Slashdot Mirror
Android Oreo's Rollback Protection Will Block OS Downgrades (androidpolice.com)
jbernardo writes: Google is using the boiling frog method to exclude power users and custom ROMs from android. A new feature in Android 8.0 Oreo, called "Rollback Protection" and included in the "Verified Boot" changes, will prevent a device from booting should it be rolled back to an earlier firmware. The detailed information is here. As it rejects an image if its "rollback index" is inferior than the one in "tamper evident storage," any attempts to install a previous version of the official, signed ROM will make the device unbootable. Much like iOS (without the rollback grace period) or the extinct Lumias. It is explained in the recommended boot workflow and notes below, together with some other "smart" ideas.
Now, this might seem like a good idea at first, but let's just just imagine this on a PC. It would mean no easy rollback from windows 10 to 7 after a forced installation, and doing that or installing linux would mean a unreasonably complex bootloader unlocking, with all your data wiped. Add safetynet to the mix, and you would also be blocked from watching Netflix or accessing your banking sites if you dared to install linux or rollback windows. To add insult to injury, unlocked devices will stop booting for at least 10 seconds to show some paternalist message on how unlocking is bad for your health: "If the device has a screen and buttons (for example if it's a phone) the warning is to be shown for at least 10 seconds before the boot process continues." Now, and knowing that most if not all android bootloaders have vulnerabilities/backdoors, how can this be defended, even with the "security/think of the children" approach? This has no advantages other than making it hard for users to install ROMs or to revert to a previous official ROM to restore missing functionality.
Now, this might seem like a good idea at first, but let's just just imagine this on a PC. It would mean no easy rollback from windows 10 to 7 after a forced installation, and doing that or installing linux would mean a unreasonably complex bootloader unlocking, with all your data wiped. Add safetynet to the mix, and you would also be blocked from watching Netflix or accessing your banking sites if you dared to install linux or rollback windows. To add insult to injury, unlocked devices will stop booting for at least 10 seconds to show some paternalist message on how unlocking is bad for your health: "If the device has a screen and buttons (for example if it's a phone) the warning is to be shown for at least 10 seconds before the boot process continues." Now, and knowing that most if not all android bootloaders have vulnerabilities/backdoors, how can this be defended, even with the "security/think of the children" approach? This has no advantages other than making it hard for users to install ROMs or to revert to a previous official ROM to restore missing functionality.
No really guys, just look at our motto!
Care to inform me why the fuck me, or anyone who has at least parts of his mental health remaining, would want to buy such a device?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Welp, looks like I'm never buying a new Android phone. This is going to be secure boot Google edition, with the bricked systems and all.
that google is pretty much killing itself.
All the recent news about google are just scandals, this is good stuff, im glad to be here to see the start of the end for it.
On a PC if you are going to 'roll back' the best thing to do it start from a clean hard disk. The only reason to this is if there are problems, in which case the safetest thing to do is to wipe the machine.
Does the Android phone have forced installation, if so then Antoine buying it is an idiot. If not, then why bring it up.
And as always data is only lost if you don't back it up. Now, on upgrade data can also be migrated so you may not be able to use it one an old system, but again, if this is not a forced upgrade, why didnt you back up data.
What is this, the day /. lets the children run the front page so they can whine about the fact the candy store charges momey?
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Fuck Google.
Fuck Google.
Fuck Google.
I don't want *my* device stolen, downgraded, then rooted. I want it secure.
I buy devices that can be OEM unlocked and rooted though, (currently the Pixel XL) in case I want a custom ROM or root.
As long as I can buy a device capable of being OEM unlocked and/or rooted I don't see the problem. If you have an issue with rev XYZ of a ROM you can always install a derivative with a fix from XDA, or a straight up copy of a prior version with a different name/version, just not a *signed* copy of a prior version.
tldr; All this does is prevent thieves from backtracking to an exploitable ROM. If you have authorized access you can still OEM unlock and do whatever you want.
Just because you disagree doesn't mean it's not true.
Going with an iPhone. At least Apple is the devil we know.
http://www.nouveaugallery.com/...
One potential flaw in this mechanism: I think a malware image can prevent rolling back to a known-good image by setting the rollback indexes to ridiculously high value, say 2147483647 (2**31-1).
This diagram shows how the workflow is supposed to proceed. If Mallory gets her verification key onto your device (either by social engineering or another flaw), then her custom malware image can be booted by the device in locked mode. The user will get a warning about this being a custom OS (good!), but then the rollback index values in Mallory's image are written to the stored rollback index values (bad!). If I then attempt to go back to Oreo 8.0, it won't let me.
A better mechanism would be to have a set of stored rollback index values per verification key, not a global set per device. Then I could roll back to the stock factory image from a Mallory's malware image.
