Security Researcher Publishes How-To Guide To Crack Android Full Disk Encryption (thehackernews.com) 84
An anonymous reader writes: Google first implemented Full Disk Encryption in Android by default with Android 5.0 Lollipop in an effort to prevent criminals or government agencies from gaining unauthorized access to one's data. What it does is it encodes all the data on a user's Android device before it's ever written to disk using a user's authentication code. Once it is encrypted, it can only be decrypted if the user enters his/her password. However, security researcher Gal Beniamini has discovered issues with the full disk encryption. He published a step-by-step guide on how one can break down the encryption protections on Android devices powered by Qualcomm Snapdragon processors. The source of the exploit is posted on GitHub. Android's disk encryption on devices with Qualcomm chips is based only on your password. However, Android uses your password to create a 2048-bit RSA key (KeyMaster) derived from it instead. Qualcomm specifically runs in the Snapdragon TrustZone to protect critical functions like encryption and biometric scanning, but Beniamini discovered that it's possible to exploit a security flaw and retrieve the keys from TrustZone. Qualcomm runs a small kernel in TrustZone to offer a Trusted Execution Environment known as Qualcomm Secure Execution Environment (QSEE), which allows small apps to run inside of QSEE away from the main Android OS. Beniamini has detailed a way for attackers to exploit an Android kernel security flaw to load their own QSEE app inside this secure environment, thereby exploiting privilege escalation flaw and hijacking of the complete QSEE space, including the keys generated for full disk encryption. The researcher also said Qualcomm or OEMs can comply with government or law enforcement agencies to break the FDE: "Since the key is available to TrustZone, Qualcomm and OEMs [Original Equipment Manufacturers] could simply create and sign a TrustZone image which extracts the KeyMaster keys and flash it to the target device," Beniamini wrote. "This would allow law enforcement to easily brute force the FDE password off the device using the leaked keys."
Unlocked access still required (Score:5, Informative)
From reading TFA, I conclude that you still need unlocked access to the phone? so if somebody gets hold of your turned off phone, they can't use it.
Re: (Score:3)
Yep, it's an attack on a running system. The encryption key is derived from your password and stored in secure memory for use. If someone can get hold of your unlocked device they can potentially access that memory.
Similar to attacks on encryption on running PCs etc, only harder because PCs don't usually have secure memory to hold the key in.
The solution is horribly obvious (Score:1)
Re: (Score:2)
"Trusted" stuff cannot be trusted. It's called "trusted" because its maker trusts it to keep you from doing anything its maker didn't intend you to.
Why the fuck should I trust something like that?
Re: (Score:2)
That's a nice, specific little clarification of the larger life rule: never trust anyone who says "trust me".
Re:The solution is horribly obvious (Score:5, Informative)
"Trusted" stuff cannot be trusted. It's called "trusted" because its maker trusts it to keep you from doing anything its maker didn't intend you to.
No, the only thing that makes it "trusted" is that it's small, and isolated. Those characteristics reduce its attack surface and reduce the number of bugs it has, on average.
I'll grant that the primary purpose of TrustZone in Android devices, historically, has been DRM, which is absolutely something the maker doesn't want you to muck with. That's not the case with Keymaster. If you want to know what it does, there's a full open source reference implementation in AOSP. That's not the implementation used in Qualcomm devices; they wrote their own and it's closed -- but it does as close to the same thing as what the reference implementation does as the engineers involved could make it. Some other devices do use the code from AOSP.
Re: (Score:3)
No, the only thing that makes it "trusted" is that it's small, and isolated. Those characteristics reduce its attack surface and reduce the number of bugs it has, on average.
