6 ms·

One of the primary uses-cases for VMs in Android seems to be a desire to replace the Trusted Execution Environments (TEEs) permitted by things like TrustZone. T

One of the primary uses-cases for VMs in Android seems to be a desire to replace the Trusted Execution Environments (TEEs) permitted by things like TrustZone. There have been several presentations about this by Google: - LPC 2020: https://www.youtube.com/watch?v=54q6RzS9BpQ&t=10862s https://www.youtube.com/watch?v=54q6RzS9BpQ&t=10862s and https://lpc.events/event/7/contributions/780/ https://lpc.events/event/7/contributions/780/ - KVM Forum 2020: https://mirrors.edge.kernel.org/pub/linux/kernel/people/will/slides/kvmforum-2020-edited.pdf https://mirrors.edge.kernel.org/pub/linux/kernel/people/will... From the KVM Forum presentation: "We need a way to de-privilege third party code and provide a portable environment in which to isolate services from each other and also from the rest of Android." From the LPC presentation: "What do we need? We need a hypervisor that is: 1. open source 2. easy to ship and update 3. supports guest memory protection 4. trustworthy KVM as part of GKI is a very good fit with the right extensions."

raxxorrax 5y ago
I think development of mobile OS heads into a completely wrong direction. The "curation" effect of proprietary stores is only good for censorship and mobile OS have the most aggressive applications that border on malware. At least you don't have the browser toolbar classical systems were infected with? For productivity I don't want iron curtains between my applications or between application and system. Hell, it would actually be nice to be able to directly interface the hardware without all the loops. We have a deeply flawed security model for mobile OS that relies on dogma that won't lead to additional safety. As safety issue is data exfiltration and by that standard a mobile devices are vastly more dangerous than the average work station. Comes with the nature of the device to a significant degree, but I think mobile OS have ridden of a cliff somewhere. And now they want to push apps into a VM? Why not just buy a device per app at this point...
- himinlomax 5y ago
  Walled gardens have many problems, but one of the reason they exist is that they offer some security benefits. Virtualization allows for stronger containment of apps and make walled gardens less necessary.
- colechristensen 5y ago
  Anybody making money off of phone apps should not be trusted, they can and still take every piece of data they can to figure out how to monetize it. I want and need phone app security to protect me from the companies that want me as a product to be sold.
  - withinboredom 5y ago
    I think where they are going with that is that this sounds suspiciously like a “people problem” and not a technical one though it is attempting to solve it via technology. For some reason desktops let software do whatever and they don’t seem to have near as much an issue as mobile OSes. IMHO, it’s the fact that there’s a (basically, by default) a single market driven by (basically, by default) a single search engine to locate software. The desktop market, is largely NOT driven by a single market or search engine. With the “single market” if a malicious actor can game the search engine for even a day, they can install on (potentially) millions of devices. However, with the ‘ole distribution model, it’s much harder to game.
    - pjmlp 5y ago
      Which is why the desktop market has tons of garbage anti-virus and PC cleaning software, trying to fix the cowboy land it turned into.
    - vlovich123 5y ago
      There's reasons to be suspicious but it's also important to remember that mobile phones see much deeper penetration. About 84% of the world's population has a smartphone. Annually, ~1.6 billion phones are shipped vs 275 million PCs. With scale comes new challenges and attack vectors.
      - tentacleuno 5y ago
        > Annually, ~1.6 billion phones are shipped vs 275 million PCs. This is most likely because people do not have to buy a PC every 3 years. Phones are treated as disposable items, whereas with a desktop, you can open it, clean it, change parts etc. I can even change the CPU in my laptop if I wanted to.
- kllrnohj 5y ago
  This has nothing to do with apps. It's instead about things like the biometrics or DRM handling code. The stuff that regularly runs on its own dedicated CPU or in specialized sandboxes like ARM's TrustZone. This is about moving that to instead be in a VM on the "primary" CPU, implemented in open source Linux kernel code instead of who-knows-what ARM microcode. Or to compare against an ecosystem that has more love around here, imagine if everything that Apple runs on the T2 was instead run in a VM with an equivalent level of security. That's the goal.
azalemeth 5y ago
> 4. trustworthy What does this actually mean? Trustworthy under which circumstances, in what security model? I'm terrified it means "unbreakable DRM in a way that is harder still for consumers to use or bypass" rather than "the code is not vulnerable to side-channel malware attacks". A lot of this could either be brilliant -- applications can't look at each other at all, unless one of a few trusted utilities such as screen-readers or keyboards, for example -- or utterly horrific from a user point of view. "Attestation" is mentioned in one of the end goals of that KVM Forum pdf, but it's unclear whether or not they mean a Qubes-like OS with the user as the hypervisor, or the user completely and utterly locked out of being the hypervisor, ever. One of these I think could be quite interesting -- especially without hardware attestation. One I think would be awful. Part of the reason I (thoroughly break) Android's security model and run a rooted image is to have knowledge that I have control over everything in my device. It's important to me and I worry that these efforts will ultimately take that way from me.
- kdrag0n 5y ago
  Modern phones already have DRM running in TrustZone, even if you flash a custom Android build. pKVM is actually better in that regard as the DRM will be moved to a protected VM under Android's control, so you could choose to disable it on a custom OS.
kdrag0n 5y ago
Indeed, that's one of Google's official use cases: https://twitter.com/salt___doll/status/1492865396692586497 https://twitter.com/salt___doll/status/1492865396692586497 Recently, they've also focused on using VMs to isolate parts of the system and apps: https://twitter.com/salt___doll/status/1492872311652765700 https://twitter.com/salt___doll/status/1492872311652765700 Mishaal Rahman has written a detailed post about virtualization on Android: https://blog.esper.io/android-dessert-bites-5-virtualization-in-android-13-351789/ https://blog.esper.io/android-dessert-bites-5-virtualization...

