4 ms·

I can’t discuss my former role in too much detail, but it has convinced me that all the above is insufficient in a number of very realistic threat models. One

by lumb63 4y ago

I can’t discuss my former role in too much detail, but it has convinced me that all the above is insufficient in a number of very realistic threat models. One issue is that software has vulnerabilities and bugs. I’m not talking about the software that users run in sandboxes environments. I’m talking about the sandboxes environments. I’m talking about cryptography implementations. I’m talking about the firmware running in the “trusted” hardware. The other major issue is as you alluded to: the need to trust vendors and hardware. Without protection and monitoring at the physical level, the user has no way to verify the operation of the giant stack of technology designed to “protect them”. Without the ability to verify operations, how is the user to trust anything? Why do companies tell users to “trust them” without any proof they are trustworthy? This may seem like a minor point, but this is really the crux of the issue. Building this giant house of cards on top of a (potentially) untrustworthy hardware root of trust does not buy anyone anything. Certainly it does not buy “security”. Large companies and nation states are the most likely adversaries one wants to be wary of these days (e.g. journalists, whistleblowers, etc.). What good does the technology do them if the supply chain is compromised or vendors are coerced to insert backdoors? These are the threats that actually face people concerned about security, not whether or not their executables are run in a sandboxed VM or not. Great, you’ve stopped the adversary from inserting malicious code into your device after purchase. Good thing for them, they did it prior to or during manufacture. The technology you alluded to above is mainly useful for protecting company IP from end users, IMO. That’s how I’ve mainly seen it used, and the marketing of “security for the user” is a gimmick to justify the process. EDIT: I forgot to mention this entire class of security issue since I am used to working on air gapped systems. I don’t care if you are operating in a sandboxed VM with a randomized MAC over a VPN over Tor. If you’re communicating with any other device over the Internet, you have to trust every single other machine along the way. And you shouldn’t.

b112 4y ago
Why do companies tell users to “trust them” without any proof they are trustworthy? You know the answer here, they are not to be trusted. Samsung phones, for example, have a gpsd, which phones home at random times. This runs as root, ignores vpn settings (so no netguard for you!), and if it is just getting updated agps info, it sure seems to send a lot of data for that. So no, they don't want a legitly auditable device. Too many questions, you see.
- lumb63 4y ago
  It is also worth mentioning, since I didn’t realize it until I worked in depth in the space: your CPU is not the only place to execute code, or the only place with access to hardware.
akiselev 4y ago
> The other major issue is as you alluded to: the need to trust vendors and hardware. Without protection and monitoring at the physical level, the user has no way to verify the operation of the giant stack of technology designed to “protect them”. Without the ability to verify operations, how is the user to trust anything? Why do companies tell users to “trust them” without any proof they are trustworthy? At the end of the day you need to trust Qualcomm or MediaTek. The Oracle of the hardware world, with more lawyers than engineers, or... MediaTek. That's a NOPE for me.
- drozycki 4y ago
  AFAIK there are no phones on the market with open-source baseband firmware, so you have to trust one of Qualcomm, Broadcom et al with access to all cellular communication. Do you have a best of breed supplier you’ve vetted?
  - bigiain 4y ago
    And even if you _could_ trust the baseband on your device, there’s the problem that the cell tower is running software you have no visibility of. If I were the NSA, that’s where I’d be focussing at least some of the attention of the “exploit people’s phones” department. If you want cellular connectivity, the cellular provider needs a real time way to identify your device and it’s location (at least down to neatest few cell towers accuracy). (And once I had some capability there, the people running the “most secure basebands/devices would be the ones I kept the closest eye on. I’ve heard my local intelligence service are very interested in phone switch on/off events, because they are a signal that someone might be attempting to evade surveillance, and the rarity of “normal people” switching their phone off (or disconnecting from the cellular network) makes it worthwhile collecting all that “metadata” so they can search it for the “interesting” cases.
  - namibj 4y ago
    There are open source LTE stacks, they just suffer from lack of power efficiency. Not too bad in a gaming laptop form factor, but quite bad in a smartphone.
  - 4y ago
bigiain 4y ago
While respecting your “I can go into details” comment, I’m curious to hear whatever you _can_ comment on about what sort of adversary has the capabilities you describe and do you have an opinion on whether they use those in tightly targeted attacks only, or do they compromise the entire hardware/software supply chain in a way that they can do “full take surveillance” using it? If I’m not a terrorist/sex-trafficker/investigative-journalist, can I reasonably ignore those threats even if I, say, occasionally buy personal use quantities of illegal drugs or down/upload copyright material? (With, I guess, the caveat that I’d need to assume the dealer/torrent site at the other end of those connections isn’t under active surveillance…)
- lumb63 4y ago
  All of this is public knowledge and has nothing to do with my role: Nation states, especially the US, should be suspected of having compromised everything. Look at all the things Edward Snowden released. Look at the way the NSA has corrupted cryptographic standards in the past (e.g. Dual EC DRBG). There are countless instances of similar situations.