No, what makes it "trusted" is that ARM and/or the chip vendor repeatedly tell you it is in press releases. There have been several attacks on TrustZone devices which take advantage of the fact that it's often very poorly implemented, and much less secure than the non-TrustZone stuff. The classic example of this was the rooting of a Motorola phone which hacked the insecure TrustZone, then attacked the secure non-TrustZone stuff from inside the "trusted" environment. It was the presence of TrustZone that
Re: (Score:2)
No, what makes it "trusted" is that ARM and/or the chip vendor repeatedly tell you it is in press releases. There have been several attacks on TrustZone devices which take advantage of the fact that it's often very poorly implemented, and much less secure than the non-TrustZone stuff.
Utter nonsense. Go take a look at the CVE reports of vulnerabilities in the Linux kernel, and compare them to the CVE reports of TrustZone OS vulnerabilities. The kernel is two orders of magnitude worse. That's not because it's bad, or TZ code is good... I'll readily concede that kernel code is almost certainly higher in quality than closed-source TZ OSes. But it's also vastly larger and more complex, with so much more attack surface.
Re: (Score:2)
I prefer to be able to determine myself what I consider bad things and good things. History is rife with examples how allowing other entities, especially such you have no control over whatsoever, define what "good" and what "bad" is leads to them defining them in a way you would not agree with and clashes with your interests.
Because, by definition, these entities will define it in such a way that it benefits them. If your interests are the same, you're lucky, but relying on it is stupid.
Re: (Score:1)
You shouldn't. In this case "trusted" means that the processor/ram/rom/code can be trusted to not be altered by YOU. Only the corporations that paid the cpu manufacturer for access to it can 'trust' it...
Re: (Score:2)
Don't use TrustZone; store the stuff as a proper LUKS volume and stop using "trusted" proprietary crap
TrustZone isn't proprietary; it's part of the standard ARM feature set. In many cases (not all[*]) the software running in it is. As for using an LUKS volume, the problem with that is that it's no more secure than the Linux kernel, which is popped by another security researcher every week. The kernel is so large and complex that hardening it is really difficult.
Can we just admit already that having supervisory-processor-within-a-processor stuff is inherently insecure?
No, because it's not.
The purpose of having TrustZone isn't that it's inherently more secure. It's still just software, and subject to all of the s
Re: (Score:2)
There is an important distinction though. If I do not control the code running in that processor (or trust zone), it *IS* inherently insecure for me. If I do control it, it may improve security or it might be neutral WRT security.
Re: (Score:2)
There is an important distinction though. If I do not control the code running in that processor (or trust zone), it *IS* inherently insecure for me. If I do control it, it may improve security or it might be neutral WRT security.
There's lots of code that you do not control running in every computing device you use. If you insist on that exceedingly strict definition, you should just avoid them entirely. Also, your assertion that if you do control it it's either neutral or positive is patently false. It is entirely possible to exercise control in ways that decrease your security. It's pretty common, for example, for people who root their Android devices to believe that they're improving their device security by taking control over i
Re: (Score:2)
There's not actually a lot on the machines I am using. That doesn't mean that I have written or even audited every line myself, just that it is open for me to do so.
Of course, in embedded devices the code is less open for my audit or modification, but those devices also don't have much exposure to my personal data.
Re: (Score:2)
Re: (Score:2)
There was even less when I was working on coreboot.
Keep in mind, the BIOS is a nasty pile of hair but it IS open to audit.
The ME, OTOH loads an encrypted and signed blob.
Re: (Score:2)
Just to be clear, I don't like or support the presence of opaque binaries in systems. One of the things I'm trying to achieve in the Android ecosystem is to move OEMs to using open source code in TrustZone. There is tremendous security value in having a trusted execution environment which is small and isolated, because making full consumer OSes secure is simply impossible, but having the code in that TEE be closed doesn't add anything to the security proposition, and arguably reduces it. That's why Google h
Re: (Score:2)
In a cellphone, the radio is the worst of the bunch. It has the ability to snoop on the main CPU and controls the boot process. that's why rooting many Android phones involves re-flashing the radio. An actual free and open radio probably isn't permitted by the FCC and other nation's equivalents around the world, but I would like to see it demoted to just another component with a narrow interface to the main system. Preferably it would require the cpu to feed it digitized audio rather than having a direct co
Re: (Score:2)
In a cellphone, the radio is the worst of the bunch. It has the ability to snoop on the main CPU and controls the boot process.
I've heard that said by many people, but as far as I can tell by examining the architecture of the devices I've worked on, it's not true. The baseband radio does have DMA access, like most every peripheral, but it doesn't have any special sort of access to the CPU.
Re: (Score:2)
If there isn't an IOMMU, DMA access is enough to overwrite any code in the system, and so control the CPU.
Re: (Score:2)
Re: (Score:2)
I should be more specific, an IOMMU exclusively controlled by the CPU. In this case, the secure side necessarily controls it (or it wouldn't be secure), not the user side. This makes the user side at the secure side's mercy. A narrow interface would leave the radio secure, but would also make the user side secure from the radio.
Re: (Score:2)
I should be more specific, an IOMMU exclusively controlled by the CPU. In this case, the secure side necessarily controls it (or it wouldn't be secure), not the user side. This makes the user side at the secure side's mercy. A narrow interface would leave the radio secure, but would also make the user side secure from the radio.
The IOMMU is controlled by the CPU, by which I mean the AP (application processor). The non-secure mode software (EL0 and EL1) controls most of its configuration, including allocating DMA pages for the baseband, though it can't override the configuration provided by the secure mode (EL3). That's my understanding, anyway. Most of my work is at a slightly higher level.
Re: (Score:2)
The difference may just be the phones we're dealing with. Do the ones you've worked with/on do locked bootloader/network? The ones I've seen do, and use the processor in the radio to lock it down. It may be the ones you know of simply don't do that. It could also be a matter of the generation of phone. My knowledge is a couple years out of date at this point.
There is still the question of the radio though. Does it have independent access to the microphone or does it depend on the AP for that? can it access
Re: (Score:2)
IIRC, CyanogenMod doesn't touch TZ... it just uses dm-crypt, prompts for the passphrase that unlocks the /data volume key, then goes from there.
Re: (Score:2)
CyanogenMod still uses TZ/QSEE on phones where that is used in the original firmware.
However, that never reduces security, only increases it. If your passphrase is long enough not to be at risk of a bruteforce, then this attack does not affect you.
Re: (Score:2)
The problem is not "trusting" the proprietary crap, the problem is trusting it to improve security in any measurable way.
Android full disk encryption is just as secure as LUKS (in fact, under the hood it's dm-crypt just like LUKS, the key derivation is just different). This doesn't break the FDE. You still need the passphrase. What this does is break the "you need the hardware to access the FDE and we're going to impose additional non-provable restrictions such that you can keep using your 4-digit PIN and i
This fella shopuld get a lawyer... (Score:2)
He published a step-by-step guide on how one can break down the encryption protections on Android devices powered by Qualcomm Snapdragon processors.
I do not think Qualcomm or Google will be impressed.
My advice to him: "Get a lawyer, quick!"
And this is why DRM is bad... mmmkay? (Score:2)
Not feasible against a good password. (Score:5, Interesting)
Re: (Score:2)
Additionally, they need to get to your phone in an unlocked state. As soon as you power off or reboot the key is lost.
Re: Not feasible against a good password. (Score:2)
Just MMS them a malformed mp4.
Re: (Score:2)
If you are including old, long patched vulnerabilities then why not just steal the encrypted information directly from the victim's phone? Encryption doesn't mitigate that threat on any system, that's not what it's for.
Encrypted protects you from law enforcement and theft.
Re: Not feasible against a good password. (Score:2)
not to point out the obvious, but no one is going to use a giant password they have to put in via the tiny little keyboard on the phone everytime they want to use it.
Great from a security standpoint, not so much from a convenience one.
Re: (Score:1)
That assumes you can get the user's device from them without their knowledge. Such an attack is feasible on desktops, and many laptops, but phones are the one electronic device even layman carry with them EVERYWHERE. When was the last time your phone was out of your immediate sight and direct control?