raxxorrax 5y ago

I think development of mobile OS heads into a completely wrong direction. The "curation" effect of proprietary stores is only good for censorship and mobile OS have the most aggressive applications that border on malware. At least you don't have the browser toolbar classical systems were infected with? For productivity I don't want iron curtains between my applications or between application and system. Hell, it would actually be nice to be able to directly interface the hardware without all the loops. We have a deeply flawed security model for mobile OS that relies on dogma that won't lead to additional safety. As safety issue is data exfiltration and by that standard a mobile devices are vastly more dangerous than the average work station. Comes with the nature of the device to a significant degree, but I think mobile OS have ridden of a cliff somewhere. And now they want to push apps into a VM? Why not just buy a device per app at this point...

himinlomax 5y ago
Walled gardens have many problems, but one of the reason they exist is that they offer some security benefits. Virtualization allows for stronger containment of apps and make walled gardens less necessary.
colechristensen 5y ago
Anybody making money off of phone apps should not be trusted, they can and still take every piece of data they can to figure out how to monetize it. I want and need phone app security to protect me from the companies that want me as a product to be sold.
- withinboredom 5y ago
  I think where they are going with that is that this sounds suspiciously like a “people problem” and not a technical one though it is attempting to solve it via technology. For some reason desktops let software do whatever and they don’t seem to have near as much an issue as mobile OSes. IMHO, it’s the fact that there’s a (basically, by default) a single market driven by (basically, by default) a single search engine to locate software. The desktop market, is largely NOT driven by a single market or search engine. With the “single market” if a malicious actor can game the search engine for even a day, they can install on (potentially) millions of devices. However, with the ‘ole distribution model, it’s much harder to game.
  - pjmlp 5y ago
    Which is why the desktop market has tons of garbage anti-virus and PC cleaning software, trying to fix the cowboy land it turned into.
  - vlovich123 5y ago
    There's reasons to be suspicious but it's also important to remember that mobile phones see much deeper penetration. About 84% of the world's population has a smartphone. Annually, ~1.6 billion phones are shipped vs 275 million PCs. With scale comes new challenges and attack vectors.
    - tentacleuno 5y ago
      > Annually, ~1.6 billion phones are shipped vs 275 million PCs. This is most likely because people do not have to buy a PC every 3 years. Phones are treated as disposable items, whereas with a desktop, you can open it, clean it, change parts etc. I can even change the CPU in my laptop if I wanted to.
kllrnohj 5y ago
This has nothing to do with apps. It's instead about things like the biometrics or DRM handling code. The stuff that regularly runs on its own dedicated CPU or in specialized sandboxes like ARM's TrustZone. This is about moving that to instead be in a VM on the "primary" CPU, implemented in open source Linux kernel code instead of who-knows-what ARM microcode. Or to compare against an ecosystem that has more love around here, imagine if everything that Apple runs on the T2 was instead run in a VM with an equivalent level of security. That's the goal.

azalemeth 5y ago

> 4. trustworthy What does this actually mean? Trustworthy under which circumstances, in what security model? I'm terrified it means "unbreakable DRM in a way that is harder still for consumers to use or bypass" rather than "the code is not vulnerable to side-channel malware attacks". A lot of this could either be brilliant -- applications can't look at each other at all, unless one of a few trusted utilities such as screen-readers or keyboards, for example -- or utterly horrific from a user point of view. "Attestation" is mentioned in one of the end goals of that KVM Forum pdf, but it's unclear whether or not they mean a Qubes-like OS with the user as the hypervisor, or the user completely and utterly locked out of being the hypervisor, ever. One of these I think could be quite interesting -- especially without hardware attestation. One I think would be awful. Part of the reason I (thoroughly break) Android's security model and run a rooted image is to have knowledge that I have control over everything in my device. It's important to me and I worry that these efforts will ultimately take that way from me.

kdrag0n 5y ago
Modern phones already have DRM running in TrustZone, even if you flash a custom Android build. pKVM is actually better in that regard as the DRM will be moved to a protected VM under Android's control, so you could choose to disable it on a custom OS.

kdrag0n 5y ago

Indeed, that's one of Google's official use cases: https://twitter.com/salt___doll/status/1492865396692586497 https://twitter.com/salt___doll/status/1492865396692586497 Recently, they've also focused on using VMs to isolate parts of the system and apps: https://twitter.com/salt___doll/status/1492872311652765700 https://twitter.com/salt___doll/status/1492872311652765700 Mishaal Rahman has written a detailed post about virtualization on Android: https://blog.esper.io/android-dessert-bites-5-virtualization-in-android-13-351789/ https://blog.esper.io/android-dessert-bites-5-virtualization...