5 ms·

I've been out of the security game for a while, this almost reads like fiction. Good god this is nuts. I've heard of extracting keys with timing attacks but thi

by tomc1985 5y ago

I've been out of the security game for a while, this almost reads like fiction. Good god this is nuts. I've heard of extracting keys with timing attacks but this is even more impressive! Also, apparently the Switch perma-pwn got pwned? Sad face... Also also, I hope other popular cryptoprocessors aren't so vulnerable?

scandinavian 5y ago
> Also, apparently the Switch perma-pwn got pwned? Sad face... All erista units (the ones with the bootrom flaw) are still pwnable. 6.2.0 was released on November 19, 2018 - first indication of a new hack was posted on twitter Nov 24, 2018 by @elmirorac and atmosphere 0.8.0 was released on Nov 29, 2018. So the fix he talks about in the paste lasted for around 10 days before a new one was generally available. That's why he says: > And it would have been perfect if not for the many security flaws in TSEC secure boot.
Mindwipe 5y ago
> Also also, I hope other popular cryptoprocessors aren't so vulnerable? You might be surprised, but also this chip wasn't intended to be used to secure a chain of trust but had to be press ganged into service after being let down by the main bootrom, which was done by a team at NVidia without much experience of doing these things and made a lot of elementary errors. And being used for a games console is painting a big target on your back. But ultimately a lot of secure chipset areas have been subject to a lot of... learning on the job shall we say. Things are much better than they used to be, but you don't have to go back many years before things get very hairy. People constantly say they want more OS version support for Android, but I would not want to use a five year old processor from Samsung or Qualcomm if I cared about the hardware backed security on my phone.
- my123 5y ago
  > but you don't have to go back many years before things get very hairy For the NV TSEC-equivalent Falcon successor on Ampere, it’s indeed not vulnerable to this attack because that security subsystem was made much more secure. But that’s an arch released in… 2020.
- mschuster91 5y ago
  > People constantly say they want more OS version support for Android, but I would not want to use a five year old processor from Samsung or Qualcomm if I cared about the hardware backed security on my phone. What I would really like is a modern Android that doesn't brick half the security features by e-fuse when I root it and many apps refuse to run properly afterwards - why the fuck, for example, does the PayPal app refuse fingerprint unlocking after rooting but other apps don't?! All this incentivizes me as the user is to choose an insecure password that I can actually remember.
  - no_time 5y ago
    Its a small miracle paypal doesnt flat out prevent you from running the app when rooted.
  - striking 5y ago
    I'm fairly certain you're not eFused out, but you would have to give up your root and let your phone powerwash itself if you wanted things to go back to normal.
    - mschuster91 5y ago
      Samsung Knox fires an e-fuse the moment you flash an alternative boot image.
      - striking 5y ago
        That's gross, sorry to hear that. OnePlus does not do this.

scandinavian 5y ago

> Also, apparently the Switch perma-pwn got pwned? Sad face... All erista units (the ones with the bootrom flaw) are still pwnable. 6.2.0 was released on November 19, 2018 - first indication of a new hack was posted on twitter Nov 24, 2018 by @elmirorac and atmosphere 0.8.0 was released on Nov 29, 2018. So the fix he talks about in the paste lasted for around 10 days before a new one was generally available. That's why he says: > And it would have been perfect if not for the many security flaws in TSEC secure boot.

Mindwipe 5y ago

> Also also, I hope other popular cryptoprocessors aren't so vulnerable? You might be surprised, but also this chip wasn't intended to be used to secure a chain of trust but had to be press ganged into service after being let down by the main bootrom, which was done by a team at NVidia without much experience of doing these things and made a lot of elementary errors. And being used for a games console is painting a big target on your back. But ultimately a lot of secure chipset areas have been subject to a lot of... learning on the job shall we say. Things are much better than they used to be, but you don't have to go back many years before things get very hairy. People constantly say they want more OS version support for Android, but I would not want to use a five year old processor from Samsung or Qualcomm if I cared about the hardware backed security on my phone.

my123 5y ago
> but you don't have to go back many years before things get very hairy For the NV TSEC-equivalent Falcon successor on Ampere, it’s indeed not vulnerable to this attack because that security subsystem was made much more secure. But that’s an arch released in… 2020.
mschuster91 5y ago
> People constantly say they want more OS version support for Android, but I would not want to use a five year old processor from Samsung or Qualcomm if I cared about the hardware backed security on my phone. What I would really like is a modern Android that doesn't brick half the security features by e-fuse when I root it and many apps refuse to run properly afterwards - why the fuck, for example, does the PayPal app refuse fingerprint unlocking after rooting but other apps don't?! All this incentivizes me as the user is to choose an insecure password that I can actually remember.
- no_time 5y ago
  Its a small miracle paypal doesnt flat out prevent you from running the app when rooted.
- striking 5y ago
  I'm fairly certain you're not eFused out, but you would have to give up your root and let your phone powerwash itself if you wanted things to go back to normal.
  - mschuster91 5y ago
    Samsung Knox fires an e-fuse the moment you flash an alternative boot image.
    - striking 5y ago
      That's gross, sorry to hear that. OnePlus does not do this.