12 ms·
Oneplus phone update introduces hardware anti-rollback
- direwolf20 9mo agoI thought they were the one okay manufacturer. Guess not.
- raizer88 9mo agoYou either die a hero, or live long enough to see yourself become the villain
- Raed667 9mo agoI think the writing has been on the wall since they started their Nord line.
- Sebb767 9mo agoWhat was the issue with the Nord line?
- em-bee 9mo agoyeah, i'd like to know that too. i have a oneplus nord running /e/OS and i am quite happy with it. in fact it's probably the best phone i had so far performance wise (i got it refurbished at a very good price which may have something to do with that though)
- alluro2 9mo agoDo you mean because the previous "flagship killer" company now needed a "flagship killer" sub-brand, since they could no longer be categorised as such?
- Raed667 9mo agoExactly, why did they end up in a situation where they are making killers of their "main" phones ?
- zozbot234 9mo agoBecause all midrange phones are "flagship killers" on a features basis now, flagships are just about the exclusivity. The market has adapted and the term no longer makes much sense. OnePlus still leads on custom ROM support though, e.g. no special codes or waiting times needed for unlocking the bootloader, it all works out of the box with standard commands.
- microtonal 9mo agoOnePlus still leads on custom ROM support though, e.g. no special codes or waiting times needed for unlocking the bootloader, it all works out of the box with standard commands. Google Pixel would like to have a word. Though they regressed since they stopped shipping device trees in AOSP.
- deleted 9mo ago[deleted]
- veunes 9mo agoOnePlus is a textbook case of that quote
- deleted 9mo ago[deleted]
- Retr0id 9mo agoBlind speculation: I wonder if this is in some way related to DRM getting broken at a firmware level, leading to a choice being made between "users complain that they can't watch netflix" and "users complain that they can't install custom ROMs".
- dcdc123 9mo agoIt was because a method was discovered to bypass the lockout of stolen devices.
- userbinator 9mo agoIn other words the same old boogeyman they always use to justify this crap.
- dcdc123 9mo agoFrom what I understand this does not prevent use of custom ROMs, it just means ROMs built before it was done will not work anymore. I assume they can re-package old versions to work with the new configuration, I am not entirely sure though. There are discussions elsewhere in this thread with more informed people.
- userbinator 9mo agoit just means ROMs built before it was done will not work anymore. From the article: Any subsequent attempt to install older firmware results in a permanent "hard brick" - the device becomes unusable This implies that not only does an older custom ROM not work, but neither does attempting to recover by installing a newer ROM.
- dcdc123 9mo agoOh damn I missed that detail.
- IshKebab 9mo agoWhy? What advantage do they get from this? I'm assuming it's not a good one but I'm struggling to see what it is at all.
- hexagonwin 9mo agoThey can kill custom roms and force the latest vendor firmware. If they push a shitty update that slows down the phone or something, users have no choice other than buying a new device.
- bcraven 9mo agoThe article suggests custom roms can just be updated to be 'newer' than this. At the moment they're 'older' and would class as a rollback, which this fuse prevents.
- jeroenhd 9mo agoThey patched a low-level vulnerability in their boot process. Their phones' debug features would allow attackers to load an old, unpatched version of their (signed) software and exploit it if they didn't do some kind of downgrade prevention. Using eFuses is a popular way of implementing downgrade prevention, but also for permanently disabling debug flags/interfaces in production hardware. Some vendors (AMD) also use eFuses to permanently bond a CPU to a specific motherboard (think EPYC chips for certain enterprise vendors).
- WaitWaitWha 9mo agoIs this for just one or several OnePlus models? If so, is this 'fuse' per-planned in the hardware? My understanding is cell phones take 12 to 24 months from design to market. so, initial deployment of the model where this OS can trigger the 'fuse' less one year is how far back the company decided to be ready to do this?
- TomatoCo 9mo agoLots of CPUs that have secure enclaves have a section of memory that can be written to only once. It's generally used for cryptographic keys, serials, etcetera. It's also frequently used like this.
