Secret Chips in Replacement Parts Can Completely Hijack Your Phone's Security (arstechnica.com) 62
Dan Goodin, writing for ArsTechnica: People with cracked touch screens or similar smartphone maladies have a new headache to consider: the possibility the replacement parts installed by repair shops contain secret hardware that completely hijacks the security of the device. The concern arises from research that shows how replacement screens -- one put into a Huawei Nexus 6P and the other into an LG G Pad 7.0 -- can be used to surreptitiously log keyboard input and patterns, install malicious apps, and take pictures and e-mail them to the attacker. The booby-trapped screens also exploited operating system vulnerabilities that bypassed key security protections built into the phones. The malicious parts cost less than $10 and could easily be mass-produced. Most chilling of all, to most people, the booby-trapped parts could be indistinguishable from legitimate ones, a trait that could leave many service technicians unaware of the maliciousness. There would be no sign of tampering unless someone with a background in hardware disassembled the repaired phone and inspected it. The research, in a paper presented this week (PDF) at the 2017 Usenix Workshop on Offensive Technologies, highlights an often overlooked disparity in smartphone security. The software drivers included in both the iOS and Android operating systems are closely guarded by the device manufacturers, and therefore exist within a "trust boundary."
Phone manufacturers (Score:4, Interesting)
I wonder which phone manufacturers sponsored this FUD. Technically possible? Sure. Any evidence it has ever occurred in the wild? No. Would this sort of malicious hardware have to transmit data in some way to offload the stolen information, thus raising alarms in various corporate type networks and the like? Eventually.
Re: (Score:1)
"error 53"
Re: (Score:1)
"error 53"
That again?!?
It was a coding error, subsequently fixed with an Update (which iOS devices actually RECEIVE, unlike 99.9999999999999999999999999999% of Android devices).
https://ifixit.org/blog/7924/e... [ifixit.org]
Re: (Score:2)
My two year old Samsung still gets an update at least every other month. Soooooo wth were you saying again champ?
So, you're in the .00000000000000000000000000000001 percent of Android users that have gotten mire than an updated or two.
Re: (Score:1)
So, you're in the .00000000000000000000000000000001 percent of Android users that have gotten mire than an updated or two.
Rubbish. My Samsung Galaxy Note 4 (last of the line with a replaceable battery!) was originally released in late 2014. It still regularly receives updates.
Re: Phone manufacturers (Score:1)
Re: (Score:2)
Probably our friendly, neighborhood, fruit tree company...
Probably not; but I'll bet their devices don't share this issue. Not because of good design (but that is likely part of it); but because they don't use commodity SoCs like in 100% of Android devices.
But I would really be surprised if ANY independent repair shops are replacing BGA-packaged SoCs, anyway.
I agree: The article is FUD.
Re: (Score:3)
Re: (Score:2)
How can a screen or digitizer communicate to the outside world? It likely isn't on a bus where it can ask the radio or NIC to packetize stuff it feels like. At best, it can record taps on a screen, but getting those out would be a different story. Perhaps for physical snooping where the device is captured later on (say to glean someone's PIN), but for a remote attacker, it isn't that feasible.
Re: (Score:2)
Re: (Score:2)
If it knows what touches to simulate, then it can use any of a number of ways of doing so when the user isn't actively handling their phone (e.g. after it has been set down, but not yet auto-locked).
But unless it knows exactly WHAT App is receiving those "taps" (which the display and digitzer most assuredly do NOT), so the fuck what?
Re: (Score:2)
How can a screen or digitizer communicate to the outside world? It likely isn't on a bus where it can ask the radio or NIC to packetize stuff it feels like. At best, it can record taps on a screen, but getting those out would be a different story. Perhaps for physical snooping where the device is captured later on (say to glean someone's PIN), but for a remote attacker, it isn't that feasible.
Right. Because the user taps in several places on the screen; but unless the display/digitizer is privvy to exactly WHAT App is running in the foreground, those taps and swipes are USELESS outside of the phone.
FUD.
Re: (Score:3)
No, it's not. Because if you log where you touch on the screen and where you swipe, you can probably figure out what's going on.
