7

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it.

I can't understand why fundamentally disposable mass market consumer devices need a working test instrumentation port when they are released to the average consumer; In my opinion this is a significant security vulnerability across the entire Android ecosystem.

--- Added This is not an issue of whether or not the device is secure - it is an issue of whether or not the presence of a functional JTAG interface significantly alters the cost/reward equation for lower value data for a less experienced attacker. Evaluating security risk involves evaluating the costs and risks of compromising a system - there is no system that is completely secure against anything, and a system that is secure against nothing is worth nothing (in this context) (e.g. your phone broadcasts its memory over open wireless all the time) - my concern is that a working JTAG port on a device with 'interesting' data on it is signficantly weaker than one without such a port and therefore the cost/reward equation is significantly changed

--- Added Citation Editor’s note: JTAG is a well-known standard mechanism for in-field test. Although it provides high controllability and observability, it also poses great security challenges.

This article analyzes various attacks and proposes protection schemes. Mohammad Tehranipoor, University of Connecticut - citation -

Improve this question
3
  • Go look at a Bus Pirate. You don't need ports to extract information. Basic answer is, "Don't lose your phone". If you're that important and you've put delicate information on it in an unencrypted state, it's free for anyone with technical expertise to extract.
    – Fiasco Labs
    Commented Oct 6, 2012 at 2:07
  • The question is the level of technical expertise - JTAG renders MDM (en.wikipedia.org/wiki/Mobile_device_management) pointless
    – Mark Mullin
    Commented Oct 6, 2012 at 2:11
  • @MarkMullin: So does unrestricted physical access to the phone.
    – Scott Pack
    Commented Oct 6, 2012 at 15:51

3 Answers 3

Reset to default
3

It depends on the device. In most Android devices it is possible to physically replace the software in Flash (the so-called "ROM") and thus overcome any software dependent security, in which case an open JTAG port doesn't make things much worse. But there are a few Android devices on the market in which the hardware validates the "ROM" software before it is loaded. In such devices it's critical that the JTAG be locked as well. I suspect this is the situation in Android devices approved by the US Department of Defense.

In a comment you mentioned the ARM TrustZone technology. One of the feature of TrustZone is that resources (e.g. code, data) protected by the ARM TrustZone are inaccessible to a JTAG port even if there is an open JTAG port on the device. In other words with TrustZone you can have an open JTAG give you access to most of the device resources but not to the most sensitive resources which are protected by TrustZone.

Improve this answer
3
  • OK, I do think JTAG makes things worse, but if you're alluding to a pure software exploit I can't argue - and they're out there - far as I'm concerned, this means any line of business application with deep offline functionality cannot be considered to impose any reasonable breach cost - I can't deny I am becoming ever more horrified by security understanding in general tho - to paraphrase Eliot - security is not black and white, it is endless shades of gray once you leave the clean world of modern algebra
    – Mark Mullin
    Commented Oct 6, 2012 at 22:15
  • 1
    Very true. Regarding pure software exploits, Android is getting much harder to break thanks to ASLR and DEP (see arstechnica.com/security/2012/07/…) and the next line of attack for someone with physical access to a device would likely be JTAG.
    – David Wachtfogel
    Commented Oct 7, 2012 at 5:40
  • You can debug the TrustZone secure world through JTAG too. But if the manufacturer did things properly, that possibility will be disabled or at least require cryptographic authentication on a non-development device.
    – Gilles 'SO- stop being evil'
    Commented Dec 31, 2012 at 14:59
5

No.

There's something to be said for the fact that if you "own" a machine, then you own it. Physical possession of a piece of hardware with the ability to disassemble, modify, and otherwise physically hack the device very nearly guarantees that with enough work you will be able to get around security measure that might be present.

So, no, JTAG is no more troublesome than a USB port, or exposed RAM leads, or a desolderable flash chip.

EDIT

I can't understand why fundamentally disposable mass market consumer devices need a working test instrumentation port

JTAG is useful for more than just development testing. It's also used by repair technicians to fix phones that have firmware damage that makes software-based tools unusable. Including JTAG support in the production device lowers the maintenance/repair cost to the carriers who tend to be responsible for maintaining and fixing these devices on behalf of the customer. And lowering cost is always a worthwhile goal for the provider.

