11 ms·

Qualcomm’s Chain of Trust

180 points by krtkush 8y ago

ohazi 8y ago
Without some pretty drastic changes, I don't think I'm ever going to feel confident that a computer with a Qualcomm or Broadcom SoC can be made secure. These two companies are basically the worst at making their documentation / datasheets / code available for inspection. The article suggests that the boot process has been simplified, but as an outsider it still looks astoundingly complex, and the "random oem additions that are likely to be insecure" part is absolutely terrifying. Am I wrong?
voltagex_ 8y ago
>Motorola’s use of a single QFUSE that must be blown to unlock the device, permanently voiding the warranty. If this isn't illegal (the warranty part), it should be.
- drdaeman 8y ago
  Not that simple. Depends on what warranty is on. Hardware warranty shouldn't be generally affected, unless it's about parts that can fail because of software malfunction - e.g. when failsafes are defined in user-overridable software. It is fair that a hardware vendor shouldn't be responsible for user e.g. overclocking something. Software warranty should be voided. Although I can't remember when it was the last time I saw a warranty for software, explicit or implied. Rather, I believe there's an explicit dismissal of any warranties in every single licensing agreement out there.
  - taneq 8y ago
    My phone's screen sometimes wouldn't come back on after a phone call. The sound quality transmitted was sometimes terrible. Both of those things present as hardware problems (prox sensor, microphone) but turned out to be software related. How would you prove that a hardware problem's not actually software? As an aside, LineageOS seems to have been getting gradually more buggy on my Nexus 5X. 15.1 has the two issues above, plus Bluetooth music streaming is broken and crashes the music player. I reverted to an old 14.1 ROM and everything works perfectly.
    - craftyguy 8y ago
      > As an aside, LineageOS seems to have been getting gradually more buggy on my Nexus 5X. 15.1 has the two issues above, plus Bluetooth music streaming is broken and crashes the music player. I have none of those problems with 15.1 on my nexus 5x, but I also make it a point to install the latest weekly updates and the latest vendor partition blob.
      - taneq 8y ago
        Maybe I set it up wrong, then? My basic install flow: - Get latest nightly build from lineageos.org - Get matching factory image from Google and extract vendor and radio images from it - Install TWRP - Do a full wipe of the phone - Install LineageOS, vendor image and radio image Then when an OTA update came out, I'd install it and update the vendor image manually if it complained. What'd I miss?
        craftyguy 8y ago
        That seems about right, and similar to what I do. Maybe it's a hardware issue? I also don't use the default music app for streaming music over bluetooth, so it could be an issue with that..
        taneq 8y ago
        Yeah, I assumed it was hardware (there's a known issue with some 5Xes with poor mic quality) but I've gone back to 14.1 and all is fixed, so meh. The only thing I really miss is the new power saving features and I can live with charging every two days instead of every three days.
        craftyguy 8y ago
        > I can live with charging every two days instead of every three days. Yea it's incredible how long the battery lasts on this device, compared to previous nexus devices (though I never owned a nexus 5..) I've only ever run lineageos on this thing and regularly get multiple days on a charge with light/moderate usage. I once took it on a 8 day backpacking trip where it was powered on but in airplane mode (to serve as camera and backup map), got out of the wilderness with something like 40% battery left. IMHO that really shows how much negative impact on performance google's shit has on a mobile device when it can last that long without it.
- mjones72 8y ago
  It is illegal.
  - gehsty 8y ago
    Yep and if the teacher doesn’t arrive in 10 minutes you can legally leave the class room. Come on. If you modify the device to work in a way it wasn’t intended (eg overclocked) you have clearly voided the warranty. This is what this is there to detect.
    - mjones72 8y ago