- Muromec 9mo agoFuses are there on all phones since 25+ years ago, on the real phone CPU side. With trusted boot and shit. Otherwise you could change IMEI left and right and it's a big no-no. What you interact with runs on the secondary CPU -- the fancy user interface with shiny buttons, but that firmware only starts if the main one lets it.
- userbinator 9mo agoOtherwise you could change IMEI left and right and it's a big no-no. You can still change the IMEI on many phones if you know how to.
- happycube 9mo agoThis is in the Qualcomm SOC chip, so it's not something that has to be designed into the phone per se.
- scbzzzzz 9mo agoWhat do OnePlus gain from this? Can someone explain me what are the advantages of OnePlus doing all this? A failed update resulting in motherboard replacement? More money, more shareholders are happy? I still sometimes ponder if oneplus green line fiasco is a failed hardware fuse type thing that got accidentally triggered during software update. (Insert I can't prove meme here).
- TomatoCo 9mo agoMy understanding is there was a bug that let you wipe and re-enable a phone that had been disabled due to theft. This prevents a downgrade attack. It's in OnePlus's interest to make their phones less appealing for theft, or, in their interest to comply with requirements to be disableable from carriers, Google, etc.
- scbzzzzz 9mo agoMake perfect sense, Thanks kind stranger. Hope it is the reason and not some corporate greed. It on me, lately my thoughts are defaulted towards corporates sabotaging consumers. I need to work on it. The effects on custom os community is causing me worried ( I am still rocking my oneplus 7t with crdroid and oneplus used to most geek friendly) Now I am wondering if there are other ways they could achieved the same without blowing a fuse or be more transparent about this.
- zozbot234 9mo agoI don't think so. Blowing a fuse is just how the "no downgrades" policy for firmware is implemented. No different for other vendors actually, though the software usually warns you prior to installing an update that can't be manually rolled back.
- chasil 9mo agoAre you quite certain? Google pushed a non-downgradable final update to the Pixel 6a. I was able to install Graphene on such a device. Lineage was advertised and completely incompatible, but some hinted it would work.
- syntaxing 9mo agoOnePlus has pretty much become irrelevant since Carl Pei left the company. Its more or less just a rebranded Oppo nowadays. I'm not an android user anymore but I'm rooting for his new(ish) Nothing company. Hopefully it carries the torch for the old OnePlus feel.
- Raed667 9mo agoAs an early OnePlus user (1, 3, 5, 7, 13) i find myself unimpressed with what Nothing is proposing, feels more like a design exercise than a flagship killer
- skeledrew 9mo agoI've been with OnePlus since the beginning, and am not at all impressed by the Nothing. Primary missing feature which I've come to depend on, off screen gestures, is missing. And the device just comes across as foreign in general; makes me think of the iPhone, which is not something I want to think of.
- opan 9mo agoThey consistently have allowed bootloader unlocking without extra fuss and have had good LineageOS support. That is their main appeal, IMO. Nothing phones had no LineageOS support until recently (spacewar is now supported, unsure about other models), and it's not clear if there's enough of a community/following to keep putting LineageOS on them. I do not want any phone where I'm stuck with the stock ROM.
- zozbot234 9mo agoNothing phones also allow seamless bootloader unlocking, just like OnePlus. There's been some rumors that OnePlus might be about to exit the market altogether, if so Nothing will probably expand into their niche and beyond their current approach based on "unique" design.
- opan 8mo agoThis is true, but only half the equation. Nothing Phone 1 took ages to get LineageOS support and the already-supported OnePlus 8T had similar specs. Though if OnePlus pisses everyone off, maybe Nothing will take their place and get more LOS maintainers, in which case I'd be fine switching to their devices.
- bflesch 9mo agoHow likely is it that such software-activated fuse-based kill switches are built into iPhones? Any insights?
