Supply chain attacks on Pixel devices?

Open_Source_Enjoyer

How hard would it be for malicious actors to conduct a supply chain attack on Pixel devices?
For example could the chinese manufactures implement a hardware backdoor?
Could any instance between the factory and the consumer manipulate the device in a way that couldn't get erased by a factory reset (so hardware or low level software)?

And for used/refurbished devices:
Could someone buy a Pixel and modify the hardware or low level software (like boot loader or board loader) to implement a backdoor that wouldn't get erased by a factory reset and then resell the device?

de0u

Open_Source_Enjoyer Many things are possible in theory! Somebody could open up a Pixel and add a small radio beacon that would transmit only a little bit rarely.

Of course, the same is true of an iPhone, or an electric toothbrush... or an LED light bulb... or a key fob for a car...

Tampering with the smartphone parts of a smartphone, thus getting files stored on the device, would be a lot harder. But if somebody is willing to spend $100,000 to get data on you in particular they probably will, at least unless your opsec is stellar all the time, which is a heavy cost.

GrapheneOS on a Pixel makes it hard for random entities to cheaply harvest lots of data from lots of people, and provides quite good resistance against a variety of focused attacks. But it's genuinely difficult to protect against a well-resourced attacker focused on a specific target, especially an attacker who isn't in a hurry.

teezeh

Open_Source_Enjoyer How hard would it be for malicious actors to conduct a supply chain attack on Pixel devices?
For example could the chinese manufactures implement a hardware backdoor?

Why waste time with such hypertheoretical questions?

Open_Source_Enjoyer

de0u a small radio beacon that would transmit only a little bit rarely.

What could this beacon transmit?

de0u Of course, the same is true of an iPhone, or an electric toothbrush... or an LED light bulb... or a key fob for a car...

I know this problem is not limited to Pixels, it is a more generell problem, especially for a hardware that include less trustworthy countries in their supply chains.

de0u Tampering with the smartphone parts of a smartphone, thus getting files stored on the device

Do you mean getting my files from the device to the attacker or do you mean get a backdoor from the attacker to my device?

de0u But if somebody is willing to spend $100,000 to get data on you in particular they probably will, at least unless your opsec is stellar all the time, which is a heavy cost.

If the coasts are so high then its safe enough cause my data is not so valuable (for the attacker).

de0u GrapheneOS on a Pixel makes it hard for random entities to cheaply harvest lots of data from lots of people, and provides quite good resistance against a variety of focused attacks. But it's genuinely difficult to protect against a well-resourced attacker focused on a specific target, especially an attacker who isn't in a hurry.

How could GrapheneOS prevent for example the CCP to just backdoor every electronic component that goes through their factory?

locked A Chinese manufacturer probably could implant a hardware backdoor somehow, and likely not anything software related, and to do so would be very risky. Should Google discover this it on a large scale, it would likely be game over for that supplier.

I did some research on if hardware components like CPUs can audited and it seems that its very difficult even for big tech firms or government agencies to audit hardware components and make sure that there is no backdoor.

23Sha-ger Nobody will go to that length of complexity for a "nice to have" thing.
There are lower hanging fruits, such as all the Chinese phones, you can implement backdoors in software
and it can stay under the radar for years.

But every person that care a at least a little bit about privacy and security would not use this stuff, the only people they get with these, are people that have all their stuff easy accessible (for every organization who really wants to) anyway.

Software backdoors are a lot easier to detect and/or to prevent then hardware backdoors.
Open Source software is if reproducible (if not then its not really open source) very easy to audit even for not so technical person, in a way that they can make sure that they have the same code running that is on Github and if the projects is big enough they can reasonably assume that someone would have audited the code itself.
And even closed source software is a lot easier to reverse engineer then it is to reverse engineer hardware components. And even if this fails, you can at least make sure that all the binaries have the same checksum so you have the same code as everyone else and also as inspecting government agencies who maybe able to reverse engineer if they have a suspicion.
With hardware all this is not really possible.

locked

A Chinese manufacturer probably could implant a hardware backdoor somehow, and likely not anything software related, and to do so would be very risky. Should Google discover this it on a large scale, it would likely be game over for that supplier. A hardware attack could come from elsewhere in the supply chain, but I think it's highly unlikely to occur.

23Sha-ger

This is very unlikely for Pixel devices. Too much effort without actual value. When governments do it, they
usually expect some kind of ROI. Nobody will go to that length of complexity for a "nice to have" thing.
There are lower hanging fruits, such as all the Chinese phones, you can implement backdoors in software
and it can stay under the radar for years.

de0u

teezeh Why waste time with such hypertheoretical questions?

2016: https://cyberscoop.com/android-malware-china-huawei-zte-kryptowire-blu-products/
2023: https://www.tomsguide.com/news/thousands-of-android-tv-boxes-infected-with-dangerous-malware-linked-to-fraud

It's unclear why things that have been widely documented as happening would be dismissively referred to as "hypertheoretical".

de0u

teezeh https://www.techworm.net/2015/08/lenovo-pcs-and-laptops-seem-to-have-a-bios-level-backdoor.html

de0u

teezeh https://www.theregister.com/2023/02/07/chinese_android_phones_leak_pii/

Open_Source_Enjoyer

teezeh Why waste time with such hypertheoretical questions?

Its not hypertheoretical
If the hardware components or low level software can't be trusted then the entire chain of trust is broken, even if you have the most secure operating system on your device.

grayway2

de0u Xiaomi is probably the worst big brand in phone market for breaking people's privacy. They are very good at making good devices but they are evil. They have zero respect to consumers privacy. Xiaomi's apps like file manager asks dangerous permissions. In the past they were collecting every key stroke and search through their browser.

Wechat is as secure as sms. Social credit system is real. Qr code payments is the base.

China is really a lost cause.

Skyway

Due to recent events this might be more plausible. which products I don't know.

de0u

Open_Source_Enjoyer I did some research on if hardware components like CPUs can audited and it seems that its very difficult even for big tech firms or government agencies to audit hardware components and make sure that there is no backdoor.

Correct. But people do things that are difficult and expensive all the time. For example, roughly once per year Google designs a new Pixel SoC, and then they test it and debug the new Android onto it and make boxes to match the new devices and buy online ads to sell them. That's difficult and expensive! Might companies start spending an extra 5% on post-factory chip audits? Of course, 5% wouldn't be guaranteed to find back doors, but once one leaves the realm of mathematics absolute guarantees are very hard to come by.

Open_Source_Enjoyer How could GrapheneOS prevent for example the CCP to just backdoor every electronic component that goes through their factory?

I don't speak for the GrapheneOS project, but I don't expect they believe hardware audits to be within their scope.

I think it's important to separate out two very-different things:

Can somebody with sufficient money, energy, and persistence break into my personal device? My claim is: probably yes.
Can somebody compromise tens of millions of devices, year after year, without being caught? I suspect not. People notice things (see the articles I linked above). People take things apart and look inside (even chips). People monitor network traffic. People involved in conspiracies leak information about conspiracies! In the CCP/Pixel scenario, everybody capable of leaking would have years and years during which the leak would cause severe reputational damage to the CCP, and there would be a fair number of capable people.

Note that even "retail" attacks against small numbers of personally targeted devices (e.g., Pegasus) are discovered. I'm not saying a model where somebody compromises tens of millions of devices per year and nobody notices is impossible. But I think it's at least thousands, maybe millions, of times less likely than the likelihood that a well-resourced attacker can break into a small number of targeted devices without getting caught. The examples I cited above are cases where people mass-infested devices and were caught fairly quickly. And in general they were cases where the actors didn't particularly fear discovery -- for example, if you're a criminal malware gang infecting Android TV boxes and that gets found out, oh well, time to find a different way to get people; it's not like the attackers got jail time.

So: could somebody compromise one phone, or a few phones, on eBay? I guess so, but it's not clear why it would be a good business model. Could the CCP compromise every Pixel 9a? In theory, sure, but they probably would get caught.

locked

Something like this would take a lot of research and cost a lot, and who ever is doing it, would want to keep it a secret. The target would have to be very important for something like this to be attempted...

Open_Source_Enjoyer

locked Something like this would take a lot of research and cost a lot

The technology for this allready exists so the attacker only need to implement it.

de0u Might companies start spending an extra 5% on post-factory chip audits? Of course, 5% wouldn't be guaranteed to find back doors, but once one leaves the realm of mathematics absolute guarantees are very hard to come by.

Are there any sources that companies like Google actually do such audits?

de0u I don't speak for the GrapheneOS project, but I don't expect they believe hardware audits to be within their scope.

Do the GrapheneOS Team has the ressources for stuff like this?

de0u cause severe reputational damage to the CCP

Do they have the reputation of beeing trustworthy at the moment so they can lose it?

locked

de0u They would certainly get caught, and likely not ever export anymore phones, to the west, especially today, as the Chinese are already 'skating on thin ice' as it is. The last thing they need is to be caught doing something like this on say 'all pixel phones' or any phones for that matter.

de0u

de0u Might companies start spending an extra 5% on post-factory chip audits? Of course, 5% wouldn't be guaranteed to find back doors, but once one leaves the realm of mathematics absolute guarantees are very hard to come by.

Open_Source_Enjoyer Are there any sources that companies like Google actually do such audits?

I am not aware of any public statements -- either way. There are marketing reasons why a company might announce hardware audits, but there are business and legal reasons why a company might do hardware auditing and not say anything.

de0u I don't speak for the GrapheneOS project, but I don't expect they believe hardware audits to be within their scope.

Open_Source_Enjoyer Do the GrapheneOS Team has the [resources] for stuff like this?

Again, I don't speak for the GrapheneOS project... but I suspect most of the GrapheneOS developers are software people. Meanwhile, decapping chips, and operating scanning tunneling microscopes, etc., are hardware-people activities. Obviously people can be good at both, but there are only so many hours in a day.

I suspect if there were a lot of people (millions) who were willing to pay double for phones then it might be possible to have each phone's hardware audited to some extent. I'm not expecting that any time soon.

raccoondad

Open_Source_Enjoyer moment so they can lose it?

Obviously this gets slightly political, I'll try to avoid the most of it, but honestly the CCP has a huge interest in never, ever, fucking around in that capacity.

Their own citizens in their own borders? Especially cities? You can do your own research and come to your conclusions.

However the rest of the world? I assure you, China as a state has little interest in what you are doing. They are very, very far away.

They would lose everything if such a thing was exposed, and gain nothing by doing it.

Also hardware backdoors are...rough to implement. Some rootkits attack the boot process and inject malicious kernel modules, sure, but those are rare and could probably be picked up on.

If the CCP does anything, its probably based on their own hardware, in their own companies, towards their own citizens they have legal authority over.

Simply put, Chinese law enforcement doesn't really care about you. They can't do much to you. Their main goal is to manufacture, and I believe the CCP is smart enough not to bite hands that feed them billions.

locked

Open_Source_Enjoyer Here I found some information that may be interesting to you.

https://security.googleblog.com/2023/08/pixel-binary-transparency-verifiable.html
https://services.global.ntt/en-us/about-us/case-studies/google
https://www.webpronews.com/googles-pixel-binary-transparency-keeps-users-safe-from-supply-chain-attacks/

Open_Source_Enjoyer

de0u Again, I don't speak for the GrapheneOS project... but I suspect most of the GrapheneOS developers are software people. Meanwhile, decapping chips, and operating scanning tunneling microscopes, etc., are hardware-people activities. Obviously people can be good at both, but there are only so many hours in a day.

This is why i don't think that GrapheneOS devs do hardware audits.

de0u I suspect if there were a lot of people (millions) who were willing to pay double for phones then it might be possible to have each phone's hardware audited to some extent. I'm not expecting that any time soon.

Its not necessary to audit everything.
Its totally fine to randomly collect samples on the end consumer side, best case by buying the phones from online stores and physical stores on the normal way and then audit the samples.
Even if you audit less then 0,0001% of the supply it would be enough if you do it with random and anonymously collected samples.