5 ms·

Securing the Boot Process

77 points by mkesper 7y ago

use___net 7y ago
its not poss!
sneak 7y ago
TFA: > Most people remember when the FBI wanted a backdoor into iPhones and Tim Cook refused. Fewer people remember when the CCP wanted a backdoor into iCloud and Apple said yes, for fear of losing its largest growth market. Presently, all iCloud users in China are hosted by a Chinese company, in China, to which the CCP by law has full access. There is also a claim that Apple cancelled a plan to e2e encrypt iCloud phone backups, which would mean that Apple/FBI could no longer decrypt your phone’s backup. All iPhones logged in to iCloud are backing up to iCloud by default with encryption that Apple/FBI can read. The claim is that the FBI specifically requested that they not further secure this, which would prevent their current methods of easily accessing these backups. Note that your backups generally contain your complete iMessage and SMS history, including all attached images and videos. There’s little practical point in denying a backdoor into a seized phone if Apple/FBI already have a copy of everything on it that they can decrypt and read because your backups are encrypted to Apple, not you. (They do this because many, many people lose their device, and have forgotten their Apple ID password which then needs to be reset. The naïve solution to this is to simply encrypt the backups to an Apple key, which is always decryptable by Apple as required for restore after resetting your password via alternate ID verification. Unfortunately it puts every single user of iCloud backup at risk of bulk surveillance.) The whole thing is rather performative, like they are showing off for the market. Indeed, people well respected (such as the author of TFA) are repeating this meme without any of the associated caveats. Make sure you tell your family and friends to disable iCloud and more specifically, iCloud device backups if they value their privacy.
- mirimir 7y ago
  Yes, iCloud is not really private. You can use iTunes backup to your own computer. But then, that must be securely full-disk encrypted. And then it's you who'll be holding the password and/or key.
  - kohtatsu 7y ago
    iTunes backups support encryption without your computer needing FDE. There is also the idevicebackup2 commandline tool from the libimobiledevice suite for doing those backups on linux, mac, or windows hosts. Supports the iOS protocols, including the native backup encryption. https://www.libimobiledevice.org/ https://www.libimobiledevice.org/ Having a secure iOS device is possible: disable iCloud backups, probably disable messages and photos too, and use a custom numeric pin >10 digits (a lot more if you are using it as T9 input). The secure enclave's kdf is only configured for 100ms of stretching IIRC, but it's sufficient with a long pin code.
    - mirimir 7y ago
      I'd still rather have FDE, as well. For me, LUKS.
      - notyourday 7y ago
        I'd go as far as to say LUKS in plain mode, rather than ever so popular container LUKS.
      - kohtatsu 7y ago
        I have both, but if I could only have one I'd rely on the native iOS backup encryption. I trust Apple's implementation more than I trust myself accidentally leaving my disk unlocked in public. And I do trust myself not to leave my disk unlocked in public. (I know this is a digression from the topic but we're nicely tucked away at the bottom of the comments)
        mirimir 7y ago
        That's how they got DFS. Two agents pretended to have a lovers' argument at the library, to distract him, and the third grabbed his laptop. I don't use laptops anymore. Just host machines for VMs. And I always shut them all down, whenever I leave the building. I have a commercial UPS, with a deadman circuit. So I just cabled that line with the CAT6, and there are motorcycle-style kill switches in key places (desk, bathroom, kitchen and bed).
- lorenzhs 7y ago
  This is an article about securing the boot process on various platforms. Whatever your thoughts on Apple's cloud security practices (I'm not a fan either), it gets tedious to have this brought up every time an article is in any way related to Apple and security. Boot security matters, regardless of whether your cloud backups are end-to-end encrypted or not. I find calling it "rather performative" disingenuous.
  - sneak 7y ago
    Yes, my comment is orthogonal to the topic of the article. I’m just so incredibly tired of seeing people trot out this commonplace and false Tim Cook vs the FBI narrative entirely uncritically, which is precisely what TFA does.
bo1024 7y ago
I've always been pretty skeptical of secure boot and trusted hardware modules since it seems to generally mean "trusted by the manufacturer, not the user". The model feels like the manufacturer owns and controls the device, and the user is just barely trusted enough to press the boot key. Because of this I appreciated that the article stressed the importance of open-source firmware and called out companies like Intel for user-hostile approaches.
- userbinator 7y ago
  It's been like that since the beginning of "Trusted Computing" --- it was originally for DRM. Only within the last decade(!) has it been advocated strongly as a security feature, and my belief is that the companies (and the government) have realised that security paranoia is a powerful tool of control. Unfortunately most people won't question anything if it's "for security". I don't think open-source is really all that important, and the article is being very misleading in that respect; in fact, if we don't have the keys, all that being open-source does is to allow us to easily see how they're oppressing us. (Of course, there's also the Ken Thompson Hack --- inspecting the binary is the real way to determine if there's anything unusual.) This is a related article which everyone interested in this topic should read: https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html
  - coretx 7y ago
    I long back to the days when we said security is compromised when a adversary had physical access and that zero point many zero's 1 dollar jumper physically setting things to read only works just fine. Today I primarily don't trust my systems because of the manufacturers seeing me -the owner- as the #1 security risk and favoring corporate interest over client interest.
  - dreamcompiler 7y ago
    Even inspecting the binary doesn't prove anything in general. Halting problem...
- xondono 7y ago
transpute 7y ago
Reproducible builds of open firmware, BMC and boot components can enable owner-managed keys for verification of platform and application integrity, rooted in (increasingly open) hardware. Recent conference talks on hardware-assisted security and open firmware: OSFC 2019: https://osfc.io/archive https://osfc.io/archive PSEC 2019: https://platformsecuritysummit.com/2019/videos https://platformsecuritysummit.com/2019/videos FOSDEM 2020: https://fosdem.org/2020/schedule/track/open_source_firmware_bmc_and_bootloader/ https://fosdem.org/2020/schedule/track/open_source_firmware_...

