5 ms·

> “Samsung takes the security of Galaxy devices seriously. We have issued security patches since 2016 upon being made aware of the issue“ They’ve known about i

> “Samsung takes the security of Galaxy devices seriously. We have issued security patches since 2016 upon being made aware of the issue“ They’ve known about it since 2016!?!

dontbenebby 4y ago
Who's in charge of certificate stuff in these situations?
- gryf 4y ago
- SilasX 4y ago
- akiselev 4y ago
  Some intern at the corporate HQ
  - dontbenebby 4y ago
    Which corporation though? Samsung or GOOG?
    - karamanolev 4y ago
      Google can add certificates to the CRLs (certification revocation lists) for things they control, but generally, Samsung owns and keeps their private keys, including this one.
- Izkata 4y ago
  I don't know if this has changed since I last looked a few years ago (around 2018-2019), but: The app-signing key can't be changed without just creating a new app, and creating a new app means you users won't be able to upgrade - they have to manually uninstall, go to the app store, and install the new one. It's not just an app store thing, I think I remember Android itself verifies that the upgrades have the same key as the old version.
  - clysm 4y ago
    You can do certificate rotation in signing scheme V3 and Android 9+. https://source.android.com/docs/security/features/apksigning/v3 https://source.android.com/docs/security/features/apksigning...
skipnup 4y ago
Maybe for all devices published since 2016?
ehhthing 4y ago
The article is rather misleading. It is almost certain that Samsung used HSMs to sign their APKs, so the key itself could never actually leak unless someone had physical access to the HSMs themselves and managed to somehow delid it and then put it back together without anyone noticing. I'm not too familiar with the documented attacks on delidding HSMs, but I believe that delidding chips causes permanent damage to them in such a way that they will never function properly again. It's much more likely that an employee's account was compromised and then used to sign malicious APKs, or something similar. Once Samsung realized, they could get the logs of every APK signed with the HSM and then revoke those certificates individually through a software update. Not really sure if they actually did that or not, but either way the key doesn't necessarily need to be replaced.
- jeroenhd 4y ago
  > revoke those certificates individually through a software update Android doesn't really do revoking certificates in this way. The only way to fix a leak of a system key is to generate a new key and use replace the entire system image. I hope you're right that this is merely a remote signing account being compromised, because I don't see Samsung building six years of new system images.
- fulafel 4y ago
  Can you expand reasoning or evidence behind this guess that the keys would be stored (only) in HSM?
dagmx 4y ago
I think the more generous take is that they resigned all their security patches back to 2016 with a new key?

> “Samsung takes the security of Galaxy devices seriously. We have issued security patches since 2016 upon being made aware of the issue“ They’ve known about it since 2016!?!

dontbenebby 4y ago

Who's in charge of certificate stuff in these situations?

gryf 4y ago
SilasX 4y ago
akiselev 4y ago
Some intern at the corporate HQ
- dontbenebby 4y ago
  Which corporation though? Samsung or GOOG?
  - karamanolev 4y ago
    Google can add certificates to the CRLs (certification revocation lists) for things they control, but generally, Samsung owns and keeps their private keys, including this one.
Izkata 4y ago
I don't know if this has changed since I last looked a few years ago (around 2018-2019), but: The app-signing key can't be changed without just creating a new app, and creating a new app means you users won't be able to upgrade - they have to manually uninstall, go to the app store, and install the new one. It's not just an app store thing, I think I remember Android itself verifies that the upgrades have the same key as the old version.
- clysm 4y ago
  You can do certificate rotation in signing scheme V3 and Android 9+. https://source.android.com/docs/security/features/apksigning/v3 https://source.android.com/docs/security/features/apksigning...

skipnup 4y ago

Maybe for all devices published since 2016?

ehhthing 4y ago

The article is rather misleading. It is almost certain that Samsung used HSMs to sign their APKs, so the key itself could never actually leak unless someone had physical access to the HSMs themselves and managed to somehow delid it and then put it back together without anyone noticing. I'm not too familiar with the documented attacks on delidding HSMs, but I believe that delidding chips causes permanent damage to them in such a way that they will never function properly again. It's much more likely that an employee's account was compromised and then used to sign malicious APKs, or something similar. Once Samsung realized, they could get the logs of every APK signed with the HSM and then revoke those certificates individually through a software update. Not really sure if they actually did that or not, but either way the key doesn't necessarily need to be replaced.

jeroenhd 4y ago
> revoke those certificates individually through a software update Android doesn't really do revoking certificates in this way. The only way to fix a leak of a system key is to generate a new key and use replace the entire system image. I hope you're right that this is merely a remote signing account being compromised, because I don't see Samsung building six years of new system images.
fulafel 4y ago
Can you expand reasoning or evidence behind this guess that the keys would be stored (only) in HSM?

dagmx 4y ago

I think the more generous take is that they resigned all their security patches back to 2016 with a new key?