5 ms·

If you could safely (on the hardware level) replace image of the phone with another, it would be easy to guarantee that you can get a rootkit-free phone - all y

by js8 5y ago

If you could safely (on the hardware level) replace image of the phone with another, it would be easy to guarantee that you can get a rootkit-free phone - all you need is a trusted image.

dewey 5y ago
> it would be easy to guarantee that you can get a rootkit-free phone The problem in this case is that you get the malware installed through a no-click required iMessage and not a "supply chain" attack on the image your phone is running on. How would that help?
- tremon 5y ago
  You could replace the image with software that doesn't support iMessage, for example.
- pdkl95 5y ago
  It could help by simply being sufficiently different. The only reason this type of malware is such a widespread problem is the large monoculture of potential targets. Just like in agriculture (e.g. potatoes, bananas), a monoculture allows a single pathogen to affect an entire crop. In security this is a class break[1]. Utilizing different software implementations limits the scope of this type of attack. The current trend to increasing centralization and forced-update monoculture is a huge gift to malware authors: they only have to write one version of their malware to affect everyone. [1] https://www.schneier.com/blog/archives/2017/01/class_breaks.html https://www.schneier.com/blog/archives/2017/01/class_breaks....
  - maldeh 5y ago
    This is a good principle in terms of reducing the overall blast radius of exploits. But to do this the implementations should genuinely be independent. In practice we may find a monoculture within a hidden layer of the stack than we're optimizing for, such as an OS kernel method, TLS library or chipset which coincidentally has captured the entire market. When a clever enough exploit on a common resource is found, then the problem transforms to one of coordinating patching for the same, wherein a broad ecosystem of higher level components (like Android or PCs) becomes nearly impossible to thoroughly cover. As such malware authors may potentially still get away with writing a single version of their software so long as they target low-level enough. With sufficient fragmentation they don't even need to invent their own exploits, just use publicly known CVEs that they can brute-force against older devices. (Not saying you're wrong, your recommendation may still be better in the long-run. We're after all weighing the risk level of black swan events, such as a zero-day on a low level of the stack, or a high level of the stack on a high-volume vendor)
  - gruez 5y ago
    On the flip side, having a monoculture is good because you made more eyes looking at the same piece of code.
    - pdkl95 5y ago
      How many people have seen the iMessage source code? A handful of devs at Apple? Closed, proprietary software by definition prevents "more eyes" from looking. Even if we consider an open source product where having "many eyes" review the code is at least hypothetically possible, a large number of people using the software doesn't imply there is also a large amount of people reviewing it.
      - gruez 5y ago
        >Closed, proprietary software by definition prevents "more eyes" from looking But we were talking about the general case of monoculture, not closed source monoculture. Even for closed source software, where more eyes are prevented from looking "by definition", having a monoculture can in theory allow more code audits to be done, because of economy of scale. > large number of people using the software doesn't imply there is also a large amount of people reviewing it. Right, but roughly speaking, the number of reviewers should monotonically increase given an increase in users. Whether that produces better security overall is anyone's guess. My point was just that there was a counteracting force to consider.
- eptcyka 5y ago
  The argument isn't that granting more freedoms to the owner of the device will magically make it more secure in all cases, for most it won't. The argument is that removing freedoms from owners in the name of security is a false dichotomy because bad actors will still gain the ability to execute arbitrary code whilst owners of devices won't be able to do so. Also, if I could provide the software I want to run, I'd probably not have iMessage.