Look at the lock screen on your phone, and your keypad is probably laid out like every other keypad out there. In fact, it looks remarkably like the phone keypad too (if
Re: (Score:2)
No, it's not. Because if you log where you touch on the screen and where you swipe, you can probably figure out what's going on.
Look at the lock screen on your phone, and your keypad is probably laid out like every other keypad out there. In fact, it looks remarkably like the phone keypad too (if you're using a PIN). So any succession of taps in that region of the screen with the relatively wide spacing may be either a phone number, or the PIN code to unlock your phone.
Ditto with the keyboard - if you're making a bunch of taps in the lower 1/3rd of the screen, I don't need to know what you're running in order to guess you might be typing something. If I record the locations of the taps, and then try to play it back with various scaling on the keyboard, I might be able to recreate what you typed.
Heck, I might log information about when the touch screen chip is turned off so I can tell when you power it up, you're screen is probably locked and to note the next few taps and swipes.
I'm sorry; my lock screen doesn't have a keypad, nor do I swipe to unlock.
Re: (Score:2)
Not only is it FUD, but it could be done with brand-new phones. Thousands of people have access to the supply chain and at any point could pull inventory, modify/replace the original parts, and swap them back in. The fact is that there is no reasonable commercial incentive for the random repair person at a store to spy on the random customer that has his screen replaced, and it would be super simple to catch the responsible party. Talk about hard evidence!
Re: (Score:2)
if you're a front for organized crime, then it's an easy way to hijack people's phones
Re: (Score:2)
But like I said, super easy to trace back and with tons of hard evidence, both on-premises and in all of your victim's hands. Plus the circumstantial evidence of all the ripped off people having a common experience of using your business. Much better off with a software hack. I mean, you have the person's phone in your possession... why not just install whatever software that you want - where there is at least some degree of plausible deniability?
Re: (Score:2)
But like I said, super easy to trace back and with tons of hard evidence, both on-premises and in all of your victim's hands. Plus the circumstantial evidence of all the ripped off people having a common experience of using your business. Much better off with a software hack. I mean, you have the person's phone in your possession... why not just install whatever software that you want - where there is at least some degree of plausible deniability?
Good luck doing that with a signed OS, like iOS... You can't even install a LEGIT, but no-longer-signed, version of iOS; let alone some backroom-hacked FrankenWare version.
Re: (Score:2)
OK, but if you can't do it with physical access to the phone, then a screen hack also won't help you.
Re: (Score:2)
Re:Phone manufacturers (Score:5, Insightful)
Perhaps you're not familiar with how security research works. Stopping at "is this being exploited in the wild now?" is shortsighted.
For some background, read:
https://blog.osvdb.org/2017/08... [osvdb.org]
(about "L0pht, Making the theoretical practical since 1992." )
Re: (Score:2)
Dumb question here. Why do we trust Apple or Samsung parts more than Huwai?
Re: (Score:2)
now android marketing and spy OS ,there is no difference to ios,(it's not for geek), I used to like before there was a 2.3 version, now I use a simple push-button telephone
WTF are you even talking about?
Re: (Score:3)
In theory, Apple and Samsung have a lot more to lose. Apple especially, since their reputation as a phone provider rides on how secure their devices are, and if something is discovered, there are many rivals who will be happy to take the loss. Samsung, similar.
Huawei? Not as much, as they are in a different market segment.
Re: (Score:2)
In theory, Apple and Samsung have a lot more to lose. Apple especially, since their reputation as a phone provider rides on how secure their devices are, and if something is discovered, there are many rivals who will be happy to take the loss. Samsung, similar.
Huawei? Not as much, as they are in a different market segment.
Exactly.
Re:Phone manufacturers (Score:5, Informative)
Apple and Samsung devices and software have been evaluated and validated against FIPS 140-2, Common Criteria and Commercial Solutions for Classified (CSfC) standards and are considered safe enough for use by the US government and others which respect those certifications (such as the 20+ countries in the Common Criteria Recognition Agreement).
Huawei has financial and political ties to the Chinese government, which has a well known history of taking "cyber" action for both political and industrial espionage purposes, in addition to siding with adversarial countries such as Russia, North Korea, etc. on a number of issues.