77 points by mkesper 7y ago

its not poss!

TFA: > Most people remember when the FBI wanted a backdoor into iPhones and Tim Cook refused. Fewer people remember when the CCP wanted a backdoor into iCloud and Apple said yes, for fear of losing its largest growth market. Presently, all iCloud users in China are hosted by a Chinese company, in China, to which the CCP by law has full access. There is also a claim that Apple cancelled a plan to e2e encrypt iCloud phone backups, which would mean that Apple/FBI could no longer decrypt your phone’s backup. All iPhones logged in to iCloud are backing up to iCloud by default with encryption that Apple/FBI can read. The claim is that the FBI specifically requested that they not further secure this, which would prevent their current methods of easily accessing these backups. Note that your backups generally contain your complete iMessage and SMS history, including all attached images and videos. There’s little practical point in denying a backdoor into a seized phone if Apple/FBI already have a copy of everything on it that they can decrypt and read because your backups are encrypted to Apple, not you. (They do this because many, many people lose their device, and have forgotten their Apple ID password which then needs to be reset. The naïve solution to this is to simply encrypt the backups to an Apple key, which is always decryptable by Apple as required for restore after resetting your password via alternate ID verification. Unfortunately it puts every single user of iCloud backup at risk of bulk surveillance.) The whole thing is rather performative, like they are showing off for the market. Indeed, people well respected (such as the author of TFA) are repeating this meme without any of the associated caveats. Make sure you tell your family and friends to disable iCloud and more specifically, iCloud device backups if they value their privacy.

mirimir 7y ago
Yes, iCloud is not really private. You can use iTunes backup to your own computer. But then, that must be securely full-disk encrypted. And then it's you who'll be holding the password and/or key.
- kohtatsu 7y ago
  iTunes backups support encryption without your computer needing FDE. There is also the idevicebackup2 commandline tool from the libimobiledevice suite for doing those backups on linux, mac, or windows hosts. Supports the iOS protocols, including the native backup encryption. https://www.libimobiledevice.org/ https://www.libimobiledevice.org/ Having a secure iOS device is possible: disable iCloud backups, probably disable messages and photos too, and use a custom numeric pin >10 digits (a lot more if you are using it as T9 input). The secure enclave's kdf is only configured for 100ms of stretching IIRC, but it's sufficient with a long pin code.
  - mirimir 7y ago
    I'd still rather have FDE, as well. For me, LUKS.
    - notyourday 7y ago
      I'd go as far as to say LUKS in plain mode, rather than ever so popular container LUKS.
    - kohtatsu 7y ago
      I have both, but if I could only have one I'd rely on the native iOS backup encryption. I trust Apple's implementation more than I trust myself accidentally leaving my disk unlocked in public. And I do trust myself not to leave my disk unlocked in public. (I know this is a digression from the topic but we're nicely tucked away at the bottom of the comments)
      - mirimir 7y ago
        That's how they got DFS. Two agents pretended to have a lovers' argument at the library, to distract him, and the third grabbed his laptop. I don't use laptops anymore. Just host machines for VMs. And I always shut them all down, whenever I leave the building. I have a commercial UPS, with a deadman circuit. So I just cabled that line with the CAT6, and there are motorcycle-style kill switches in key places (desk, bathroom, kitchen and bed).
lorenzhs 7y ago
This is an article about securing the boot process on various platforms. Whatever your thoughts on Apple's cloud security practices (I'm not a fan either), it gets tedious to have this brought up every time an article is in any way related to Apple and security. Boot security matters, regardless of whether your cloud backups are end-to-end encrypted or not. I find calling it "rather performative" disingenuous.
- sneak 7y ago
  Yes, my comment is orthogonal to the topic of the article. I’m just so incredibly tired of seeing people trot out this commonplace and false Tim Cook vs the FBI narrative entirely uncritically, which is precisely what TFA does.

bo1024 7y ago

I've always been pretty skeptical of secure boot and trusted hardware modules since it seems to generally mean "trusted by the manufacturer, not the user". The model feels like the manufacturer owns and controls the device, and the user is just barely trusted enough to press the boot key. Because of this I appreciated that the article stressed the importance of open-source firmware and called out companies like Intel for user-hostile approaches.

userbinator 7y ago
It's been like that since the beginning of "Trusted Computing" --- it was originally for DRM. Only within the last decade(!) has it been advocated strongly as a security feature, and my belief is that the companies (and the government) have realised that security paranoia is a powerful tool of control. Unfortunately most people won't question anything if it's "for security". I don't think open-source is really all that important, and the article is being very misleading in that respect; in fact, if we don't have the keys, all that being open-source does is to allow us to easily see how they're oppressing us. (Of course, there's also the Ken Thompson Hack --- inspecting the binary is the real way to determine if there's anything unusual.) This is a related article which everyone interested in this topic should read: https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html
- coretx 7y ago
  I long back to the days when we said security is compromised when a adversary had physical access and that zero point many zero's 1 dollar jumper physically setting things to read only works just fine. Today I primarily don't trust my systems because of the manufacturers seeing me -the owner- as the #1 security risk and favoring corporate interest over client interest.
- dreamcompiler 7y ago
  Even inspecting the binary doesn't prove anything in general. Halting problem...
xondono 7y ago

transpute 7y ago

Reproducible builds of open firmware, BMC and boot components can enable owner-managed keys for verification of platform and application integrity, rooted in (increasingly open) hardware. Recent conference talks on hardware-assisted security and open firmware: OSFC 2019: https://osfc.io/archive https://osfc.io/archive PSEC 2019: https://platformsecuritysummit.com/2019/videos https://platformsecuritysummit.com/2019/videos FOSDEM 2020: https://fosdem.org/2020/schedule/track/open_source_firmware_bmc_and_bootloader/ https://fosdem.org/2020/schedule/track/open_source_firmware_...