Improve this answer
16
  • 2
    @MarkMullin You cannot protect a device that is in the attacker's physical possession. That's the beginning and end of it. If you want to keep your data safe, the only way (only way) is to encrypt it. If cutting the JTAG traces gives you a warm fuzzy, then go ahead and do that. But it will not give you the security you care about.
    – tylerl
    Commented Oct 6, 2012 at 0:17
  • 2
    Never underestimate the reduction of support costs that a JTAG port brings. On old phones, a reflash of the baseband firmware required test points to be connected, which were essentially tiny SMT pads on the phone board. This meant that the entire phone had to be dismantled, and a special set of connectors had to be attached (and usually held in place by hand). Also keep in mind that each manufacturer's testpoint was a custom piece of hardware that hooked up to a PC's serial port, or USB if you were lucky. As such, they cost thousands to buy. Factor in added manual work... very costly.
    – Polynomial
    Commented Oct 6, 2012 at 9:40
  • 2
    As an example, the phone unlocking shop that I used to work in could do a baseband flash on a Motorola Razr v3 in about an hour, or a Blackberry Bold in about 20 minutes. JTAG made all the difference - less than half of those 20 minutes were spent actually hooking up the phone to the JTAG testpoint, the rest was just the firmware upload and reboot. On the old Razr V3 it took ages to strip the phone down to just the board, and hook it all up. Plus we'd frequently have problems with cracked plastic and other damage during the process.
    – Polynomial
    Commented Oct 6, 2012 at 9:44
  • 1
    @MarkMullin You're missing an important caveat of the rule - a safe is not designed to prevent any form of access. If you have the tools and the time, you can always break into a safe. The goal of the safe is to make it time consuming and infeasible to break into it without being caught in the act. If you have unrestricted access to the safe, e.g. if you can put the safe in a 600 tonne machine press, it is just as pwned as an Android device that you hand to a bad guy. The JTAG issue is the same thing - given unrestricted access you're pwned no matter what.
    – Polynomial
    Commented Oct 7, 2012 at 0:09
  • 1
    @tylerl I don't agree with the statement that it's impossible to "protect a device that is in the attacker's physical possession." It's extremely difficult and expensive - but not impossible. Any FIPS 140-2 security level 4 device is supposed to be secure even if it's in the attacker's physical possession for a substantial amount of time (this includes many HSMs). A good example is the PS3, which was in the attacker's hands for four years before its DRM was hacked (see events.ccc.de/congress/2010/Fahrplan/attachments/…).
    – David Wachtfogel
    Commented Oct 7, 2012 at 5:55
2

What bothering me is that people are managing valuable data -- in some cases, their whole life, and some other data which was entrusted to them -- in devices for which they cannot, do not, and not even try to, maintain physical security. A phone is something which is:

  1. expensive;
  2. small enough to be easily carried, but large enough to allow for easy grasping;
  3. brandished by the users while walking in the street, secured in position mostly by the suction strength of their ear, while the user is distracted by a conversation, and thus does not pay attention to his/her immediate environment.

It is no wonder that mobile phones are the most often stolen kind of object. A mobile phone is a risk by itself.

That the thief will be able to access the data without scratching the case, well, it does not bother me.

Improve this answer
3
  • Granted - but now they're bringing these devices into corporate networks on 'Bring your own device' (BYOD) programs, and the companies are installing 'Mobile Device Managers' (MDMs) that are supposed to protect the companies data - and this makes any of that protection a complete illusion - my issue is that with the existence of the JTAG port, any effort to secure the device is fundamentally pointless - no software can protect you against chip/instruction level access - and it isn't that they don't scratch the case, they can give it back to you and there's NO way to tell they were there :-(
    – Mark Mullin
    Commented Oct 6, 2012 at 0:20
  • 1
    @MarkMullin I think what you're not getting is that securing the device against an intruder who has physical access is a fundamentally pointless endeavor and an illusion to begin with. Adding a JTAG port does not decrease the security as there was none to begin with.
    – tylerl
    Commented Oct 6, 2012 at 0:34
  • @tylerl See arm.com/products/processors/technologies/trustzone.php - you can buy a samsung galaxy 3 in europe that has this, but you can't buy one here - as i said above, the concern i have is not that it is possible, it is that the jtag port removes most of the workload on the attacker - if someones going to peel the chips off the board there's not much i can do - what i don't like is someone with far less skills being able to mount the same attack - i can never protect the secret molecule on a drug ceo phone - but now I can't protect a local cops notes either
    – Mark Mullin
    Commented Oct 6, 2012 at 1:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .