Detecting and mitigating adversarial physical access w/ known PIN

jcom

Watermelon Excellent points that I hadn't considered, thank you, appreciate the post.

Watermelon

jcom I think there's a very doubtable chance it might be possible to unlock the device securely if you take it and enter a faraday cage, unlock it there, and use the Auditor app and it passes the verification (this requires your real phone to already be paired in Auditor). Even if the device could be a fake one that'd unlock without caring what credential you actually put into it, your real phone with the Auditor app would not pass attestation without being unlocked for running the Auditor app, and proxying from the device you're holding to your real phone should(?) be impossible: only after both unlocking and passing verification with Auditor, you'd have proof that your real phone is present with you in the faraday cage. It still doesn't rule out physical tampering, and I'm not a wireless radio expert. And if unlocking or the attestation fails, you'd have to disintegrate the device within the faraday cage so it won't transmit your unlock credential when you take it outside.

AcclaimSublevel19

I think Haven is a great choice for this problem. Even if you can't prevent unauthorized access, it can enable you to be aware of it and take necessary precautions.

Of course, I'm assuming that the attacker has the capability to compromise the phone if they have physical access. If your scenario enables you to take precautions like choosing a stronger password, using a duress PIN, disabling the USB port, etc. you should absolutely do so.

By the way, making electronics tamper evident is probably easier at the hardware level. I think you may find this guide interesting: https://www.anarsec.guide/posts/tamper

jcom

AcclaimSublevel19 Fantastic links, thank you! Haven comes as close to solving the original problem with software as I think one can realistically get. There are certainly ways it could be defeated, but it definitely raises the level of effort to do so substantially. The tamper protection stuff is great as well, that entire site looks to be an excellent rabbit hole to go down. Thanks a lot for the post.

MetropleX

AcclaimSublevel19 Haven was last updated in 2021 and is effectively abandonware.

Like Hardware Kill Switches this approach is literally closing the door after the horse has bolted.

Bob would be best doing practical things such as factory resetting or changing his pin. If they have access to it just consider it exploited and be sure to remove sensitive data before it is left.

Don't be like Bob or use some deprecated panacea is the best advice.

AcclaimSublevel19

I'm glad you found it useful! By the way that site is where I first learned about GrapheneOS 😁

Murcielago

jcom

This is less about preventing the access from occurring or safeguarding any data than it is about knowing with absolute certainty that the device wasn't accessed while left unattended, if that makes sense.

Is it possible to setup a hidden camera to detect / rule out device access?

jcom

Murcielago Bob doesn't totally control the space where the device must be left unattended unfortunately, it's not a place where he could set up and secure a camera.

Murcielago A better metaphor: You think your wife may try to poison you with arsenic. You could take the coffeemaker to bed and sleep with your arm around it. You could throw out all coffee and never drink it again. Or, you could test the mug you're about to drink each morning for arsenic so you know it hasn't been adulterated. That's basically the objective

DeletedUser622

Watermelon You're assuming that the device you return to is still the device you expect it to be physically, but with potentially tampered software/data. This assumption is unfounded.

Can be another smartphone of the same model.

Watermelon

DeletedUser622 another smartphone of the same model

That would be one kind of a “fake device” as I called it.

Murcielago

jcom

Given this scenario, Bob seeks a purely technical approach to detecting any access to his unattended device after the fact. Hindering or mitigating the impact of that access would be lovely, but Bob accepts that physical access + PIN is catastrophic and just wants to know that access potentially occurred.
[...]
This is less about preventing the access from occurring or safeguarding any data than it is about knowing with absolute certainty that the device wasn't accessed while left unattended, if that makes sense.

Unfortunately, I still don't quite understand why you prioritize monitoring access to your device instead of preventing it in the first place.

That's like setting up a security camera in your house to film burglars stealing your valuables instead of putting good locks on the door to prevent that from happening.

name22222

jcom

I am not a software engineer in any way, but isn't there surely some kind of available "rootkit" I have come to be informed of that would allow you to send any kind of signal anywhere based on any kind of event (such as access)?

I sadly can't tell bob that there's a trusted rootkit for him to download to his phone. Perhaps Bob could buy an identical phone and do it on that. That would cost a lot of money though.

« Previous Page