Slashdot Mirror
Secret Chips in Replacement Parts Can Completely Hijack Your Phone's Security (arstechnica.com)
Dan Goodin, writing for ArsTechnica: People with cracked touch screens or similar smartphone maladies have a new headache to consider: the possibility the replacement parts installed by repair shops contain secret hardware that completely hijacks the security of the device. The concern arises from research that shows how replacement screens -- one put into a Huawei Nexus 6P and the other into an LG G Pad 7.0 -- can be used to surreptitiously log keyboard input and patterns, install malicious apps, and take pictures and e-mail them to the attacker. The booby-trapped screens also exploited operating system vulnerabilities that bypassed key security protections built into the phones. The malicious parts cost less than $10 and could easily be mass-produced. Most chilling of all, to most people, the booby-trapped parts could be indistinguishable from legitimate ones, a trait that could leave many service technicians unaware of the maliciousness. There would be no sign of tampering unless someone with a background in hardware disassembled the repaired phone and inspected it. The research, in a paper presented this week (PDF) at the 2017 Usenix Workshop on Offensive Technologies, highlights an often overlooked disparity in smartphone security. The software drivers included in both the iOS and Android operating systems are closely guarded by the device manufacturers, and therefore exist within a "trust boundary."
I wonder which phone manufacturers sponsored this FUD. Technically possible? Sure. Any evidence it has ever occurred in the wild? No. Would this sort of malicious hardware have to transmit data in some way to offload the stolen information, thus raising alarms in various corporate type networks and the like? Eventually.
Better known as 318230.
Such as faulty/counterfeit batteries used in Galaxy Note 4s during repair.
deleting the extra space after periods so i can stay relevant, yeah.
Once you give up physical access to your device, you give up security. This is no different than the possibility that a locksmith could use a copy of a key he made for you. It's stupid.
So fine, your screen part has a malicious "touch logger" capability... how does it send data? Oh yeah, it CAN'T.
This sounds like FUD to make sure customers use the most expensive repair channel - the original manufacturer - to have the work done.
"A hacked touchscreen can inject pre-scripted touch events into the event screen"
Of course, this assumes:
a) the device is unlocked
b) the malicious driver can guess where the required touch zones are located (no small feat, considering the diversity of softkey layouts (e.g, Samsung vs Nexus vs LG vs HTC), homescreen launchers, and the layout of app drawers (depending upon what the user installed).
c) Since malware (in addition to the driver itself) is almost a requirement (given a & b), the hardware itself is almost superfluous. At most, it might log touch events to its own local ram, then make them available to malware that knows how to use the attack chip (events Android itself might otherwise choose to not share with the malware).
Put another way, under precisely the right circumstances, a mouse can be used to completely hijack a device's security (by guessing where to move & generating phantom clicks). And if pigs had gills, they could breathe underwater.
The more likely scenario: a state espionage agency replaces touchscreen controller chips with hand-crafted replacements that include a simple radio transmitter so they can remotely monitor & log touch events. That's an ENTIRELY different challenge than implementing your own network stack or attempting to do naughty things over the i2c bus or as a USB peripheral.
Put another way, this is a multi-stage attack that's SO outrageously complex, requiring so many resources from the attacker, and requiring so much knowledge about the state of the target victim's phone, even taking it seriously as a possibility of something that has happened to you requires venturing into the realm of conspiracy-theory paranoia. There are easier, cheaper, and more profitable ways to compromise a user's device without going so far off the complexity deep-end.
I'll be sure to pay out the a$$ for the expensive parts with spyware approved by the shiny people.
Requiem for the American Dream
Ken Thompson's Reflections on Trusting Trust is well worth a read. Long story short, anyone with access to the hardware/software stack of your machine can compromise its security.
These attacks are not merely theoretical. The key to good security is to make the cost of compromise greater than the value of whatever would be received by doing so. For the average person, their privacy is not worth the effort of surrepitiously installing hardware. However, if you're a Palestinian terrorist... You may just want to have someone else purchase/service your electronic devices, as the Israeli equivalent of the CIA has planted explosives in the cellphones of Palestinians (and successfully carried out assassinations this way.)
The society for a thought-free internet welcomes you.
This just shows that you should always order by mail order or by Amazon, so that the NSA can install their own chips inside instead of the other ones a repair shop would install.
-- Tigger warning: This post may contain tiggers! --