      https://fsfe.org/freesoftware/legal/flashingdevices.en.html https://fsfe.org/freesoftware/legal/flashingdevices.en.html You are moving the goalposts, because we were talking about "changing the ROM", not about "changing the ROM and then doing something that will fuck the hardware up"
      - SmellyGeekBoy 8y ago
        The point is that changing the ROM allows the user to do something that will "fuck the hardware". Presumably the stock ROM doesn't allow overclocking.
        mjones72 8y ago
        Even if changing the ROM allows me to break the hardware, just by changing the ROM I don't lose my right to have the mobile repaired under free warranty. The manufacturer has to prove I managed to break the hardware only because I changed the ROM. By the way, if you fuck up the CPU by overclocking it I guarantee they won't notice it because they will just throw the entire motherboard away. The subcontracted company that fixes your mobile (it's almost never the manufacturer) won't spend their time doing some CSI on it.
      - 1023bytes 8y ago
        Yep, in the EU it's definitely illegal.
- TheChaplain 8y ago
  I believe Samsung have/had something similar, though it doesn't blow on unlocking but only if you insert an unsigned kernel.
  - lozaning 8y ago
    It's also my understanding the rooting a samsung phone will forever disable samsung pay from working on it ever again.
- diaz 8y ago
  Haven't installed a rom on my sony xperia yet because it explicitly said in a few places that doing that voids the warranty. I still have around 1 year and half of waiting until mandatory warranty ends so I can feel ol with doing it.
JoshuaAshton 8y ago
I mean, why can't they just have a regular bootloader like a PC? It's a lot of effort for what is essentially 0 gain if you just have full device encryption. The phone should at least always be unlockable by a single switch in the developer settings - none of this "oh go to our website and generate an unlock code/pay us money for an unlock code/phone us" which is a HUGE pain in the butt. I swap between roms a lot, and the whole idea of a system partition and data partition etc is just stupid. They always are the wrong size for what they need to be and then I try to install gapps and its like "oh your system partition is too small my dude," so why separate these and just have everything like a regular linux OS. Maybe I'm missing something stupid? But I kinda just want a phone that just starts a linux based operating system like a PC, and lets me do everything I can on my linux PC in a touch-centric way.
- pjmlp 8y ago
  The PC was an accident, which IBM repented themselves quite heavily, tried to regain with PS2 and failed to do so. If the current trend of UEFI and laptops without any expansion options is any indication, that open PC of yore will fade into a very tiny niche, as computers become appliances.
  - snaky 8y ago
    The previous accident of that kind was UNIX. That's acute, considering an open-source is mainstream today - a couple of accidents is enough to change the world.
    - pjmlp 8y ago
      Yes, had Bell Labs not been forbidden to sell it, thus going to the market with a closed source OS, selling it the same price range as VMS, OS/360 and similar systems, the history outcome would have been quite different. Still anyone that has had the pleasure to write portable UNIX code knows that portability is relative.
      - snaky 8y ago
walrus01 8y ago
For those who haven't heard of it, LineageOS is essentially a fork of CyanogenMod. Cyanogen (the corporation) is now dead. OnePlus' oxygenOS which they ship on the 3, 3T, 5, and 6 is very close to cyanogenmod in functionality and no-bullshit-added android experience.
- snaky 8y ago
  And the OnePlus kernel and modem firmware are broken so much the maintainer of 3 and 3T LineageOS branches couldn't take it anymore. https://forum.xda-developers.com/showpost.php?p=76423626&postcount=4158 https://forum.xda-developers.com/showpost.php?p=76423626&pos... https://forum.xda-developers.com/showpost.php?p=76511525&postcount=4229 https://forum.xda-developers.com/showpost.php?p=76511525&pos...
  - SmellyGeekBoy 8y ago
    As a LineageOS OP3 user this is fascinating. Although presumably someone else picked this up as I'm still receiving updates.
    - snaky 8y ago
      15.1 is officially supported by LineageOS but it's not as good as 14.1, that's why 14.1 is still getting security updates thanks to denser@xda https://forum.xda-developers.com/showpost.php?p=77567550&postcount=4551 https://forum.xda-developers.com/showpost.php?p=77567550&pos...
