SoylentNews is people
SoylentNews
from the Use-only-Official®-Authorized-Parts-and-Repair-Services dept.
People with cracked touch screens or similar smartphone maladies have a new headache to consider: the possibility the replacement parts installed by repair shops contain secret hardware that completely hijacks the security of the device.
The concern arises from research that shows how replacement screens—one put into a Huawei Nexus 6P and the other into an LG G Pad 7.0—can be used to surreptitiously log keyboard input and patterns, install malicious apps, and take pictures and e-mail them to the attacker. The booby-trapped screens also exploited operating system vulnerabilities that bypassed key security protections built into the phones. The malicious parts cost less than $10 and could easily be mass-produced. Most chilling of all, to most people, the booby-trapped parts could be indistinguishable from legitimate ones, a trait that could leave many service technicians unaware of the maliciousness. There would be no sign of tampering unless someone with a background in hardware disassembled the repaired phone and inspected it.
The research, in a paper presented this week at the 2017 Usenix Workshop on Offensive Technologies, highlights an often overlooked disparity in smartphone security. The software drivers included in both the iOS and Android operating systems are closely guarded by the device manufacturers, and therefore exist within a "trust boundary." The factory-installed hardware that communicates with the drivers is similarly assumed to be trustworthy, as long as the manufacturer safeguards its supply chain. The security model breaks down as soon as a phone is serviced in a third-party repair shop, where there's no reliable way to certify replacement parts haven't been modified.
The researchers, from Ben-Gurion University of the Negev, wrote:
The threat of a malicious peripheral existing inside consumer electronics should not be taken lightly. As this paper shows, attacks by malicious peripherals are feasible, scalable, and invisible to most detection techniques. A well motivated adversary may be fully capable of mounting such attacks in a large scale or against specific targets. System designers should consider replacement components to be outside the phone's trust boundary, and design their defenses accordingly
Source: Ars Technica
Also covered at: Engadget.
(Score: 2) by Bot on Tuesday August 22 2017, @07:22AM (4 children)
stop this paranoid thinking
it makes no sense to hijack a phone through spare parts when you already control all the phone's parts.
PS do you know I speak perfect Chinese? Well I don't.
sent from my china produced hardware.
Account abandoned.
(Score: 2) by FatPhil on Tuesday August 22 2017, @08:15AM (3 children)
Of course, once the data's off the bus and in the CPU, and being passed around the software stack (linux driver, linux event interface, X input layer, snoopable via Xtest), then that's another matter entirely, but that's not evil replacement hardware, that's sloppy or evil software which came with the phone anyway.
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by Arik on Tuesday August 22 2017, @08:32AM
As long as it's available in the store though, the screen can wait till the system is idle, then invisibly install the app. Their app uses a buffer exploit and at that point it's game over. The combination of the app and the screen have full control of the system, it's a keylogger and a rootkit and it can use the network anytime it wants.
Seem to me like you could achieve the same effect by just installing the app while you have the phone though? Removing the app from the store wouldn't help those already infected but would turn any existing stock of screens into junk, as at minimum they would have to be reprogrammed to install a different app.
I don't know, I'm mostly agreeing with the other guy, that there's no need for attackers who already have the phones thoroughly compromised to start trying to sneak in replacement screens. It's not a horrible idea it's just redundant.
If laughter is the best medicine, who are the best doctors?
(Score: 2) by TheRaven on Tuesday August 22 2017, @09:36AM (1 child)
Not in a typical Android phone, they're all on the memory bus and are have complete DMA access to the whole of physical memory and to other devices control registers.
sudo mod me up
(Score: 2) by FatPhil on Tuesday August 22 2017, @12:56PM
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves