Jailbreaks through the web are always a threat - they don't stop being a threat because you're using a legit cell tower. So I think that "what if there's a low-interaction 0-day" doesn't really interact with Stingrays. If you're worried about it, avoiding events where Stingrays are likely to be used doesn't really help you. iOS does verify OS software via a secure-boot-style chain of trust, starting with a public key that's part of ROM, and there's rollback prevention for the OS, the baseband, and the Secure Enclave's software. https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf (At least, if you believe Apple, and if you don't, stop putting interesting info on your Apple cell phone.) Android also does verified boot https://source.android.com/security/verifiedboot/verified-boot https://source.android.com/security/verifiedboot/verified-bo... but device support is probably all over the place. I think that anything running Android 6 or later is required to use ARM TrustZone, but it's probably a lot easier to defeat than iOS's mechanism. Rupprecht et al. 2016 find that most devices on the market at the time - including the iPhone 5S and 6S and the Nexus 5 and 7 - would accept the LTE no-encryption mode ("EEA0") without showing any UI warning or indicator; see section 5 / table 2 in https://www.usenix.org/system/files/conference/woot16/woot16-paper-rupprecht.pdf https://www.usenix.org/system/files/conference/woot16/woot16... . They also find that some Huawei chipsets will accept the LTE no-integrity-protection mode ("EIA0"), although most devices reject that. I haven't seen a newer version of this research. NIST points out (https://csrc.nist.gov/CSRC/media/Presentations/LTE-Security-How-Good-is-it/images-media/day2_research_200-250.pdf https://csrc.nist.gov/CSRC/media/Presentations/LTE-Security-... slides 40 and 47 - warning, 3-megabyte PDF) that most phones support downgrading to older standards - which is what you want for roaming, but if you're in a densely populated area with a clear view of the sky and your phone shows "3G", maybe you should be suspicious. Your 75-year-old uncle with a thrift store Android is almost certainly at serious risk, yes, but I think his primary problem is that this Android isn't getting updates any more and there are just publicly known exploits that anyone can use. Personally, I'd say the best thing is to get him a ~$150 iPhone SE from one of the prepaid carriers, because that's what they're going for these days, the SE should have about two more years of security support lifecycle left, and it does have a Secure Enclave.
  - stuntkite 8y ago
    Thank you for your thoughtful breakdown and useful links!
kabdib 8y ago
That's putting a lot of faith in HW manufacturers' security practices. I've had conversations with ex-employees of a couple of large cell phone firms who know about their build systems, and am not willing to buy those brands now. (Think: Dedicated PCs, one builder for each major revision of a phone, basically unpatched for years, with magic and difficult to reproduce configurations. Don't know specifically about HSMs, but those seem unlikely given their level of care and sophistication).
- luma 8y ago
  That's a pretty accurate description of firmware build environments for a whole lot of products, not just cell phones.
  - kabdib 8y ago
    Once upon a time, a certain large maker of a popular video game console lost the hardware engineer's laptop where the source code for the game controller firmware was. I don't know the nature of the catastrophe, whether the code was accidentally deleted, or the drive failed, or perhaps the employee left and the the laptop got recycled. In any event, the source was gone. Source control? What's that? Sounds complicated and unnecessary. All you need are files on disk, right? "Wait, I thought your laptop had the source code. Um..." They wound up paying a consultant to disassemble the binary and turn it back into plausible C. For all I know, given the way that those firmware engineers wrote code, the recreated source was of better quality than the original. :-/ [I am trying real hard not to turn this into a "how bad can firmware code get" comment, but I do have to say that this was the same group where one contractor had written the firmware for a device, consisting of one massive function with a bunch of goto statements and static variables, with names like 'v' and 'x' and 'xx'. The contractor also seemed to think that removing whitespace from the program would make the binary run faster...]

stuntkite 8y ago

I'd hope for most things on my iphone or newish name brand android, but I don't have the audits to prove it for everything. There were some amazing phishing attacks way back when the iPhone could do a single click jailbreak through the web. While that scene publicly is mostly dead for people that want a Cydia app, there's definitely a big money private game that still exists. I don't think it's a totally safe assumption to just trust that a sophisticated man in the middle at a dense event isn't possible. Unlikely, sure... Maybe I'm not even the best target. My 75 year old uncle with his thrift store Android might be in a common set of outdated devices ripe for picking, and wouldn't be able to catch a phish if it slapped him. Let alone something that didn't need user input. That's a pretty reasonable inroad to all sorts of stuff if your patient and inclined. I dunno, I think it's a reasonable thing to at least ponder in our current world of ubiquitous barely updated pocket linux slabs.