- SmellyGeekBoy 8y ago
  "No bullshit added" if you ignore the insanely detailed tracking stuff they have/had running in the background. I've been running LineageOS ever since because of this. They make very nice hardware at a good price but I don't think their OS can be trusted at this point. (Citation: https://techcrunch.com/2017/10/15/user-outcry-prompts-oneplus-to-step-down-its-excessive-data-collection/ https://techcrunch.com/2017/10/15/user-outcry-prompts-oneplu...)
ggm 8y ago
so.. can somebody in SoC land explain to me if there is any technology extant, which can reliably un-blow a blown fuse on die, and not irrevocably ruin the entire chip? a lot gets built into these 'cannot be undone' moments. The cryptech people talked about building large capacitor circuits into their design to be charged up and blow the secure keystore if the tamper switch went "bing" but I always wonder if you could eg use a electron microscope to reverse engineer the keystore state before it was wiped.
- tinganho 8y ago
  I actually did a bit of research on this before. For easier chips like TPMs(Trusted Platform Module). What I've seen people do when trying to steal secrets(key) on a chip is to buy multiples of the same chip. On each chip expose the layer under a microscope(A chip exist of multiple layers, thats why we need multiple chips). Now, you know everything to reverse engineer the secrets. There exists tools for drilling and probing each trace on the chip. Here is an example. https://www.youtube.com/watch?v=h-hohCfo4LA https://www.youtube.com/watch?v=h-hohCfo4LA I think what you mean by charging a huge capacitor and blowing up the secrets. You refer to an HSM(Hardware Security Module). They typically have sensors to detect any fraudulent behavior. They are much harder hack. But there is always holes in each HSM. I think hackers use the same technic there as well. Buy multiple HSM to figure out the design. Reverse engineer the traces and try to probe without being detected on the target device. To my knowledge there are currently no sensors that are 100% bullet proof. They can either be fooled or have weak spots.
  - baybal2 8y ago
    Gemalto at least had that flaw - it had a lot of circuits to detect probing, but a circuit that feeds fuse blower is easy to disconnect/damage even under optical microscope
  - teddyh 8y ago
    > On each chip expose the layer under a microscope Or use X-ray tomography: https://news.ycombinator.com/item?id=13952016 https://news.ycombinator.com/item?id=13952016
bass_case 8y ago
I have nipples, Greg. Can you milk me?
- sctb 8y ago
  Not here, please. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
DoctorOetker 8y ago
>QFUSE: Microscopic hardware fuse that is integrated into the SoC - Once physically blown, impossible to reset or replace I understand that once set, it can't be restored. My question: could some of the earliest priviliged states decide to burn unburnt fuses of the public key? or is there an extra special root fuse which only allows burning the key fuses if it isn't yet burnt, and which is burnt as soon as the root public key is burnt? This may seem irrelevant if we don't have access to the privileged states, but perhaps with hardware vulnerabilities as we have been seeing more and more, it may conceivably be possible to force it to run code to burn an unburnt fuse of the key. I.e. perhaps we can set bits in the public key such that the new key is easier to factor? (in case of say RSA) EDIT: if this is possible we could sign our own root bootloader
- Ristovski 8y ago
  There is a fuse-antifuse pair most likely. Think of it this way: You burn the bits "0001" into some fuse bank, which is mirrored in an anti-fuse bank that now equals "1110". You can burn the unburned fuses in the normal bank, but can't unburn them in the antifuse bank.
  - DoctorOetker 8y ago
    thanks, I actually thought of that, but it seems rather inefficient compared to a single fuse, unblown before writing a key, blown after written key is verified as correctly written, once blown no fuses for this key can be blown... But I don't know if they actually use such a system, or perhaps they simply assume the attackers never get fuseblowing privilege, and perhaps they assume that a key in a blown set of fuses is no longer rewritable...