- turminal 5y ago
  It would help because knowledgeable people would get to pick what software they run on their phones and iMessage probably wouldn't be on the list.
  - derefr 5y ago
    Journalists (as here) don't usually get to choose the communication software their sources are comfortable communicating over. They install whatever's required to get the story. And they likely wouldn't install an OS that doesn't let them install such apps.
    - cronix 5y ago
      That's a niche use case. You might not be able to choose what app they require to communicate over, but you can choose what device to install it onto, like a burner, couldn't you? Some apps you might not mind on your personal phone, others you probably do.
      - derefr 5y ago
        Well, yes, but if you think about it, the whole point of a journalist's work phone is just to aggregate a bunch of "burner" accounts. And that's exactly what an attacker would want to steal from a journalist: conversations between them and (or contact details of) another source. Which is all to say, ideally a journalist would have N phones, one per source. But that's impractical.
- godelski 5y ago
  Would it? Wouldn't you still need privilege escalation? Having root access is different from being logged in as the root user. Of course being logged in as root comes with all the same security risks as it does if you do this on Linux. But no one uses root as their main account.
pvarangot 5y ago
The Pegasus thing didn't even survive a reboot, it was reinstalled by using the 0-day again on a fresh boot. Replacing the image would have done nothing if they were flashing a version that still had the iMessage vulnerability.
- fartcannon 5y ago
  But if that imessage vulnerability was FOSS and you could flash your own image, you could fix it and move on with your life.
  - ekianjo 5y ago
    its not like there are no security vulnerabilities in FOSS apps either
    - fartcannon 5y ago
      No, but when they appear, _you can fix them_.
      - zzt123 5y ago
        Are there actual hard numbers on whether open-to-all-eyes is beneficial at all scales? For example, do public eyes actually catch and did more Linux bugs than three letter agencies? And would this situation be worse if Linux were a very well funded, closed source Windows? I’m ignorant on whether the open source security mantra is founded upon religion or evidence.
        drran 5y ago
        Classical FUD. > For example, do public eyes actually catch and did more Linux bugs than three letter agencies? Is it so important, who found a bug? TLA can find a bug, and then it has a choice: TLA can use it to spy on other countries, or TLA can fix it to protect their own country. Your TLA may choose to leave your country unprotected, but it is the problem of your country.
mrtksn 5y ago
> all you need is a trusted image I bet you, that image will be provided by the trustworthy people from NSO, free of charge or at a price! Whatever makes you trust their image. IMHO devices should be root-able but with high barriers of entry, something like soldering should be involved. If you are after doing something that you don't understand but a stranger on the internet told you to do it you shouldn't be able to do it. I just want to remind you that quite recently a few police agencies come together, built a "secure messaging app", fed it to the criminals and tracked all their communication until gather enough information to take down their entire operation.[0] Or the time when CIA run a Swiss encryption company[1] [0]https://news.ycombinator.com/item?id=27429311 https://news.ycombinator.com/item?id=27429311 [1]https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22297963
- mustafa_pasi 5y ago
  So according to you Linux is compromised?
  - mrtksn 5y ago
    The point is, you wouldn't know unless you have complete understanding on every aspect of your device and every bit of the software. Nobody would be installing a Linux kernel and use the phone like that, they would be installing a distro. There are so many vectors of attack, the person who puts the distro together doesn't need to have malicious intent, the supply chain could be compromised.
  - theyellowkid 5y ago
    You know, it's getting so big and warty that I'd be surprised if it wasn't.
  - failuser 5y ago
    Probably not intentionally, but there are likely a bunch of 0-day exploits we don’t know about.

