Timeline for Does a working JTAG diagnostics port on Android phone add unnecessary risk?
Current License: CC BY-SA 3.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 16, 2020 at 9:49 | history | edited | CommunityBot |
Commonmark migration
|
|
| Oct 7, 2012 at 5:55 | comment | added | David Wachtfogel | @tylerl I don't agree with the statement that it's impossible to "protect a device that is in the attacker's physical possession." It's extremely difficult and expensive - but not impossible. Any FIPS 140-2 security level 4 device is supposed to be secure even if it's in the attacker's physical possession for a substantial amount of time (this includes many HSMs). A good example is the PS3, which was in the attacker's hands for four years before its DRM was hacked (see events.ccc.de/congress/2010/Fahrplan/attachments/…). | |
| Oct 7, 2012 at 0:09 | comment | added | Polynomial | @MarkMullin You're missing an important caveat of the rule - a safe is not designed to prevent any form of access. If you have the tools and the time, you can always break into a safe. The goal of the safe is to make it time consuming and infeasible to break into it without being caught in the act. If you have unrestricted access to the safe, e.g. if you can put the safe in a 600 tonne machine press, it is just as pwned as an Android device that you hand to a bad guy. The JTAG issue is the same thing - given unrestricted access you're pwned no matter what. | |
| Oct 6, 2012 at 18:35 | comment | added | tylerl | @MarkMullin While I fully understand your point, I don't think you're going to get anyone here to agree with you. | |
| Oct 6, 2012 at 15:36 | comment | added | Mark Mullin | @polynomial - true, but that law is a simplistic overgeneralization - consider bank vaults - they come in many flavors, and the ones used by the New York Fed are considerably more sophisticated than the one used in a small town - you have to address the fact that IFF the bad guys get a hold of something, how much does it cost them to get in and try and ensure cost beats exploit value- otherwise the argument would be that there is no point in security beyond physical security (strictly limited to the context of this discussion) My concern here is focused on the cost & record of comprimise | |
| Oct 6, 2012 at 13:23 | comment | added | Polynomial | But that's precisely the point that this answer covers. It's Immutable Law of Security #3 - if the bad guys get physical access to your device, it is no longer your device. | |
| Oct 6, 2012 at 13:05 | comment | added | Mark Mullin | @Polynomial I grant the value of JTAG - my concern is exactly what you point out - the ease of unlocking and reconfiguring it - my concern is for impacts on security in business applications - ypu've hit the point thats bothering me right on the head | |
| Oct 6, 2012 at 9:44 | comment | added | Polynomial | As an example, the phone unlocking shop that I used to work in could do a baseband flash on a Motorola Razr v3 in about an hour, or a Blackberry Bold in about 20 minutes. JTAG made all the difference - less than half of those 20 minutes were spent actually hooking up the phone to the JTAG testpoint, the rest was just the firmware upload and reboot. On the old Razr V3 it took ages to strip the phone down to just the board, and hook it all up. Plus we'd frequently have problems with cracked plastic and other damage during the process. | |
| Oct 6, 2012 at 9:40 | comment | added | Polynomial | Never underestimate the reduction of support costs that a JTAG port brings. On old phones, a reflash of the baseband firmware required test points to be connected, which were essentially tiny SMT pads on the phone board. This meant that the entire phone had to be dismantled, and a special set of connectors had to be attached (and usually held in place by hand). Also keep in mind that each manufacturer's testpoint was a custom piece of hardware that hooked up to a PC's serial port, or USB if you were lucky. As such, they cost thousands to buy. Factor in added manual work... very costly. | |
| Oct 6, 2012 at 2:34 | comment | added | Mark Mullin | Granted - some blackberries have exactly that after a fashion - pull the cover off, memory gets zero'd - and I'm fine with that - beating that raises the penetration cost back to a reasonable level - this is not an issue of how horrible, it's a question about cost and risk | |
| Oct 6, 2012 at 2:10 | comment | added | Fiasco Labs | Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. And if it doesn't have an automatic self-destruct on opening the case, you can prod it in any number of ways to get it to spill information. | |
| Oct 6, 2012 at 0:56 | comment | added | Mark Mullin | @ewanm89 - I'm well aware of that - but a lot of security involves the balance of information value against attacker workload - my issue here is that the JTAG port removes most of the workload on the attacker - thats what I don't like, not the fact the device can be comprimised | |
| Oct 6, 2012 at 0:52 | comment | added | Mark Mullin | @tylerl as far as device repair - other than screen replacement I'm not aware of much of that happening - and encryption is only a guarantee in this case if all data is truly encrypted/decrypted on each access from an externally entered key - last I checked ARM chips are going to be a bit challenged if I use decent encryption against several gigs each time i log in or out - i wont argue wear leveling analysis, cause that is back in the domain of the rarer black hats and a risk one just has to deal with | |
| Oct 6, 2012 at 0:48 | comment | added | Mark Mullin | @tylerl True -the lack of physical security is no security at all - the issue is the cost of the comprimise - if it requires a chip off attack, then the cost is much higher than this - a relatively inexperienced individual can comprimise a device through a JTAG port without being able to remove a BGA chip with a heat gun, have any kind of ICE equipment, etc - I'm not concerned with the possibility, it's the ridiculously low barrier to entry that bothers me | |
| Oct 6, 2012 at 0:42 | history | edited | tylerl | CC BY-SA 3.0 |
added 575 characters in body
|
| Oct 6, 2012 at 0:27 | comment | added | ewanm89 | @MarkMullin Number 3: technet.microsoft.com/en-us/library/hh278941.aspx | |
| Oct 6, 2012 at 0:17 | comment | added | tylerl | @MarkMullin You cannot protect a device that is in the attacker's physical possession. That's the beginning and end of it. If you want to keep your data safe, the only way (only way) is to encrypt it. If cutting the JTAG traces gives you a warm fuzzy, then go ahead and do that. But it will not give you the security you care about. | |
| Oct 5, 2012 at 23:46 | comment | added | Mark Mullin | I agree - but this makes your phone as easily breachable by someone else as it makes it by you - I like the idea of being able to buy a phone with working jtag, i do not like the idea of companies making their byod plans radically insecure by not even knowing this risk is present - it's basically reducing the cost of an attack by an unreasonable level | |
| Oct 5, 2012 at 23:34 | history | answered | tylerl | CC BY-SA 3.0 |