180 points by krtkush 8y ago

Without some pretty drastic changes, I don't think I'm ever going to feel confident that a computer with a Qualcomm or Broadcom SoC can be made secure. These two companies are basically the worst at making their documentation / datasheets / code available for inspection. The article suggests that the boot process has been simplified, but as an outsider it still looks astoundingly complex, and the "random oem additions that are likely to be insecure" part is absolutely terrifying. Am I wrong?

voltagex_ 8y ago

>Motorola’s use of a single QFUSE that must be blown to unlock the device, permanently voiding the warranty. If this isn't illegal (the warranty part), it should be.

drdaeman 8y ago
Not that simple. Depends on what warranty is on. Hardware warranty shouldn't be generally affected, unless it's about parts that can fail because of software malfunction - e.g. when failsafes are defined in user-overridable software. It is fair that a hardware vendor shouldn't be responsible for user e.g. overclocking something. Software warranty should be voided. Although I can't remember when it was the last time I saw a warranty for software, explicit or implied. Rather, I believe there's an explicit dismissal of any warranties in every single licensing agreement out there.
- taneq 8y ago
  My phone's screen sometimes wouldn't come back on after a phone call. The sound quality transmitted was sometimes terrible. Both of those things present as hardware problems (prox sensor, microphone) but turned out to be software related. How would you prove that a hardware problem's not actually software? As an aside, LineageOS seems to have been getting gradually more buggy on my Nexus 5X. 15.1 has the two issues above, plus Bluetooth music streaming is broken and crashes the music player. I reverted to an old 14.1 ROM and everything works perfectly.
  - craftyguy 8y ago
    > As an aside, LineageOS seems to have been getting gradually more buggy on my Nexus 5X. 15.1 has the two issues above, plus Bluetooth music streaming is broken and crashes the music player. I have none of those problems with 15.1 on my nexus 5x, but I also make it a point to install the latest weekly updates and the latest vendor partition blob.
    - taneq 8y ago
      Maybe I set it up wrong, then? My basic install flow: - Get latest nightly build from lineageos.org - Get matching factory image from Google and extract vendor and radio images from it - Install TWRP - Do a full wipe of the phone - Install LineageOS, vendor image and radio image Then when an OTA update came out, I'd install it and update the vendor image manually if it complained. What'd I miss?
      - craftyguy 8y ago
        That seems about right, and similar to what I do. Maybe it's a hardware issue? I also don't use the default music app for streaming music over bluetooth, so it could be an issue with that..
        taneq 8y ago
        Yeah, I assumed it was hardware (there's a known issue with some 5Xes with poor mic quality) but I've gone back to 14.1 and all is fixed, so meh. The only thing I really miss is the new power saving features and I can live with charging every two days instead of every three days.
        craftyguy 8y ago
        > I can live with charging every two days instead of every three days. Yea it's incredible how long the battery lasts on this device, compared to previous nexus devices (though I never owned a nexus 5..) I've only ever run lineageos on this thing and regularly get multiple days on a charge with light/moderate usage. I once took it on a 8 day backpacking trip where it was powered on but in airplane mode (to serve as camera and backup map), got out of the wilderness with something like 40% battery left. IMHO that really shows how much negative impact on performance google's shit has on a mobile device when it can last that long without it.
mjones72 8y ago
It is illegal.
- gehsty 8y ago
  Yep and if the teacher doesn’t arrive in 10 minutes you can legally leave the class room. Come on. If you modify the device to work in a way it wasn’t intended (eg overclocked) you have clearly voided the warranty. This is what this is there to detect.
  - mjones72 8y ago
    https://fsfe.org/freesoftware/legal/flashingdevices.en.html https://fsfe.org/freesoftware/legal/flashingdevices.en.html You are moving the goalposts, because we were talking about "changing the ROM", not about "changing the ROM and then doing something that will fuck the hardware up"
    - SmellyGeekBoy 8y ago
      The point is that changing the ROM allows the user to do something that will "fuck the hardware". Presumably the stock ROM doesn't allow overclocking.
      - mjones72 8y ago
        Even if changing the ROM allows me to break the hardware, just by changing the ROM I don't lose my right to have the mobile repaired under free warranty. The manufacturer has to prove I managed to break the hardware only because I changed the ROM. By the way, if you fuck up the CPU by overclocking it I guarantee they won't notice it because they will just throw the entire motherboard away. The subcontracted company that fixes your mobile (it's almost never the manufacturer) won't spend their time doing some CSI on it.
    - 1023bytes 8y ago
      Yep, in the EU it's definitely illegal.
TheChaplain 8y ago
I believe Samsung have/had something similar, though it doesn't blow on unlocking but only if you insert an unsigned kernel.
- lozaning 8y ago
  It's also my understanding the rooting a samsung phone will forever disable samsung pay from working on it ever again.
diaz 8y ago
Haven't installed a rom on my sony xperia yet because it explicitly said in a few places that doing that voids the warranty. I still have around 1 year and half of waiting until mandatory warranty ends so I can feel ol with doing it.

JoshuaAshton 8y ago

I mean, why can't they just have a regular bootloader like a PC? It's a lot of effort for what is essentially 0 gain if you just have full device encryption. The phone should at least always be unlockable by a single switch in the developer settings - none of this "oh go to our website and generate an unlock code/pay us money for an unlock code/phone us" which is a HUGE pain in the butt. I swap between roms a lot, and the whole idea of a system partition and data partition etc is just stupid. They always are the wrong size for what they need to be and then I try to install gapps and its like "oh your system partition is too small my dude," so why separate these and just have everything like a regular linux OS. Maybe I'm missing something stupid? But I kinda just want a phone that just starts a linux based operating system like a PC, and lets me do everything I can on my linux PC in a touch-centric way.

pjmlp 8y ago
The PC was an accident, which IBM repented themselves quite heavily, tried to regain with PS2 and failed to do so. If the current trend of UEFI and laptops without any expansion options is any indication, that open PC of yore will fade into a very tiny niche, as computers become appliances.
- snaky 8y ago
  The previous accident of that kind was UNIX. That's acute, considering an open-source is mainstream today - a couple of accidents is enough to change the world.
  - pjmlp 8y ago
    Yes, had Bell Labs not been forbidden to sell it, thus going to the market with a closed source OS, selling it the same price range as VMS, OS/360 and similar systems, the history outcome would have been quite different. Still anyone that has had the pleasure to write portable UNIX code knows that portability is relative.
    - snaky 8y ago

walrus01 8y ago

For those who haven't heard of it, LineageOS is essentially a fork of CyanogenMod. Cyanogen (the corporation) is now dead. OnePlus' oxygenOS which they ship on the 3, 3T, 5, and 6 is very close to cyanogenmod in functionality and no-bullshit-added android experience.

snaky 8y ago
And the OnePlus kernel and modem firmware are broken so much the maintainer of 3 and 3T LineageOS branches couldn't take it anymore. https://forum.xda-developers.com/showpost.php?p=76423626&postcount=4158 https://forum.xda-developers.com/showpost.php?p=76423626&pos... https://forum.xda-developers.com/showpost.php?p=76511525&postcount=4229 https://forum.xda-developers.com/showpost.php?p=76511525&pos...
- SmellyGeekBoy 8y ago
  As a LineageOS OP3 user this is fascinating. Although presumably someone else picked this up as I'm still receiving updates.
  - snaky 8y ago
    15.1 is officially supported by LineageOS but it's not as good as 14.1, that's why 14.1 is still getting security updates thanks to denser@xda https://forum.xda-developers.com/showpost.php?p=77567550&postcount=4551 https://forum.xda-developers.com/showpost.php?p=77567550&pos...
SmellyGeekBoy 8y ago
"No bullshit added" if you ignore the insanely detailed tracking stuff they have/had running in the background. I've been running LineageOS ever since because of this. They make very nice hardware at a good price but I don't think their OS can be trusted at this point. (Citation: https://techcrunch.com/2017/10/15/user-outcry-prompts-oneplus-to-step-down-its-excessive-data-collection/ https://techcrunch.com/2017/10/15/user-outcry-prompts-oneplu...)