Re: (Score:2)
When was the last time your phone was out of your immediate sight and direct control?
5-8 hours per night. plus the odd nap. plus when i leave it in the locker at the pool or gym. There are some other times too... like swimming at the beach.
That assumes you can get the user's device from them without their knowledge.
Just steal it from them when they are out and about. Sure they'll know its gone missing. So what? You want what's on it, it doesn't always matter if they know or not -- and most of us aren't paranoid enough to assume it was the men in black helicopters and not just some random theif. Phones get stolen ALL THE TIME.
Hell, you can even plant something on it,
Re:Easier ways (Score:5, Interesting)
Hell, you can even plant something on it, and then return it to them... turn it into the carrier or lost and found or the police or something; odds are they'll be so happy/surprised that it turned up again they won't even think that it was hacked.
Planting something on it isn't so easy if it's locked. But, really, you don't have to do that. Want to get into someone's phone? Here's how:
Buy an identical device. Get a good look at theirs so you can put similar scratches, cover, lockscreen background, etc. on it. Configure your device to send the password they enter to you. Steal theirs and leave yours in its place. When they enter your password, you get it and use it to get into their device. To keep it from being obvious that their device has been replaced, have it refuse to "unlock" no matter what they enter. This also helps you in the event they get their password wrong the first time, because they'll helpfully re-enter it. Meanwhile, they'll think their password on their phone has gotten messed up.
This works on *any* model... Android, iPhone, Windows phone, Blackberry... you name it.
Re: (Score:1)
and most of us aren't paranoid enough to assume it was the men in black helicopters and not just some random theif.
The point is that the people who do have something to hide are apt to be that paranoid, so this attack vector isn't as useful as it might seem. Then again, I suppose that many criminals are idiots, and I could see some of them being stupid enough to enter a passphrase even if the device was handed back to them by the detective running their case. Hell, they'd probably unlock it on their way out of the station to text their buddies about how they beat the system. That's pretty low hanging fruit though.
Pe
Re: (Score:2)
Why not just uncompressed the initramfs, load a binary or other tool to siphon off the users pw on key entry?
The kernel is unencrypted as the system needs to boot from it
If you modify the boot image on a Marshmallow device, the screen will notify the user during boot that verification failed. On a Nougat device I believe it will refuse to boot.
Already patched (Score:2)
For devices that get regular updates the Qualcomm TrustZone bug has already been fixed. It went out in the January 2016 updates: https://source.android.com/sec... [android.com]. Check the patchlevel date on your device.
Of course the other part, that someone who can compel Qualcomm to sign TrustZone software images that intentionally compromise security, is still the case, and likely will be for some time. That's a threat model that hadn't been considered important until recently, and it's one that's not easy to mitigat
Re: (Score:2)
For devices that get regular updates the Qualcomm TrustZone bug has already been fixed. It went out in the January 2016 updates: https://source.android.com/sec... [android.com]. Check the patchlevel date on your device.
Of course the other part, that someone who can compel Qualcomm to sign TrustZone software images that intentionally compromise security, is still the case, and likely will be for some time. That's a threat model that hadn't been considered important until recently, and it's one that's not easy to mitigate. That's not restricted to Qualcomm, either. In every device with a trusted execution environment, there's some organization who holds the signing keys needed to load firmware in that environment, generally (but not always) the SoC vendor.
Can't this hole be closed by designing the trusted firmware so it requires that the passcode be entered before it will accept a firmware update?
Re: (Score:2)
Can't this hole be closed by designing the trusted firmware so it requires that the passcode be entered before it will accept a firmware update?
Yes, but it's tricky, particularly because it's not that hard to open the device and write an updated firmware blob to flash directly, bypassing any software-based gatekeeping checks. There are ways to address that, but they raise subtle issues in turn, and ways to address those, but they raise more issues. At root, the existence of Replay Protected Memory Blocks in eMMC controllers makes it feasible to have small amounts of non-volatile storage that an attacker probably can't write to, which I believe make
Re: (Score:1)
Re: (Score:2)
Oh yeah Grandma: "check the patchlevel of your device".