by js8 5y ago

If you could safely (on the hardware level) replace image of the phone with another, it would be easy to guarantee that you can get a rootkit-free phone - all you need is a trusted image.

dewey 5y ago

> it would be easy to guarantee that you can get a rootkit-free phone The problem in this case is that you get the malware installed through a no-click required iMessage and not a "supply chain" attack on the image your phone is running on. How would that help?

tremon 5y ago
You could replace the image with software that doesn't support iMessage, for example.
pdkl95 5y ago
It could help by simply being sufficiently different. The only reason this type of malware is such a widespread problem is the large monoculture of potential targets. Just like in agriculture (e.g. potatoes, bananas), a monoculture allows a single pathogen to affect an entire crop. In security this is a class break[1]. Utilizing different software implementations limits the scope of this type of attack. The current trend to increasing centralization and forced-update monoculture is a huge gift to malware authors: they only have to write one version of their malware to affect everyone. [1] https://www.schneier.com/blog/archives/2017/01/class_breaks.html https://www.schneier.com/blog/archives/2017/01/class_breaks....
- maldeh 5y ago
  This is a good principle in terms of reducing the overall blast radius of exploits. But to do this the implementations should genuinely be independent. In practice we may find a monoculture within a hidden layer of the stack than we're optimizing for, such as an OS kernel method, TLS library or chipset which coincidentally has captured the entire market. When a clever enough exploit on a common resource is found, then the problem transforms to one of coordinating patching for the same, wherein a broad ecosystem of higher level components (like Android or PCs) becomes nearly impossible to thoroughly cover. As such malware authors may potentially still get away with writing a single version of their software so long as they target low-level enough. With sufficient fragmentation they don't even need to invent their own exploits, just use publicly known CVEs that they can brute-force against older devices. (Not saying you're wrong, your recommendation may still be better in the long-run. We're after all weighing the risk level of black swan events, such as a zero-day on a low level of the stack, or a high level of the stack on a high-volume vendor)
- gruez 5y ago
  On the flip side, having a monoculture is good because you made more eyes looking at the same piece of code.
  - pdkl95 5y ago
    How many people have seen the iMessage source code? A handful of devs at Apple? Closed, proprietary software by definition prevents "more eyes" from looking. Even if we consider an open source product where having "many eyes" review the code is at least hypothetically possible, a large number of people using the software doesn't imply there is also a large amount of people reviewing it.
    - gruez 5y ago
      >Closed, proprietary software by definition prevents "more eyes" from looking But we were talking about the general case of monoculture, not closed source monoculture. Even for closed source software, where more eyes are prevented from looking "by definition", having a monoculture can in theory allow more code audits to be done, because of economy of scale. > large number of people using the software doesn't imply there is also a large amount of people reviewing it. Right, but roughly speaking, the number of reviewers should monotonically increase given an increase in users. Whether that produces better security overall is anyone's guess. My point was just that there was a counteracting force to consider.
eptcyka 5y ago
The argument isn't that granting more freedoms to the owner of the device will magically make it more secure in all cases, for most it won't. The argument is that removing freedoms from owners in the name of security is a false dichotomy because bad actors will still gain the ability to execute arbitrary code whilst owners of devices won't be able to do so. Also, if I could provide the software I want to run, I'd probably not have iMessage.
turminal 5y ago
It would help because knowledgeable people would get to pick what software they run on their phones and iMessage probably wouldn't be on the list.
- derefr 5y ago
  Journalists (as here) don't usually get to choose the communication software their sources are comfortable communicating over. They install whatever's required to get the story. And they likely wouldn't install an OS that doesn't let them install such apps.
  - cronix 5y ago
    That's a niche use case. You might not be able to choose what app they require to communicate over, but you can choose what device to install it onto, like a burner, couldn't you? Some apps you might not mind on your personal phone, others you probably do.
    - derefr 5y ago
      Well, yes, but if you think about it, the whole point of a journalist's work phone is just to aggregate a bunch of "burner" accounts. And that's exactly what an attacker would want to steal from a journalist: conversations between them and (or contact details of) another source. Which is all to say, ideally a journalist would have N phones, one per source. But that's impractical.
godelski 5y ago
Would it? Wouldn't you still need privilege escalation? Having root access is different from being logged in as the root user. Of course being logged in as root comes with all the same security risks as it does if you do this on Linux. But no one uses root as their main account.

pvarangot 5y ago

The Pegasus thing didn't even survive a reboot, it was reinstalled by using the 0-day again on a fresh boot. Replacing the image would have done nothing if they were flashing a version that still had the iMessage vulnerability.

fartcannon 5y ago
But if that imessage vulnerability was FOSS and you could flash your own image, you could fix it and move on with your life.
- ekianjo 5y ago
  its not like there are no security vulnerabilities in FOSS apps either
  - fartcannon 5y ago
    No, but when they appear, _you can fix them_.
    - zzt123 5y ago
      Are there actual hard numbers on whether open-to-all-eyes is beneficial at all scales? For example, do public eyes actually catch and did more Linux bugs than three letter agencies? And would this situation be worse if Linux were a very well funded, closed source Windows? I’m ignorant on whether the open source security mantra is founded upon religion or evidence.
      - drran 5y ago
        Classical FUD. > For example, do public eyes actually catch and did more Linux bugs than three letter agencies? Is it so important, who found a bug? TLA can find a bug, and then it has a choice: TLA can use it to spy on other countries, or TLA can fix it to protect their own country. Your TLA may choose to leave your country unprotected, but it is the problem of your country.

mrtksn 5y ago

> all you need is a trusted image I bet you, that image will be provided by the trustworthy people from NSO, free of charge or at a price! Whatever makes you trust their image. IMHO devices should be root-able but with high barriers of entry, something like soldering should be involved. If you are after doing something that you don't understand but a stranger on the internet told you to do it you shouldn't be able to do it. I just want to remind you that quite recently a few police agencies come together, built a "secure messaging app", fed it to the criminals and tracked all their communication until gather enough information to take down their entire operation.[0] Or the time when CIA run a Swiss encryption company[1] [0]https://news.ycombinator.com/item?id=27429311 https://news.ycombinator.com/item?id=27429311 [1]https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22297963

mustafa_pasi 5y ago
So according to you Linux is compromised?
- mrtksn 5y ago
  The point is, you wouldn't know unless you have complete understanding on every aspect of your device and every bit of the software. Nobody would be installing a Linux kernel and use the phone like that, they would be installing a distro. There are so many vectors of attack, the person who puts the distro together doesn't need to have malicious intent, the supply chain could be compromised.
- theyellowkid 5y ago
  You know, it's getting so big and warty that I'd be surprised if it wasn't.
- failuser 5y ago
  Probably not intentionally, but there are likely a bunch of 0-day exploits we don’t know about.