This has no advantages other than making it hard for users to install ROMs or to revert to a previous official ROM to restore missing functionality.
No advantages - except enforcing security, whether you want it or not. And the story link provided even says Rollback Protection can be disabled.
Now you may not want it - you may think you're smart enough to not need it - but let's not pretend there's no reason for this.
The summary's proffered example of "no easy rollback from windows 10 to 7" is technically true, but overstating things quite a bit for dramatic purposes. More relevant analogs would be "no easy removal of Windows security patches you've previously applied" and "no easy rollback from your current Linux kernel to the previous one which contained a remote root exploit".
#DeleteChrome
More evil from google
If you're buying an Android device used, you want to know whether the previous owner hasn't installed malware that persists across an apparent factory reset. Popping up a "This device runs a custom operating system" notice while the bootloader is loading the kernel is an unobtrusive way of doing this.
If you're buying an Android device, and you watch movies, you want a wide selection of movies. Google can do one of two things. It can keep its license from major movie and television studios to offer their works through Google Play by continuing to improve the digital restrictions management that deters copying a rented stream. Or it can lose its license and pull the works from Google Play, and end users will end up having to buy an iPod touch, iPhone, or iPad in order to continue to watch notable movies and television series once the licensed apps become iOS-exclusive.
any attempts to install a previous version of the official, signed ROM will make the device unbootable. Much like iOS (without the rollback grace period) or the extinct Lumias.
Pretty sure it was possible to downgrade Lumias with Windows Device Recovery Tool.
What ClickBait, This has nothing to do with customROMs.
"RollBack Protection", prevents the device from booting from an earlier major version of Android. So as to prevent would-be thieves from easily wiping the device and obviating Android Oreo's security mechanisms.
Android 8.0 Oreo Review
Downgrade attacks were a problem with old Sambas, so it's a real concern. Google just did the mitigation badly.
Hanlon's razor: "Never attribute to malice that which is adequately explained by stupidity"
davecb@spamcop.net
Subject.
How many of us have purchased random hardware when there were vendors out there working to improve things either because it was cheaper or because we needed it immediately/otherwise too impatient!! Hardware doesn't magically just work with Linux. There are people and companies that have to do the work or convince the right chipset vendors to release code or even do the work for them. The reality is if we want phones that are in the users and community's control we got to purchase from vendors and companies working to give us that control regardless of what they offer. They'll never get to a point where they have something we want if we don't support them now (even when they don't have what we want exactly). The Linux market is huge, but only a tiny fraction which is maybe 3% are buying Linux hardware from companies that are working on getting the complete set of code released for their devices. Check out ThinkPenguin.com or MiniFree.org as both companies are working on getting code released and/or engineering (well ThinkPenguin is, they have or are working on EOMA68 for engineering, release of ath9k-htc source so we can have properly supported USB wifi chipsets to build adapters off, or at least get adapters that work (they sell em too), they fund LibreCMC and sell wifi routers, etc) or otherwise contributing something of value (ie the person behind Mini Free has contributed to LibreBoot).
What comes after EOMA68 is potentially a modular communications device designed from the ground up to evade or reduce the resolution of tracking (all cellular devices depend on being tracked to receive or make calls) and separate cellular modem components from the rest of the phone such that encryption can actually work against malicious adversaries (ie cellular modem firmware will never be releasable and communications carriers / government have remote control of firmware updates and can and have used this to spy on the rest of the device, so any encryption on a phone currently is futile, separating the modem and providing power on/off control of it to the main CPU can solve or reduce this problem to one degree or another).
For any device that is sold with the feature, you're knowingly purchasing a device that performs this check. That means you don't care enough to check, don't mind it, or want the feature.
Or you have checked, the result being that all devices available to the public include the feature, and you begrudgingly accept the feature. This, for example, is true of the "Windows 10 preinstalled, no other OSes warranted" feature of every non-Apple laptop PC shown in a U.S. retail chain's showrooms. Technically, one might argue that this falls under "don't mind it" but I felt that this sort of Hobson's choice was worth mentoining.
Latest major OS bricks your device and that is that.
As is made clear further down, the rollback index does not prevent custom ROMs, old versions, or anything else from being installed IF the device's bootloader is unlocked - as has always been the case when installing custom ROMs.
All it does is prevent locked devices from being downgraded (to a presumably less-secure version that could be exploited). Locked devices are locked for security, so this is entirely expected behaviour. If you would rather take control and manage your own security, you can unlock the bootloader at any time (at least on Google's own devices; YMMV with other vendors). Then you can install anything you want.
Why would anyone engrave "Elbereth"?
You mean after the major movie and television studios see a mysterious 80-90% drop in revenue
How so? Last I checked, revenue from paid apps and IAPs per user is nine times as large on iOS compared to Android. This gap is so big that it more than offsets Android's larger user base.