- jacquesm 9mo agoI'd say for commercial hardware it is a near certainty even if you won't ever know until it is much too late. Realize that many of these manufacturers sell their hardware in and employ companies in highly policed societies. Just the fact that they are allowed to continue to operate implies that they are playing ball and may well have to perform a couple of favors. And that's assuming they are fully aware of what they are shipping, which may not be always the case. I don't think it is a bad model at all to consider any cell phone to be compromised in multiple ways even though you don't have hard proof.
- hexagonwin 9mo agoiPhones already cannot be downgraded, they can only install OS versions signed by apple during the install time. (search SHSH blobs) They also can't run unsigned IPA files (apps). Not sure if they have a physical fuse, but it's not much different.
- hoistbypetard 9mo agoThe significant difference is that if it were placed into DFU mode and connected to an appropriate device that had access to appropriately signed things, it could be "unbricked" without replacing the mainboard.
- hexagonwin 9mo agotrue, but I believe these bricked oneplus devices can also be revived from 9008 (EDL) if they can find the qualcomm firehorse loader file.
- Retr0id 9mo agoThe M-series CPUs found in iPads (which cannot boot custom payloads) are the same as the M-series CPUs found in Macbooks (which can boot custom payloads) - just with different fuses pre-burnt during manufacturing. Pre-prod (etc.) devices will also have different fuses burnt.
- tripdout 9mo ago> When the device powers on, the Primary Boot Loader in the processor's ROM loads and verifies the eXtensible Boot Loader (XBL). XBL reads the current anti-rollback version from the Qfprom fuses and compares it against the firmware's embedded version number. If the firmware version is lower than the fuse value, boot is rejected. When newer firmware successfully boots, the bootloader issues commands through Qualcomm's TrustZone to blow additional fuses, permanently recording the new minimum version What exactly is it comparing? What is the “firmware embedded version number”? With an unlocked bootloader you can flash boot and super (system, vendor, etc) partitions, but I must be missing something because it seems like this would be bypassable. It does say > Custom ROMs package firmware components from the stock firmware they were built against. If a user's device has been updated to a fused firmware version & they flash a custom ROM built against older firmware, the anti-rollback mechanism triggers immediately. and I know custom ROMs will often say “make sure you flash stock version x.y beforehand” to ensure you’re on the right firmware, but I’m not sure what partitions that actually refers to (and it’s not the same as vendor blobs), or how much work it is to either build a custom ROM against a newer firmware or patch the (hundreds of) vendor blobs.
- Muromec 9mo ago>What exactly is it comparing? What is the “firmware embedded version number”? With an unlocked bootloader you can flash boot and super (system, vendor, etc) partitions, but I must be missing something because it seems like this would be bypassable. This doesn't make sense unless the secondary boot is signed and there is a version somewhere in signed metadata. Primary boot checks the signature, reads the version of secondary boot and loads it only if the version it's not lower than what write-once memory (fuse) requires. If you can self-sign or disable signature, then you can do whatever boot you want, as long as it's metadata satisfies the version.
- ARob109 9mo agoFirmware (XBL and other non OS components) are versioned with anti rollback values. If the version is less than the version burned into the fuses the firmware is rejected. The “boot” partition is typically the Linux kernel. Android Verified Boot loads and hashes the kernel image and compares it to the expected hash in the vbmeta partition. The signature of the hash of the entire vbmeta metadata is compared to a public key coded into the secondary boot loader (typically abl (fastboot before fastbootd was done in user space to support super partitions)) The abl firmware contains an anti rollback version that is checked with the eFuse version. The super partition is a bunch of lvm logical partitions on top of a single physical partition. Of these, is the main root filesystem which is mounted read only and protected with dm-verity device mapping. The root hash of this verity rootfs is also stored in the signed vbmeta. Android Verified Boot also has an anti rollback feature. The vbmeta partition is versioned and the minimum version value is stored cryptographically in a special flash partition called the Replay Protected Memory Block (rpmb). This prevents rollback of boot and super as vbmeta itself cannot be rolled back.
