On Android distros [LWN.net]

On Android distros

Posted Jan 2, 2025 21:50 UTC (Thu) by intelfx (subscriber, #130118)
In reply to: On Android distros by epa
Parent article: Some things to expect in 2025

> Presumably if you control the distribution all the way down to the kernel, you could program it to hide the apps that are installed or change the ‘unlocked’ flag.

The "remote attestation" thing (read: pervasive DRM facilitated by hardware) is explicitly designed to mitigate this... unfortunate possibility (unfortunate, of course, in the eyes of the commercial interests).

to post comments

On Android distros

Posted Jan 2, 2025 22:06 UTC (Thu) by epa (subscriber, #39769) [Link] (3 responses)

Yes, I guess it depends on whether you have open hardware or there are some parts of the system (a TPM) that not even the kernel can fully control.

On Android distros

Posted Jan 3, 2025 2:12 UTC (Fri) by khim (subscriber, #9252) [Link] (2 responses)

Most (all?) mobile devices have two systems in one chipset, one is running Android (or other high-level OS) and the other one runs proprietary RTOS and certified to drives the radio.

Guess which one is in charge of everything and couldn't be easily touched and/or changed?

On Android distros

Posted Jan 3, 2025 8:56 UTC (Fri) by epa (subscriber, #39769) [Link] (1 responses)

That’s true but I think it is not what we were talking about. A banking app does not check whether your phone’s radio is operating within FCC parameters. It may ask to list the apps installed at the Linux level or whether the user has root access (which does not give you control over the locked-down radio hardware).

The question is whether there is a third piece of hardware, the TPM, which can be queried from user space but isn’t under the device owner’s control, so you cannot tell it to say you are running a particular software stack when you aren’t.

If you do have root you could in principle attach a debugger to the misbehaving app and alter its memory to make it run anyway, but that wouldn’t help with a cryptographically strong attestation to a remote server using a private key locked inside the TPM.

On Android distros

Posted Jan 3, 2025 14:56 UTC (Fri) by khim (subscriber, #9252) [Link]

> A banking app does not check whether your phone’s radio is operating within FCC parameters.

Sure, but the existence of separate, “hidden” and “secret” world means this quesion

> The question is whether there is a third piece of hardware, the TPM, which can be queried from user space but isn’t under the device owner’s control, so you cannot tell it to say you are running a particular software stack when you aren’t.

Has very definitive and obvious answer: yes, there is such a piece of hardware. And you can not forge it.

Of course many banking apps look for things that shouldn't concern them (things like what other apps are installed), and these can be easily forged by suitable firmware.

But if they just look for the attestation then this couldn't be forged.

> If you do have root you could in principle attach a debugger to the misbehaving app and alter its memory to make it run anyway, but that wouldn’t help with a cryptographically strong attestation to a remote server using a private key locked inside the TPM.

Of course our world is not perfect and we couldn't have nice things: because in certain places hacked Chinese phones are extremely popular (they are cheaper but need hacked ROM to stop phoning to the Chinese landlords) banks couldn't just trust the attestation. Instead they invent elaborate schemes that allow the use of some of these hacked phones, but not all hacked phones.

Whether it'll work on your device depends on the bank and the phase of the moon.