Slashdot Mirror
Secret Chips in Replacement Parts Can Completely Hijack Your Phone's Security (arstechnica.com)
Dan Goodin, writing for ArsTechnica: People with cracked touch screens or similar smartphone maladies have a new headache to consider: the possibility the replacement parts installed by repair shops contain secret hardware that completely hijacks the security of the device. The concern arises from research that shows how replacement screens -- one put into a Huawei Nexus 6P and the other into an LG G Pad 7.0 -- can be used to surreptitiously log keyboard input and patterns, install malicious apps, and take pictures and e-mail them to the attacker. The booby-trapped screens also exploited operating system vulnerabilities that bypassed key security protections built into the phones. The malicious parts cost less than $10 and could easily be mass-produced. Most chilling of all, to most people, the booby-trapped parts could be indistinguishable from legitimate ones, a trait that could leave many service technicians unaware of the maliciousness. There would be no sign of tampering unless someone with a background in hardware disassembled the repaired phone and inspected it. The research, in a paper presented this week (PDF) at the 2017 Usenix Workshop on Offensive Technologies, highlights an often overlooked disparity in smartphone security. The software drivers included in both the iOS and Android operating systems are closely guarded by the device manufacturers, and therefore exist within a "trust boundary."
I wonder which phone manufacturers sponsored this FUD. Technically possible? Sure. Any evidence it has ever occurred in the wild? No. Would this sort of malicious hardware have to transmit data in some way to offload the stolen information, thus raising alarms in various corporate type networks and the like? Eventually.
Better known as 318230.
The same thing can be done with original screens.
Didn't the NSA teach us this was such a thing?
Hoorah, now you have the right to turn your own phone into a surveillance device.
By asserting your right to fix your own phone, you've destroyed not only your own privacy, but the privacy of all your contacts.
Boo-yeah!
Representatives threw up their hands and muttered (in Korean): Hey, if they can understand what I'm saying, fuckyouverymuch, then we're officially blown. Please tell our beloved dictator to cancel those plans on Guam. No, the bombing part only. His scuba dive trip will still proceed as scheduled--we don't want to disappoint him now, do we?
Such as faulty/counterfeit batteries used in Galaxy Note 4s during repair.
deleting the extra space after periods so i can stay relevant, yeah.
Once you give up physical access to your device, you give up security. This is no different than the possibility that a locksmith could use a copy of a key he made for you. It's stupid.
It's pandora's box baby. I work in automotive security, and even if we airgap systems, we basically can't assume that all systems will be airgapped. It's so easy for an owner (or even a non-owner, clandestinely) to install a tiny piece of hardware with an internet connection that bridges to a previously airgapped system. The miniturization of electronics will be a security nightmare for the years to come.
The genuine original chips do that too!
So fine, your screen part has a malicious "touch logger" capability... how does it send data? Oh yeah, it CAN'T.
This sounds like FUD to make sure customers use the most expensive repair channel - the original manufacturer - to have the work done.
"A hacked touchscreen can inject pre-scripted touch events into the event screen"
Of course, this assumes:
a) the device is unlocked
b) the malicious driver can guess where the required touch zones are located (no small feat, considering the diversity of softkey layouts (e.g, Samsung vs Nexus vs LG vs HTC), homescreen launchers, and the layout of app drawers (depending upon what the user installed).
c) Since malware (in addition to the driver itself) is almost a requirement (given a & b), the hardware itself is almost superfluous. At most, it might log touch events to its own local ram, then make them available to malware that knows how to use the attack chip (events Android itself might otherwise choose to not share with the malware).
Put another way, under precisely the right circumstances, a mouse can be used to completely hijack a device's security (by guessing where to move & generating phantom clicks). And if pigs had gills, they could breathe underwater.
The more likely scenario: a state espionage agency replaces touchscreen controller chips with hand-crafted replacements that include a simple radio transmitter so they can remotely monitor & log touch events. That's an ENTIRELY different challenge than implementing your own network stack or attempting to do naughty things over the i2c bus or as a USB peripheral.
