3 ms·

The NSA Planned to Hijack Google App Store to Hack Smartphones [1] Given that software updates are automatic (unless you manually turn them off etc), how can y

The NSA Planned to Hijack Google App Store to Hack Smartphones [1] Given that software updates are automatic (unless you manually turn them off etc), how can you trust an app if you can't trust the platform? 1. https://firstlook.org/theintercept/2015/05/21/nsa-five-eyes-google-samsung-app-stores-spyware/ https://firstlook.org/theintercept/2015/05/21/nsa-five-eyes-...

mike_hearn 11y ago
Two things. Firstly, Android checks app signatures and as far as I know the market app doesn't have any ability to override that. It can do a few privileged things like skip showing the permissions screen, but I think the OS still wants to see correct signatures. So even if the app store was hacked the phone itself might reject a bogus upgrade. Secondly, that slide is more like some junior GCHQ guy noodling around, I think. It is old and dates from a time before Google used SSL for everything. I doubt it's possible to do via purely technical attacks now. Thirdly, it'd almost certainly be easier to attack the developer laptop/workstation to steal the signing keys directly than attack Android head on. I plan to do some research this summer into splitting the RSA signing keys used by Android apps to allow for threshold signed online updates for Android and maybe iOS.
- alfiedotwtf 11y ago
  > It is old and dates from a time before Google used SSL for everything Their budget is $52.6 billion and (as you say, the slides are old) they have lead time too. Let that sit for a moment.
- zyx321 11y ago
  The only way to change the signing key for an app (on an unrooted phone at least) is by completely uninstalling it (which deletes the main data directory) and then installing a new version. In fact, Google lost the key for their OTP authenticator app at one point, requiring all users to install the new app manually before they would receive updates again.
  - alfiedotwtf 11y ago
    Have you got a link? I can't find any info on that happening
    - zyx321 11y ago
      Couldn't find the blog post I read way back when it happened. The closest thing I could find was an Android news site describing the problem. [1] I'm 90% sure that a Google engineer admitted it on their official blog, but that was 2 years ago so I might be misremembering it. [1] http://www.androidpolice.com/2012/03/22/psa-googles-authenticator-updated-to-v2-except-its-a-brand-new-app-and-you-need-to-install-it-to-get-future-updates-old-one-is-dead/ http://www.androidpolice.com/2012/03/22/psa-googles-authenti...

mike_hearn 11y ago

Two things. Firstly, Android checks app signatures and as far as I know the market app doesn't have any ability to override that. It can do a few privileged things like skip showing the permissions screen, but I think the OS still wants to see correct signatures. So even if the app store was hacked the phone itself might reject a bogus upgrade. Secondly, that slide is more like some junior GCHQ guy noodling around, I think. It is old and dates from a time before Google used SSL for everything. I doubt it's possible to do via purely technical attacks now. Thirdly, it'd almost certainly be easier to attack the developer laptop/workstation to steal the signing keys directly than attack Android head on. I plan to do some research this summer into splitting the RSA signing keys used by Android apps to allow for threshold signed online updates for Android and maybe iOS.

alfiedotwtf 11y ago
> It is old and dates from a time before Google used SSL for everything Their budget is $52.6 billion and (as you say, the slides are old) they have lead time too. Let that sit for a moment.
zyx321 11y ago
The only way to change the signing key for an app (on an unrooted phone at least) is by completely uninstalling it (which deletes the main data directory) and then installing a new version. In fact, Google lost the key for their OTP authenticator app at one point, requiring all users to install the new app manually before they would receive updates again.
- alfiedotwtf 11y ago
  Have you got a link? I can't find any info on that happening
  - zyx321 11y ago
    Couldn't find the blog post I read way back when it happened. The closest thing I could find was an Android news site describing the problem. [1] I'm 90% sure that a Google engineer admitted it on their official blog, but that was 2 years ago so I might be misremembering it. [1] http://www.androidpolice.com/2012/03/22/psa-googles-authenticator-updated-to-v2-except-its-a-brand-new-app-and-you-need-to-install-it-to-get-future-updates-old-one-is-dead/ http://www.androidpolice.com/2012/03/22/psa-googles-authenti...