- jacquesm 9mo agoThis goes beyond the 'right to repair' to simply the right of ownership. These remote updates prove again and again that even though you paid for something you don't actually own it.
- mystraline 9mo agoIndeed. My ownership is proved by my receipt from the store I bought it from. This vandalization at scale is a CFAA violation. I'd also argue it is a fraudulent sale since not all rights were transferred at sale, and misrepresented a sale instead of an indefinite rental. And its likely a RICO act, since the C levels and BOD likely knew and/or ordered it. And damn near everything's wire fraud. But if anybody does manage to take them to court and win, what would we see? A $10 voucher for the next Oneplus phone? Like we'd buy another.
- amelius 9mo agoTheir defense would probably be like: "you clicked Yes on the EULA form."
- dataflow 9mo agoAs far as legal arguments go, I imagine their first counter would be that you agreed to the update, so it's on you.
- mystraline 9mo agoA forced update or continual loop of "yes" or "later" is not consent. The fact that there is no "No" option shows that. Fabricated or fake consent, or worse, forced automated updates, indicates that the company is the owner and exerting ownership-level control. Thus the sale was fraudulently conducted as a sale but is really an indefinite rental.
- ndriscoll 9mo agoIt Is not an indefinite rental. A sale can't be "misrepresented". It is a blatant CFAA violation. They are accessing your computer, modifying its configuration, and exfiltrating your private data without your authorization. If I buy a used vehicle for example, I have exactly zero relationship with the manufacturer. I never agree to anything at all with them. I turn the car on and it goes. They do not have any authorization to touch anything. We shouldn't confuse what's happening here. The engineers working on these systems that access people's computers without authorization should absolutely be in prison right alongside the executives that allowed or pushed for it. They know exactly what they're doing.
- hypeatei 9mo agoIt's my first time hearing about this "eFuse" functionality in Qualcomm CPUs. Are there non-dystopian uses for this as a manufacturer?
- Retr0id 9mo agoeFuses are in most CPUs, often used for things like disabling hardware debug interfaces in production devices - and rollback prevention.
- hexagonwin 9mo agoSamsung uses this for their Knox security feature. The fuse gets broken in initial bootloader unlock, and all features related to Knox (Samsung Pay, Secure Folder, etc) gets disabled permanently even after reverting to stock firmware.
- thesh4d0w 9mo agoI use them in an esp32 to write a random password to each of my products, so when I sell them they can each have their own secure default wifi password while all using the same firmware.
- josephcsible 9mo agoWhat advantage do you see from using eFuses and not some other way to store the password?
- thesh4d0w 9mo agoThis is the only way I could come up with that would allow an end user to do a full factory reset, and end up back in a known good secure state afterwards. Storing it in the firmware would mean every user has the same key. Storing it in eeprom means a factory reset will clear it. This allows me to ship hardware with the default key on a sticker on the side, and let's a non technical user reset it back to that if they need to. It gives you a 256bit block to work with - https://docs.espressif.com/projects/esp-idf/en/stable/esp32/api-reference/system/efuse.html https://docs.espressif.com/projects/esp-idf/en/stable/esp32/...
- deleted 9mo ago[deleted]
- zozbot234 9mo agoAccording to OP this does not disable bootloader unlocking in itself. It makes the up-versioned devices incompatible with all previous custom ROMs, but it should be possible to develop new ROM releases that are fully compatible with current eFuse states and don't blow the eFuse themselves.
- palata 9mo agoI understand that there is a nuance somewhere, but that's about it. Can you explain it in simpler terms such that an idiot like me can understand? Like what would an alternative OS have to do to be compatible with the "current eFuse states"?
- Muromec 9mo agoPeople need to re-sign their releases and include the newer version of bootloader, more or less.