Well, the right answer is to buy a device that has a published support policy that includes monthly security patches. Then you don't have to check the patchlevel (which actually isn't tough, even for Grandma: It's just a date and she's perfectly capable of understanding it), because you know it's good. Maybe someday consumers will demand that of all Android devices. At present, they don't, and manufacturers give them what they want.
Re: (Score:1, Offtopic)
Re: (Score:2)
Oh yeah grandma: "buy a device that has a published support policy". Christ. No wonder Apple is selling so many iPhones.
Well, she knows to look at the warranty when she buys a car.
Re: (Score:2)
Well, she knows to look at the warranty when she buys a car.
Does she? And if she does, will she? Or will she just ask them a couple of questions about it like how long is it and what does it cover, and then move on? Legal contracts are difficult for anyone to understand, is your grandmother a lawyer?
To be fair, Apple's legalese is plenty long.
Re: Already patched (Score:1)
No, it's not JUST buy a device with a patch policy you trust, it is buy a device from a vendor you trust, with a patch policy you trust, and also go and do a bunch of research into the vendors to figure out which ones you can trust, and way MORE research to figure out the patch policy you can trust.
Or just buy and iPhone and skip the degree in this field that you don't have any interest in.
Re: (Score:2)
Alternatively, don't store sensitive information on your phone.
Re: (Score:1)
This just in... (Score:1)
Re: (Score:2)
Not NULL encryption.
It may not be so bad afterall... (Score:2)
The original Android implementation of dm-crypt generates a -random- key in Android 5.0, which is the key used for encryption. It then encrypts that key with the user's passphrase/PIN/whatever. This implementation is pretty secure, because other than active RAM attacks, when the phone starts up, it will ask for the decryption key for /data, and no key, no decryption.
From what I have looked at with CyanogenMod, this ROM uses the "old fashioned way". No TrustZone, no fancy footwork with keys... just a rela
Re: (Score:2)
"CyanogenMod (...) uses the "old fashioned way". No TrustZone, no fancy footwork with keys... just a relatively simple prompt for the passphrase at the phone startup so /data can be mounted and used."
I'm using CM13 (Android 6/Marshmallow), which uses FDE, yet can boot without password prompt, just like stock Android 6. It will present the lock screen though. Leaving aside the security of a booted and connected phone with only the lock screen as a protection, the only way to do this seems to be to use some k
Make the manufacturer key replaceable (Score:1)
Backdoors are always bad (Score:2)
>" The researcher also said Qualcomm or OEMs can comply with government or law enforcement agencies to break the FDE: "Since the key is available to TrustZone, Qualcomm and OEMs could simply create and sign a TrustZone image which extracts the KeyMaster keys and flash it to the target device," Beniamini wrote. "This would allow law enforcement to easily brute force the FDE password off the device using the leaked keys." "
Which also means ANYONE it was leaked to can do the same thing- criminals, spies, ma
Surprised (Score:2)
this was made public knowledge before the FBI could classify it as a National Security secret.
Explain something to me. (Score:2)
From the article in The Hacker News, "Once getting hold of this key, an attacker could perform a brute-force attack to grab the user password, PIN or lock, cracking Android's full disk encryption."
Why not just get the user password by brute force attack to begin with since it will unlock the encrypted files for you? I know I'm missing something. If you go through this process only to wind up having to mount a brute force attack, what is gained?
Re: (Score:2)
Why not just get the user password by brute force attack to begin with since it will unlock the encrypted files for you?
Because the user's password won't let you unlock the encrypted files, at least not on its own. The password works in conjunction with a much stronger key randomly generated by the device itself. To decrypt the files you need both the device key and the user's password. The key is normally only available to software running inside the TrustZone, which limits the number and frequency of authentication attempts. This exploit allows an attacker to retrieve the device-specific key from the TrustZone, but they st