Put another way, this is a multi-stage attack that's SO outrageously complex, requiring so many resources from the attacker, and requiring so much knowledge about the state of the target victim's phone, even taking it seriously as a possibility of something that has happened to you requires venturing into the realm of conspiracy-theory paranoia. There are easier, cheaper, and more profitable ways to compromise a user's device without going so far off the complexity deep-end.
"Closely guarded", i.e. unauditable, would imply that they are outside of any trust boundary: they would be the least trusted software components present on the system. And if the OS just happens to treat them as more trusted, that's merely a hilariously disastrous design flaw. But not unexpected, since most of us run fairly shitty OSes on our handhelds.
And as for the bigger picture, it's not news that "if you didn't build it, then you don't know what it does." That's the big problem with handheld PC hardware right now: almost nobody builds it themselves (as opposed to ATX, etc form factor systems).
BTW, whining about "malicious hardware" getting added to your phone is kind of funny. Most people knowingly buy phones already containing malicious hardware on purpose, planted by the manufacturer, without any subterfuge or denial. This isn't even an "open secret," it's just open. Apple's phones have stuff that directly works against the user to prevent them from installing whatever software they want, many Android phones contain hardware to allow the to be compatible with DRM, etc. You know you are buying a computer intended to serve someone else at your expense at the time you put down your money. And also, for all you know, some government pointed a gun at the manufacturer and it might contain a key logger already. Why wouldn't it?
(This is all somewhat related to why I still haven't put my phone on my VPN. I just assume it's compromised, because there are so many ways that it might have been, and by so many different parties. Yes, I hate my phone.)
This is the case for all iOS users (nobody can buy a trustworthy iOS device) and a vast majority of Android users (trustworthy Android phones probably exist, though I don't happen to know where to get one). In many ways, the handheld computer situation is actually worse than the desktop situation of the 1990s. In terms of security, these are not good times.
I'll be sure to pay out the a$$ for the expensive parts with spyware approved by the shiny people.
Requiem for the American Dream
You're all getting the grief you deserve for wasting your time, money, and attention on what amounts to a shiny toy. We got along just fine without smartphones before they showed up, but now you're all like a bunch of drug addicts, you can't go 5 minutes without checking your goddamned stupid Facebook or whatever other social-media nonsense you waste your time on, or play some dumbass game, or light money on fire by 'streaming' video from somewhere because you can't BEAR to be bored, ever. You're like little kids with overly-permissive parents, spoiled rotten and totally out of control. You're going to pay for it one way or another when you have ZERO privacy in your life, and get your identities stolen repeatedly, and your life savings drained away. I have nothing but contempt for all of you and will point and laugh when you're utterly ruined.
Ken Thompson's Reflections on Trusting Trust is well worth a read. Long story short, anyone with access to the hardware/software stack of your machine can compromise its security.
These attacks are not merely theoretical. The key to good security is to make the cost of compromise greater than the value of whatever would be received by doing so. For the average person, their privacy is not worth the effort of surrepitiously installing hardware. However, if you're a Palestinian terrorist... You may just want to have someone else purchase/service your electronic devices, as the Israeli equivalent of the CIA has planted explosives in the cellphones of Palestinians (and successfully carried out assassinations this way.)
The society for a thought-free internet welcomes you.
If i were Apple or Google i would finance this to discourage third party cheap parts and repairs... devious.
How hard would it be to monitor and log the transmissions through your router to detect what your device is doing?
by this line of reasoning, how do you trust the original equipment you get? how would you ever know the original parts had not been tampered with?
This just shows that you should always order by mail order or by Amazon, so that the NSA can install their own chips inside instead of the other ones a repair shop would install.
-- Tigger warning: This post may contain tiggers! --
Ken Thompson's Reflections on Trusting Trust is well worth a read. Long story short, anyone with access to the hardware/software stack of your machine can compromise its security.
These attacks are not merely theoretical. The key to good security is to make the cost of compromise greater than the value of whatever would be received by doing so. For the average person, their privacy is not worth the effort of surrepitiously installing hardware. However, if you're a Palestinian terrorist... You may just want to have someone else purchase/service your electronic devices, as the Israeli equivalent of the CIA has planted explosives in the cellphones of Palestinians (and successfully carried out assassinations this way.)
... and Palestinians are naturally the default examples of terrorists, because resisting an illegal, brutal foreign military dictatorship is 'terrorism'.