geofft 8y ago
Jailbreaks through the web are always a threat - they don't stop being a threat because you're using a legit cell tower. So I think that "what if there's a low-interaction 0-day" doesn't really interact with Stingrays. If you're worried about it, avoiding events where Stingrays are likely to be used doesn't really help you. iOS does verify OS software via a secure-boot-style chain of trust, starting with a public key that's part of ROM, and there's rollback prevention for the OS, the baseband, and the Secure Enclave's software. https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf (At least, if you believe Apple, and if you don't, stop putting interesting info on your Apple cell phone.) Android also does verified boot https://source.android.com/security/verifiedboot/verified-boot https://source.android.com/security/verifiedboot/verified-bo... but device support is probably all over the place. I think that anything running Android 6 or later is required to use ARM TrustZone, but it's probably a lot easier to defeat than iOS's mechanism. Rupprecht et al. 2016 find that most devices on the market at the time - including the iPhone 5S and 6S and the Nexus 5 and 7 - would accept the LTE no-encryption mode ("EEA0") without showing any UI warning or indicator; see section 5 / table 2 in https://www.usenix.org/system/files/conference/woot16/woot16-paper-rupprecht.pdf https://www.usenix.org/system/files/conference/woot16/woot16... . They also find that some Huawei chipsets will accept the LTE no-integrity-protection mode ("EIA0"), although most devices reject that. I haven't seen a newer version of this research. NIST points out (https://csrc.nist.gov/CSRC/media/Presentations/LTE-Security-How-Good-is-it/images-media/day2_research_200-250.pdf https://csrc.nist.gov/CSRC/media/Presentations/LTE-Security-... slides 40 and 47 - warning, 3-megabyte PDF) that most phones support downgrading to older standards - which is what you want for roaming, but if you're in a densely populated area with a clear view of the sky and your phone shows "3G", maybe you should be suspicious. Your 75-year-old uncle with a thrift store Android is almost certainly at serious risk, yes, but I think his primary problem is that this Android isn't getting updates any more and there are just publicly known exploits that anyone can use. Personally, I'd say the best thing is to get him a ~$150 iPhone SE from one of the prepaid carriers, because that's what they're going for these days, the SE should have about two more years of security support lifecycle left, and it does have a Secure Enclave.
- stuntkite 8y ago
  Thank you for your thoughtful breakdown and useful links!

kabdib 8y ago

That's putting a lot of faith in HW manufacturers' security practices. I've had conversations with ex-employees of a couple of large cell phone firms who know about their build systems, and am not willing to buy those brands now. (Think: Dedicated PCs, one builder for each major revision of a phone, basically unpatched for years, with magic and difficult to reproduce configurations. Don't know specifically about HSMs, but those seem unlikely given their level of care and sophistication).

luma 8y ago
That's a pretty accurate description of firmware build environments for a whole lot of products, not just cell phones.
- kabdib 8y ago
  Once upon a time, a certain large maker of a popular video game console lost the hardware engineer's laptop where the source code for the game controller firmware was. I don't know the nature of the catastrophe, whether the code was accidentally deleted, or the drive failed, or perhaps the employee left and the the laptop got recycled. In any event, the source was gone. Source control? What's that? Sounds complicated and unnecessary. All you need are files on disk, right? "Wait, I thought your laptop had the source code. Um..." They wound up paying a consultant to disassemble the binary and turn it back into plausible C. For all I know, given the way that those firmware engineers wrote code, the recreated source was of better quality than the original. :-/ [I am trying real hard not to turn this into a "how bad can firmware code get" comment, but I do have to say that this was the same group where one contractor had written the firmware for a device, consisting of one massive function with a bunch of goto statements and static variables, with names like 'v' and 'x' and 'xx'. The contractor also seemed to think that removing whitespace from the program would make the binary run faster...]