ggm 8y ago

so.. can somebody in SoC land explain to me if there is any technology extant, which can reliably un-blow a blown fuse on die, and not irrevocably ruin the entire chip? a lot gets built into these 'cannot be undone' moments. The cryptech people talked about building large capacitor circuits into their design to be charged up and blow the secure keystore if the tamper switch went "bing" but I always wonder if you could eg use a electron microscope to reverse engineer the keystore state before it was wiped.

tinganho 8y ago
I actually did a bit of research on this before. For easier chips like TPMs(Trusted Platform Module). What I've seen people do when trying to steal secrets(key) on a chip is to buy multiples of the same chip. On each chip expose the layer under a microscope(A chip exist of multiple layers, thats why we need multiple chips). Now, you know everything to reverse engineer the secrets. There exists tools for drilling and probing each trace on the chip. Here is an example. https://www.youtube.com/watch?v=h-hohCfo4LA https://www.youtube.com/watch?v=h-hohCfo4LA I think what you mean by charging a huge capacitor and blowing up the secrets. You refer to an HSM(Hardware Security Module). They typically have sensors to detect any fraudulent behavior. They are much harder hack. But there is always holes in each HSM. I think hackers use the same technic there as well. Buy multiple HSM to figure out the design. Reverse engineer the traces and try to probe without being detected on the target device. To my knowledge there are currently no sensors that are 100% bullet proof. They can either be fooled or have weak spots.
- baybal2 8y ago
  Gemalto at least had that flaw - it had a lot of circuits to detect probing, but a circuit that feeds fuse blower is easy to disconnect/damage even under optical microscope
- teddyh 8y ago
  > On each chip expose the layer under a microscope Or use X-ray tomography: https://news.ycombinator.com/item?id=13952016 https://news.ycombinator.com/item?id=13952016

bass_case 8y ago

I have nipples, Greg. Can you milk me?

sctb 8y ago
Not here, please. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

DoctorOetker 8y ago

>QFUSE: Microscopic hardware fuse that is integrated into the SoC - Once physically blown, impossible to reset or replace I understand that once set, it can't be restored. My question: could some of the earliest priviliged states decide to burn unburnt fuses of the public key? or is there an extra special root fuse which only allows burning the key fuses if it isn't yet burnt, and which is burnt as soon as the root public key is burnt? This may seem irrelevant if we don't have access to the privileged states, but perhaps with hardware vulnerabilities as we have been seeing more and more, it may conceivably be possible to force it to run code to burn an unburnt fuse of the key. I.e. perhaps we can set bits in the public key such that the new key is easier to factor? (in case of say RSA) EDIT: if this is possible we could sign our own root bootloader

Ristovski 8y ago
There is a fuse-antifuse pair most likely. Think of it this way: You burn the bits "0001" into some fuse bank, which is mirrored in an anti-fuse bank that now equals "1110". You can burn the unburned fuses in the normal bank, but can't unburn them in the antifuse bank.
- DoctorOetker 8y ago
  thanks, I actually thought of that, but it seems rather inefficient compared to a single fuse, unblown before writing a key, blown after written key is verified as correctly written, once blown no fuses for this key can be blown... But I don't know if they actually use such a system, or perhaps they simply assume the attackers never get fuseblowing privilege, and perhaps they assume that a key in a blown set of fuses is no longer rewritable...