Or Google can ask the providers why Windows gets a pass.
Probably because it's easier to upgrade a random PC to the latest build of Windows 10 than to upgrade a random phone to the latest build of Android. This allows app developers to exclusively target a new feature update (such as Anniversary, Creators, or Fall Creators) where known holes in Protected Media Path and other digital restrictions management technologies in Windows 10 have been plugged.
And no, Windows doesn't necessarily get a pass. No app (legally) plays UHD Blu-ray movies on Windows on a PC with a CPU older than Kaby Lake or an operating system other than Windows 10. You may also need to replace your motherboard with one that supports Intel SGX and your video card with one that supports AACS 2.0 and HDCP 2.2. (Source) Movie studios have put similar requirements on 4K streaming. (Source)
Are you desperately in need of a hacker in any area of your life???
I will help you at affordable prices, i offer services like
-hack into your cheating partner's phone(whatsapp,bbm.gmail,icloud,facebook and others)
-Sales of Blank ATM cards.
-hack into email accounts and trace email location -all social media accounts,
-school database to clear or change grades,
-Retrieval of lost file/documents
-DUIs -company records and systems,
-Bank accounts,Paypal accounts -Credit cards hacker
-Credit score hack -Monitor any phone and email address
-Websites hacking, pentesting.
-IP addresses and people tracking.
-Hacking courses and classes.
my services are the best on the market and 100% security and discreet work is guaranteed. Email: northpolehackers@gmail.com
You get to choose. Either get an easily unlockable device like Pixel or OnePlus and install whatever ROM you want. Fine, 10 second boot delay, but how often do you boot a phone? Or, you just don't worry about it and just be safe. Then you don't want someone to downgrade your phone to an OS version that can be targeted with various exploits. If you change your mind, you can still unlock the bootloader after verifying some information with your vendor or wireless provider to make sure it's really you. What do you honestly think is better for an average non-technical user who has some pretty private information on that phone?
As it rejects an image if its "rollback index" is inferior than the one in "tamper evident storage," any attempts to install a previous version of the official, signed ROM will make the device unbootable. Much like iOS (without the rollback grace period) or the extinct Lumias.
That's not how the iOS downgrade grace period works at all. The installation blobs of iOS are code signed with expiring keys and the expiry dates are (generally) set to 2 weeks after the next iOS release.
This means you can at least trick iTunes/iOS into downgrading after the expiry period so long as you've kept the downloaded blobs and use tools like Prometheus... but Google's basically shut the door on its Android users.
do not use google products, please always look for an alternative.
google is evil (https://abc.xyz)
https://vimeo.com/203355957
https://www.amazon.com/They-Live-Trailer/dp/B00H2TCK7S
If the next version of the OS is found to have a massive security bug after you install it, with no work-around in sight, the logical temp fix is to roll back to the prior version. Or if the new version blocks "Install other OS" or some other useful feature without prior warning, you might choose to reverse the install.
I agree: asking the user if they're OK with the change is better, and re-asking on boot when someone's selected a know hacked version is a minimally adequate way to confirm it was the user who said OK and not some virus.
davecb@spamcop.net
Ohhh. You mean like this https://m.slashdot.org/story/3...
Hanlon's Razor:
It means that the willfully malicious get a free pass by acting stupid or claiming stupidity, and teaches people the same. It's a hair away from victim shaming, where someone feels/knows that someone has done wrong but they're told,"Oh, it's ok that person is just stupid." What utter nonsense!
I'm tired of Hanlon's Razor. It's totally bankrupt.
-
Whereas to me it says "most things can be fixed, without needing to murder the person who caused it" (;-))
In the specific case of Google, they repeat one particular stupid mistake every time they start something new: they assume that they've covered all the ways it can go wrong, and therefore don't need a customer support mechanism. This is a minor variation on that bit of arrogance.
davecb@spamcop.net
this might seem like a good idea at first
No. No, it doesn't.
I have a device at home that puts it on a large screen for me to sit on this thing called a "couch" and watch.
A lot of such devices run Android OS. If Android loses movies, these users will switch to Apple TV.
The "need" to have a way to watch mobile-accessible versions of shows/movies/etc is scary. I also say this because I work at a place where productivity falls in departments under the top-level one (top-level department, that is) because people watch movies and shows at work.
For those not afflicted in the way you go on to describe at length, it's not about watching movies and TV shows at work as much as watching them on the bus or train ride to and from work. Or is it considered suspicious for an employee to get to and from work in any way other than a personal automobile?
Unlock the bootloader and this is bypassed.
Will the new system allow the user to choose if they want their data stolen by google or even Windows? Why is everyone not calling the representatives to call for a privacy law that would put an end to the data raping of users by companies?
Its not arrogance, its a closed world assumption