Therefor, Apple and Samsung are probably better choices from a trustworthiness standpoint. On the other hand, they're largely manufactured and assembled in the PRC and would be targets for the kind of supply-chain-infiltration type hardware implant attack. It'd just be less easy to accomplish than embedding implants or back doors into the hardware of one of their own companies.
Re: (Score:2)
Apple and Samsung devices and software have been evaluated and validated against FIPS 140-2, Common Criteria and Commercial Solutions for Classified (CSfC) standards and are considered safe enough for use by the US government and others which respect those certifications (such as the 20+ countries in the Common Criteria Recognition Agreement).
Huawei has financial and political ties to the Chinese government, which has a well known history of taking "cyber" action for both political and industrial espionage purposes, in addition to siding with adversarial countries such as Russia, North Korea, etc. on a number of issues.
Therefor, Apple and Samsung are probably better choices from a trustworthiness standpoint. On the other hand, they're largely manufactured and assembled in the PRC and would be targets for the kind of supply-chain-infiltration type hardware implant attack. It'd just be less easy to accomplish than embedding implants or back doors into the hardware of one of their own companies.
PERFECT answer!
Mod Parent "Informative"!
Re: (Score:2)
Dumb question here. Why do we trust Apple or Samsung parts more than Huwai?
Because by now, any nefarious transmissions would have long-ago been discovered by people like you.
Re: (Score:2)
thus raising alarms in various corporate type networks and the like?
Only if you assume that no one ever uses a network outside their corporate network and that all networks used employ various ways to detect this data transmission. For most consumers, the normal is not to have such high security. They don't employ such detection methods and they connect to outside networks all the time.
Also consumers are far more likely to buy these 3rd party parts than someone with a corporate phone who will most likely send it to their company for repair who will use genuine parts.
Re: (Score:2)
There are much worse things already happening (Score:2)
Such as faulty/counterfeit batteries used in Galaxy Note 4s during repair [engadget.com].
This isn't news (Score:3)
Re: (Score:3)
Re: (Score:3)
And when it comes to phones, that happens before you even buy it. The idea of a phone's security being subverted is laughable. It never had any security! It was always someone else's computer.
Granted, you would probably prefer your phone to have n masters above you, rather than n+1. But for high values of n, the more you care about that, the less sense it makes. You should probably worry more about n and less about the +1. Solve the real
A cell phone inside the cell phone to send data? (Score:2)
So fine, your screen part has a malicious "touch logger" capability... how does it send data? Oh yeah, it CAN'T.
This sounds like FUD to make sure customers use the most expensive repair channel - the original manufacturer - to have the work done.
New, more accurate headline (Score:2)
"A hacked touchscreen can inject pre-scripted touch events into the event screen"
Of course, this assumes:
a) the device is unlocked
b) the malicious driver can guess where the required touch zones are located (no small feat, considering the diversity of softkey layouts (e.g, Samsung vs Nexus vs LG vs HTC), homescreen launchers, and the layout of app drawers (depending upon what the user installed).
c) Since malware (in addition to the driver itself) is almost a requirement (given a & b), the hardware itsel
Omg! Thanks for the warning. (Score:1)
I'll be sure to pay out the a$$ for the expensive parts with spyware approved by the shiny people.
Who do you trust? Really? (Score:4, Interesting)
Ken Thompson's Reflections on Trusting Trust [win.tue.nl] is well worth a read. Long story short, anyone with access to the hardware/software stack of your machine can compromise its security.
These attacks are not merely theoretical. The key to good security is to make the cost of compromise greater than the value of whatever would be received by doing so. For the average person, their privacy is not worth the effort of surrepitiously installing hardware. However, if you're a Palestinian terrorist... You may just want to have someone else purchase/service your electronic devices, as the Israeli equivalent of the CIA has planted explosives in the cellphones of Palestinians (and successfully carried out assassinations this way.)
You should always order by mail or Amazon (Score:1)
This just shows that you should always order by mail order or by Amazon, so that the NSA can install their own chips inside instead of the other ones a repair shop would install.