- zozbot234 9mo agoYes, though noting that since the antirollback is apparently implemented by the bootloader itself on this Qualcomm SoC, this will blow the fuse on devices where the new version is installed, so the unofficial EDL-mode tools that the community seems to be most concerned about will still be unavailable, and users will still be unable to downgrade from the newer to older custom ROM builds.
- Muromec 9mo agoNot being able to downgrade and using the debug tools was the exact point of doing this thing, as far as I understand.
- fc417fc802 9mo ago> unofficial EDL-mode tools The linked page seems to indicate that the EDL image is also vendor signed. Wouldn't that mean they're official? Unless I've misunderstood, the EDL image is tied to the same set of fuses as the XBL image so it's only useful to recover if the fuses don't get updated. Which seems like an outlandish design choice to me because it means that flashing a new XBL leaves you in a state where you lack the fallback tooling (hence the reports of people forced to replace the motherboard) and also that if there's anything wrong with the new XBL that doesn't manifest until after the stage where it blows the fuses then the vendor will have managed to irreversibly brick their own devices via an only slightly broken update.
- charcircuit 9mo agoThis is industry standard. Flashing old updates that are insecure to bypass security is a legitimate attack vector that needs to be defended against. Ideally it would still be possible up recover from such a scenario by flashing the latest update.
- orbital-decay 9mo agoWhat's being attacked in this particular case?
- charcircuit 9mo agoThe phone. It's the same attacks that secure boot tries to protect against. The issue is that these old, vulnerable versions have a valid signature allowing them to be installed.
- digiown 9mo agoStandard?? The standard is for the upgrade to be refused or not boot until you flash a newer one, not to brick the phone permanently. It's not an "ideally" thing for the manufacturer to not intentionally brick your device you bought and paid for.
- deleted 9mo ago[deleted]
- charcircuit 9mo ago>and you may damage your device permanently https://service.oneplus.com/us/search/search-detail?id=op588 https://service.oneplus.com/us/search/search-detail?id=op588 They make it clear that this feature is unsupported and it's possible to mess things up. The reason why it's an ideal and not an expectation is that flashing alternate operating systems is done at one's own risk and is unsupported. They have already told the users that they bear no responsibility for what may go wrong if they flash the wrong thing on that device. Flashing incompatible operating systems to the device requires people to be careful and proper care to ensure compatibility before going through with flashing was not done.
- mystraline 9mo agoIts high time we start challenging these sorts of actions as the "vandalization and sabotage at scale" that these attacks really are. I dont see how these aren't a direct violation of the CFAA, over millions of customer-owned hardware. They are no different than some shit ransomware, except there is no demand for money. However, there is a demonstrable proof of degradation and destruction of property in all these choices. Frankly, criminal AND civil penalties should be levied. Criminally, the C levels and boars of directors should all be in scope as to encouraging/allowing/requiring this behavior. RICO act as well, since this smells like a criminal conspiracy. Let them spend time in prison for mass destruction of property. Civally, start dissolving assets until the people are made whole with unbroken (and un-destroyed) hardware. The next shitty silly-con valley company thinks about running this scam of 'customer-bought but forever company owned', will think long and hard about the choices of their network and cloud.
- skeledrew 9mo ago> no demand for money There is when the device becomes hard bricked and triggers an unnecessary need for a new one.
- skeledrew 9mo agoThis is absolutely cracked. I've been with OnePlus since the One, also getting the 2, 6 and now I have the 12. Stuck with them all these years because I really respected their - original - take on device freedom. I really should've seen the writing on the wall given how much pain it is to update it in the first place, as I have the NA version which only officially allows carrier updates, and I don't live in NA (and even if I did I'd still not be tied to a carrier). Now I have to consider my device dead re updates, because if I haven't already gotten the killing update I'd rather avoid it. First thing I did was unlock the bootloader, and I intend to root/flash it at some point. Will be finding another brand whenever I'm ready to upgrade again.
- dataflow 9mo agoThis wasn't their only pain point. [1] Just get off OnePlus, you'll be happier. [1] https://dontkillmyapp.com/oneplus https://dontkillmyapp.com/oneplus
- BeetleB 9mo agoWhat are good alternatives that aren't Pixel?
- palata 9mo agoFor now, Pixels. I'm waiting to see what non-Pixel phone will be supported by GrapheneOS next, but this may take a while.
- wolvoleo 9mo agoYeah I'm surprised that they announced it but not the vendor name. I'm sure Google with their infinite resources already know which vendor it is. So who are they hiding it from?
- literallywho 9mo agoFascinating. I've had a OnePlus 6 from 2018 until 2023 (all on stock software) and I've not had or noticed any issues like that.
- RugnirViking 9mo agoisnt this just like... vandalism? nothing could give them the right to do this, they're damaging others property indescriminately.
- deleted 9mo ago[deleted]
- userbinator 9mo agoI'm not sure if this is the case anymore, but many unbranded/generic Androids used to be completely unlocked by default (especially Mediatek SoCs) and nearly unbrickable, and that's what let the modding scene flourish. I believe they had efuses too, but software never used them.
- jijji 9mo agoim sure that is not going to improve their sales numbers
- pengaru 9mo agoGlad I didn't give these people any of my hard earned dollars.
- 1a527dd5 9mo agoI look forward to the 1hr+ rant from Louis Rossmann.
- poizan42 9mo agoHe has already made the video on this, but it is only 3:23: https://youtu.be/3AiRB5mvEsk?si=XapAHhHRJtssDI4F https://youtu.be/3AiRB5mvEsk?si=XapAHhHRJtssDI4F
- mycall 9mo agoHow hard is it to fix a fuse with a microscope and a steady hand?
- userbinator 9mo agoYou'll need at least an electron microscope... but defeating MCU readout protection using a FIB is actually a thing: https://www.eag.com/services/engineering/fib-circuit-edit-debug/ https://www.eag.com/services/engineering/fib-circuit-edit-de... Costs are what you'd expect for something of this nature.
- QuiEgo 9mo agoVery hard. FIB is the only known way to do this but even then, that's the type of thing where you start with a pile of SoCs and expect to maybe get lucky with one in a hundred. A FIB machine is also millions of dollars.
- piskov 9mo agoSo that’s how in an event of war US adversaries will be relieved of their devices > The anti-rollback mechanism uses Qfprom (Qualcomm Fuse Programmable Read-Only Memory), a region on Qualcomm processors containing one-time programmable electronic fuses. What a nice thoughtful people to build such a feature. That’s why you sanction the hell out of Chinese Loongson or Russian Baikal pity of CPU — harder to disable than programmatically “blowing a fuse”.
- rwmj 9mo agoThere's so many ways to do this, but a simpler method is to hide a small logic block (somewhere in the 10 billion transistors of your CPU) that detects a specific, long sequence of bits and invokes the kill switch.
- Muromec 9mo agoThis kind of thing is generally used to disallow downgrading the bootloader once there is a bug in chain of trust handling of the bootloader. Otherwise once broken is forever broken. It makes sense from the trusted computing perspective to have this. It's not even new, it was still there on p2k motorollas 25 years ago. You may not want trusted computing and root/jailbreak everything as a consumer, but building one is not inherently evil.
- piskov 9mo ago> It's not even new, it was still there on p2k motorollas 25 years ago. I’m sure CIA was not founded after covid :-)
- obnauticus 9mo agoUhh…Wut?
- piskov 9mo agoLet me remind you the gist of the parent comment: > So that’s how in an event of war US adversaries will be relieved of their devices
- poizan42 9mo agoDoes anyone know if it has been confirmed that this only applies to the "ColorOS" branded firmware versions? Because I currently have an update to OxygenOS 16.0.3.501 pending on my OnePlus 15, which is presumably built from the same codebase. Edit: It seems that this does apply to OxygenOS too: https://xdaforums.com/t/critical-warning-coloros-16-0-3-501-updates-permanent-anti-rollback-arb-fuse-blown-do-not-downgrade.4775930/page-11#post-90460315 https://xdaforums.com/t/critical-warning-coloros-16-0-3-501-...
- InsomniacL 9mo agoDoes intentionally physically damaging a device fall foul of any laws that a software restriction otherwise wouldn't?
- plutokras 9mo agoNintendo has been doing this for ages. https://news.ycombinator.com/item?id=30773214 https://news.ycombinator.com/item?id=30773214
- geor9e 9mo agoThis has been a commonplace feature on SOCs for a decade or two now. The comments seem to be taking this headline as out‑of‑the‑ordinary news, phrased as if Oneplus invented it. Even cheapo devices often use an eFuse as anti-rollback. We do it at my work whenever root exploits are found that let you run unsigned code. If we don't blow an eFuse, then those security updates can just be undone, since any random enemy with hardware access could plug in a USB cable, flash the older exploitable signed firmware, steal your personal data, install a trojan, etc. I get the appeal of ROMs/jailbreaking/piracy but it relies on running obsolete exploitable firmware. It's not like they're forcing anyone to install the security patch who doesn't want it. This is normal.
- palijer 9mo agoIt ain't normal to me. If I bought a phone, I should be able to decide that I want to run different software on it. Let's say OP takes a very different turn with their software that I am comfortable with - say reporting my usage data to a different country. I should be able to say "fuck that upgrade, I'm going to run the software that was on my phone when I originally bought it" This change blocks that action, and from my understanding if I try to do it, it bricks my phone.
- jnwatson 9mo agoThe whole point of this is so that when someone steals your phone, they can't install an older vulnerable version of the firmware than can be used to set it back to factory settings which makes it far more valuable for resale.
- QuiEgo 9mo agoIt'd be ideal if the phone manufacturer had a way to delegate trust and say "you take the risk, you deal with the consequences" - unlocking the bootloader used to be this. Now we're moving to platforms treating any unlocked device as uniformly untrusted, because of all of the security problems your untrusted device can cause if they allow it inside their trust boundary. We cant have nice things because bad people abused it :(. Realistically, we're moving to a model where you'll have to have a locked down iPhone or Android device to act as a trusted device to access anything that needs security (like banking), and then a second device if you want to play. The really evil part is things that don't need security (like say, reading a website without a log in - just establishing a TLS session) might go away for untrusted devices as well.
- MarkusWandel 9mo agoThat's insane. If the CPU has enough fuses (which according to the wiki it does) why the h*ck can't they just make it impossible to reflash the >= minimum previously installed version of the OS after preventing the downgrade? Why the hard brick?
- peterhon 9mo agoUnfortunately similar things will be mandated by EU law through cyber resiliance act (CRA) in order to ensure tamper free boot of any kind of device sold in the EU from Dec 2027. Basically breaking any kind of FOSS or repairability, creating dead HW bricks if the vendor ceases to maintain or exist.
- zb3 9mo agoIt's Google's fault. I want to buy a smartphone without AVB at all. With no "secure boot" fuse blown (yes I DO know that this is not the same fuse) and ideally I'd want to provision my own keys. But vendors wouldn't be able to say the device runs "Android" as it's trademarked. AVB is therefore mandatory and in order for AVB to be enforced, you can't really control the device - unlocking the bootloader gives you only partial control, you can't flash your own "abl" to remove AVB entirely. But I don't want AVB and I can't buy such device for money.. this isn't free market, this is Google monopoly..
- digiown 9mo agoThe closest thing you can get is probably the Pixel, ironically. You can provision your own keys, enroll it into AVB, and re-lock the bootloader. From the phone hardware's perspective there is no difference between your key and Google's. No fuse is ever blown.
- zb3 9mo agoThat's not really true, there will be a warning shown that "the phone is loading a different operating system" - I've seen that when installing GrapheneOS on my pixel. But it's not just about that, it's about the fact that I can't flash my own "abl" or the software running in the TrustZone there at all as I don't control the actual signing keys (not custom_avb_key) and I'm not "trusted" by my own device.. There were fuses blown as evident by examining abl with its fastboot commands - many refuse to work saying I can't use it on a "production device". Plus many of those low-level partitions are closed source proprietary blobs.. Yes yes - I DO understand that for most people this warning is something positive, otherwise you could buy a phone with modified software without realizing it and these modifications could make it impossible to restore the original firmware.
- digiown 9mo agoAh, I forgot about the warning. Are the blown fuses you're talking about related to to your unlocking though? Or did they just remove the debug functions. I guess it reduces the attack surface somewhat. I do agree it's far from ideal though. But there are so many, much worse offenders that uses these fuses to actually remove features, and others that do not allow installing a different OS at all. The limited effort should probably be spent on getting rid of those first.
- abhaynayar 9mo agoDamn, I just saw that update yesterday on my phone and did not update it for no reason. Turned off auto-update right now until I figure out what to do.
- jnwatson 9mo agoSo much ignorance in this thread. There's nothing new here. All manufacturers worth their salt have this feature. This is ultimately about making the device resistant to downgrade attacks. This is what discourages thieves from stealing your phone.
- foxes 9mo agoHow is graphene considered the most secure phone os but you can still flash on new firmware? I don't care if they can downgrade the device, just that I boot into a secure verified environment, and my data is protected. I also think thieves will just grab your phone regardless, they can still sell the phone for parts, or just sell it anyway as a scam etc.
- jnwatson 9mo agoThe attack is simple: the attacker downgrades the phone to a version of firmware that has a vulnerability. The attacker then uses the vulnerability to get at your data. Your data is PIN-protected? The attacker uses the vulnerability to disable the PIN lockout and tries all of them. There's over a 10x difference in fence price between a locked and unlocked phone. That's a significant incentive/deterrent.
- foxes 9mo agoDon't pixels have a security chip that is supposed to make that infeasible? It has some increasing timer for auth, and if you try and factory reset it - it destroys all the data? As I said its less important that the thief can boot a new os, the security of my data is more important. How is that compromised? It feels like a thief is just going to opportunistically grab a phone from you rather than analyse what device it is.
- deleted 9mo ago[deleted]
- concinds 9mo agoI've been dismayed by how fast the "we should own our hardware" crowd has so quickly radicalized into "all security features are evil", and "no security features should exist for anyone". Not just "there should be some phone brands that cater to me", but "all phone brands, including the most mainstream, should cater to me, because everyone on earth cares more about 'owning their hardware' than evil maid attack prevention, Cellebrite government surveillance, theft deterrence, accessing their family photos if they forget their password, revocable code-signing with malware checks so they don't get RATs spying on their webcam, etc, and if they don't care about 'owning their hardware' more than that, they are wrong". It is objectively extremist and fanatical.
- cmxch 9mo agoSo OnePlus is no better than the rest of the pack.
- neals 9mo agoHow does an eFuse even work?
- Oxodao 9mo agoOneplus went shit since the 6. Pretty sad, they used to be a great brand...
- veunes 9mo agoIf this becomes the norm, it effectively ends the idea that you own the hardware you paid for
- Aissen 9mo agoThis does not surprise me from the company that accidentally deleted the widevine L1 certificate on my phone (that never had any third party OS) during an update and could not restore it, nor would it replace the motherboard (for which it claimed it was the only possible fix).
- willywanker 9mo agoWhat exactly is the threat model here of preventing Joe Nobody Famous or Important Poweruser from rooting the hardware they bought and paid for? If someone has physical access to your phone, you have a lot more to worry about than mere root exploits. And given those who root their devices are far out of the profile of ordinary users, so a specially targeted hack like this is pointless as compared to the regular kind of exploits in apps that can target a wider base.