On Android distros [LWN.net]

On Android distros

Posted Jan 2, 2025 21:26 UTC (Thu) by epa (subscriber, #39769)
In reply to: On Android distros by sionescu
Parent article: Some things to expect in 2025

Presumably if you control the distribution all the way down to the kernel, you could program it to hide the apps that are installed or change the ‘unlocked’ flag.

to post comments

On Android distros

Posted Jan 2, 2025 21:50 UTC (Thu) by intelfx (subscriber, #130118) [Link] (4 responses)

> Presumably if you control the distribution all the way down to the kernel, you could program it to hide the apps that are installed or change the ‘unlocked’ flag.

The "remote attestation" thing (read: pervasive DRM facilitated by hardware) is explicitly designed to mitigate this... unfortunate possibility (unfortunate, of course, in the eyes of the commercial interests).

On Android distros

Posted Jan 2, 2025 22:06 UTC (Thu) by epa (subscriber, #39769) [Link] (3 responses)

Yes, I guess it depends on whether you have open hardware or there are some parts of the system (a TPM) that not even the kernel can fully control.

On Android distros

Posted Jan 3, 2025 2:12 UTC (Fri) by khim (subscriber, #9252) [Link] (2 responses)

Most (all?) mobile devices have two systems in one chipset, one is running Android (or other high-level OS) and the other one runs proprietary RTOS and certified to drives the radio.

Guess which one is in charge of everything and couldn't be easily touched and/or changed?

On Android distros

Posted Jan 3, 2025 8:56 UTC (Fri) by epa (subscriber, #39769) [Link] (1 responses)

That’s true but I think it is not what we were talking about. A banking app does not check whether your phone’s radio is operating within FCC parameters. It may ask to list the apps installed at the Linux level or whether the user has root access (which does not give you control over the locked-down radio hardware).

The question is whether there is a third piece of hardware, the TPM, which can be queried from user space but isn’t under the device owner’s control, so you cannot tell it to say you are running a particular software stack when you aren’t.

If you do have root you could in principle attach a debugger to the misbehaving app and alter its memory to make it run anyway, but that wouldn’t help with a cryptographically strong attestation to a remote server using a private key locked inside the TPM.

On Android distros

Posted Jan 3, 2025 14:56 UTC (Fri) by khim (subscriber, #9252) [Link]

> A banking app does not check whether your phone’s radio is operating within FCC parameters.

Sure, but the existence of separate, “hidden” and “secret” world means this quesion

> The question is whether there is a third piece of hardware, the TPM, which can be queried from user space but isn’t under the device owner’s control, so you cannot tell it to say you are running a particular software stack when you aren’t.

Has very definitive and obvious answer: yes, there is such a piece of hardware. And you can not forge it.

Of course many banking apps look for things that shouldn't concern them (things like what other apps are installed), and these can be easily forged by suitable firmware.

But if they just look for the attestation then this couldn't be forged.

> If you do have root you could in principle attach a debugger to the misbehaving app and alter its memory to make it run anyway, but that wouldn’t help with a cryptographically strong attestation to a remote server using a private key locked inside the TPM.

Of course our world is not perfect and we couldn't have nice things: because in certain places hacked Chinese phones are extremely popular (they are cheaper but need hacked ROM to stop phoning to the Chinese landlords) banks couldn't just trust the attestation. Instead they invent elaborate schemes that allow the use of some of these hacked phones, but not all hacked phones.

Whether it'll work on your device depends on the bank and the phase of the moon.

On Android distros

Posted Jan 2, 2025 22:10 UTC (Thu) by excors (subscriber, #95769) [Link] (5 responses)

The kernel may not be low-level enough - the Google Play Integrity API reports a few different levels of integrity, and I believe the strongest requires Verified Boot and hardware attestation to prove you're running a certified, locked, unrooted, official bootloader/kernel/etc (https://developer.android.com/google/play/integrity/verdi...). If an app requires that level of integrity, and is willing to sacrifice compatibility with older Android devices and niche device configurations, no amount of fiddling with software will get around it (barring severe bugs in the implementation).

GrapheneOS notes that instead of using the Play Integrity API, apps could use AOSP's lower-level attestation API and choose to accept devices that match a list of "official GrapheneOS verified boot keys" (https://grapheneos.org/articles/attestation-compatibility...), which should provide a similar level of assurance without being tied to the proprietary Google Play Services. But I don't know if any serious apps actually do that.

On Android distros

Posted Jan 3, 2025 11:31 UTC (Fri) by epa (subscriber, #39769) [Link] (3 responses)

What is to stop the API reporting that it's certified and unrooted when running a custom distribution?

On Android distros

Posted Jan 3, 2025 12:08 UTC (Fri) by excors (subscriber, #95769) [Link] (2 responses)

The app connects to some online service (e.g. your bank) which controls all the sensitive data this system is trying to protect. (It's not meant to protect purely offline apps). The app uses the API to get a securely signed attestation report, which it forwards to the online service for verification (checking the root certificate is signed by Google's attestation root key, the Verified Boot details say it's running trustworthy firmware, etc). The app/kernel/firmware can't forge the signatures, because the hardware does a reasonable job at keeping the private keys secret, so the server would reject a fake report and the app wouldn't have access to your money/secrets/etc.

On Android distros

Posted Jan 3, 2025 14:01 UTC (Fri) by epa (subscriber, #39769) [Link] (1 responses)

So you're saying the signature for the attestation report comes from the TPM (not the Linux operating system).

On Android distros

Posted Jan 3, 2025 16:25 UTC (Fri) by excors (subscriber, #95769) [Link]

Basically, yes.

(Technically it's not called a TPM, probably because that's a specific ISO standard and they don't implement that, but it's a vaguely similar idea. On Pixel phones there's a small 'secure' OS running on the main CPU in parallel to Linux, using ARM TrustZone for isolation; plus a security core on the main SoC, with its own dedicated CPU/RAM/etc running another OS; plus a physically separate security chip with yet another simple OS. Some combination of those are used for Verified Boot, attestation, etc. See https://security.googleblog.com/2021/10/pixel-6-setting-n...)

On Android distros

Posted Jan 10, 2025 13:30 UTC (Fri) by anton (subscriber, #25547) [Link]

According to the German Wikipedia, GrapheneOS works with a number of banking apps (the bank where I have my main account is listed). I don't know if these apps use the attestation API, but it certainly looks encouraging.