4 ms·

"It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack" For remote key/plaintext exfiltration, it's enough the plaintex

by maqp 6y ago

"It's true, but the way I describe the Magic Wand it doesn't have any data so not much to hack" For remote key/plaintext exfiltration, it's enough the plaintext message or private key is in the memory of the application for some time. The exfiltration attack can then use privileged process to periodically read the memory of the Magic Wand application. There's nothing an app on a networked TCB can do against that. You need either an airgap or preferably a split TCB to protect yourself against endpoint exploitation.

ljlolel 6y ago
Yes it is airgapped, as stated in the doc, and multiple times in these comments.
- maqp 6y ago
  Then how are you addressing 1) the security of the individual endpoints with access to each share. Let's say your magic wand is airgapped and nothing gets in via the share transmission media (QR-code, thumbdrive, whatnot). What if your Huawei, iPhone and device N are compromised via network because they're all connected to network at all times. The adversary can then just steal all necessary shares and they don't even need to access your magic wand, they can just XOR the shares from the three receiving endpoints and recover the message. 2) Airgap exfiltration security. Let's say the iPhone is secure enough and the adversary can't hack it. But how are you ensuring the QR-code scanner app of the Magic Wand can not be exploited with a carefully crafted QR-code? If the Magic Wand is compromised, it can leak plaintext messages the next time you scan the QR-codes of outgoing shares.
  - lucb1e 6y ago
    To be fair about #2, I have rarely seen vulns in QR code scanners that were actually related to the scanning of QR codes. The only issues I heard about were things like auto-opening a URL or logic issues when handling the scanned data. Of course this doesn't immediately lead to perfect and provable security, but there are bigger issues with the concept than this.
    - maqp 6y ago
      It's still one of the cheapest attacks after #1 is plugged with public key encryption or initial off-band (sneakernet) key delivery.

by maqp 6y ago

ljlolel 6y ago

Yes it is airgapped, as stated in the doc, and multiple times in these comments.

maqp 6y ago
Then how are you addressing 1) the security of the individual endpoints with access to each share. Let's say your magic wand is airgapped and nothing gets in via the share transmission media (QR-code, thumbdrive, whatnot). What if your Huawei, iPhone and device N are compromised via network because they're all connected to network at all times. The adversary can then just steal all necessary shares and they don't even need to access your magic wand, they can just XOR the shares from the three receiving endpoints and recover the message. 2) Airgap exfiltration security. Let's say the iPhone is secure enough and the adversary can't hack it. But how are you ensuring the QR-code scanner app of the Magic Wand can not be exploited with a carefully crafted QR-code? If the Magic Wand is compromised, it can leak plaintext messages the next time you scan the QR-codes of outgoing shares.
- lucb1e 6y ago
  To be fair about #2, I have rarely seen vulns in QR code scanners that were actually related to the scanning of QR codes. The only issues I heard about were things like auto-opening a URL or logic issues when handling the scanned data. Of course this doesn't immediately lead to perfect and provable security, but there are bigger issues with the concept than this.
  - maqp 6y ago
    It's still one of the cheapest attacks after #1 is plugged with public key encryption or initial off-band (sneakernet) key delivery.