7 ms·

Agreed, though that certainly _feels_ orthogonal to unlocking the bootloader? If I modify the hardware some other way (a la a modchip) and achieve the same thin

by axoltl 3y ago

Agreed, though that certainly _feels_ orthogonal to unlocking the bootloader? If I modify the hardware some other way (a la a modchip) and achieve the same thing, it'd be illegal for the same reasons.

charcircuit 3y ago
>Agreed, though that certainly _feels_ orthogonal to unlocking the bootloader? Unlocking the bootloader is what makes it possible. The security model protects against hackers installing malware on the device otherwise. >If I modify the hardware some other way (a la a modchip) and achieve the same thing Good luck opening up the SoC and trying to modify it that way. This is not a concern as the security is good enough where this isn't a big concern.
- axoltl 3y ago
  I’ve been an embedded security engineer for the past two decades, have worked on a dozen secure silicon projects, have broken several secure boot chains (albeit only one publicly, in 2014: https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt1/ https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt...). I’ve also worked on some of the early Wii modchips when I was with Team Twiizers. These days I spend time (though not as much as I’d like) in cleanrooms playing with SEMs, plasma etchers and other fun toys. I can fairly safely say your assumptions are incorrect.
  - charcircuit 3y ago
    >I can fairly safely say your assumptions are incorrect. Tell me what assumption is wrong so I can learn (unless your point was that software (and hardware :)) can have security bugs which I'm already aware of), else I will continue to repeat this.
    - axoltl 3y ago
      Apologies, I should have been more nuanced in my reply. Your assumptions are correct, for a given threat model. I think I'm simply arguing from a different threat model that includes hardware modifications like the modchips used in the Nintendo Switch, that glitch the power rail to modify the behaviour of the SoC.

by axoltl 3y ago

charcircuit 3y ago

>Agreed, though that certainly _feels_ orthogonal to unlocking the bootloader? Unlocking the bootloader is what makes it possible. The security model protects against hackers installing malware on the device otherwise. >If I modify the hardware some other way (a la a modchip) and achieve the same thing Good luck opening up the SoC and trying to modify it that way. This is not a concern as the security is good enough where this isn't a big concern.

axoltl 3y ago
I’ve been an embedded security engineer for the past two decades, have worked on a dozen secure silicon projects, have broken several secure boot chains (albeit only one publicly, in 2014: https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt1/ https://fail0verflow.com/blog/2014/hubcap-chromecast-root-pt...). I’ve also worked on some of the early Wii modchips when I was with Team Twiizers. These days I spend time (though not as much as I’d like) in cleanrooms playing with SEMs, plasma etchers and other fun toys. I can fairly safely say your assumptions are incorrect.
- charcircuit 3y ago
  >I can fairly safely say your assumptions are incorrect. Tell me what assumption is wrong so I can learn (unless your point was that software (and hardware :)) can have security bugs which I'm already aware of), else I will continue to repeat this.
  - axoltl 3y ago
    Apologies, I should have been more nuanced in my reply. Your assumptions are correct, for a given threat model. I think I'm simply arguing from a different threat model that includes hardware modifications like the modchips used in the Nintendo Switch, that glitch the power rail to modify the behaviour of the SoC.