by lumb63 4y ago

b112 4y ago

Why do companies tell users to “trust them” without any proof they are trustworthy? You know the answer here, they are not to be trusted. Samsung phones, for example, have a gpsd, which phones home at random times. This runs as root, ignores vpn settings (so no netguard for you!), and if it is just getting updated agps info, it sure seems to send a lot of data for that. So no, they don't want a legitly auditable device. Too many questions, you see.

lumb63 4y ago
It is also worth mentioning, since I didn’t realize it until I worked in depth in the space: your CPU is not the only place to execute code, or the only place with access to hardware.

akiselev 4y ago

> The other major issue is as you alluded to: the need to trust vendors and hardware. Without protection and monitoring at the physical level, the user has no way to verify the operation of the giant stack of technology designed to “protect them”. Without the ability to verify operations, how is the user to trust anything? Why do companies tell users to “trust them” without any proof they are trustworthy? At the end of the day you need to trust Qualcomm or MediaTek. The Oracle of the hardware world, with more lawyers than engineers, or... MediaTek. That's a NOPE for me.

drozycki 4y ago
AFAIK there are no phones on the market with open-source baseband firmware, so you have to trust one of Qualcomm, Broadcom et al with access to all cellular communication. Do you have a best of breed supplier you’ve vetted?
- bigiain 4y ago
  And even if you _could_ trust the baseband on your device, there’s the problem that the cell tower is running software you have no visibility of. If I were the NSA, that’s where I’d be focussing at least some of the attention of the “exploit people’s phones” department. If you want cellular connectivity, the cellular provider needs a real time way to identify your device and it’s location (at least down to neatest few cell towers accuracy). (And once I had some capability there, the people running the “most secure basebands/devices would be the ones I kept the closest eye on. I’ve heard my local intelligence service are very interested in phone switch on/off events, because they are a signal that someone might be attempting to evade surveillance, and the rarity of “normal people” switching their phone off (or disconnecting from the cellular network) makes it worthwhile collecting all that “metadata” so they can search it for the “interesting” cases.
- namibj 4y ago
  There are open source LTE stacks, they just suffer from lack of power efficiency. Not too bad in a gaming laptop form factor, but quite bad in a smartphone.
- 4y ago

bigiain 4y ago

While respecting your “I can go into details” comment, I’m curious to hear whatever you _can_ comment on about what sort of adversary has the capabilities you describe and do you have an opinion on whether they use those in tightly targeted attacks only, or do they compromise the entire hardware/software supply chain in a way that they can do “full take surveillance” using it? If I’m not a terrorist/sex-trafficker/investigative-journalist, can I reasonably ignore those threats even if I, say, occasionally buy personal use quantities of illegal drugs or down/upload copyright material? (With, I guess, the caveat that I’d need to assume the dealer/torrent site at the other end of those connections isn’t under active surveillance…)

lumb63 4y ago
All of this is public knowledge and has nothing to do with my role: Nation states, especially the US, should be suspected of having compromised everything. Look at all the things Edward Snowden released. Look at the way the NSA has corrupted cryptographic standards in the past (e.g. Dual EC DRBG). There are countless instances of similar situations.