Hardware security

[stevenc99]

Hi! A few questions about the security (or potential trustworthiness) of the hardware itself. Much of this is probably not possible, but I'm just trying to get some ideas:

1. is the START button attached to one of OMAP5's SYSBOOT[3:0] pins - holding that button at power-on boots the MLO from USB/UART/SD instead?

that's neat, as it allows to unbrick a device if the MLO bootloader on the internal eMMC is corrupted, or to restore a trustworthy bootloader if you suspect it is infected with malware.

2. is there any way to make that default, like with a jumper or solder link, to always boot from SD?

3. is there any way to do the opposite, to *disable* booting from SD, like with an internal screw, jumper or solder link?

otherwise - it would be super easy to carry out an 'evil maid' attack on the Pyra - insert specially crafted SD card, hold START and power on, and the bootloader and/or OS on internal eMMC can be infected in no time at all, without disassembling anything.

4. is there an easy way to write-protect the eMMC, or disable it altogether? even if it involves permanently cutting through a solder track?

I'm really thinking of Joanna Rutkowska's talk at 32C3, "state considered harmful" and her paper http://blog.invisiblethings.org/2015/10/27/x86_harmful.html - hardware might be more secure and trustworthy if you can reliably write-protect or remove all of its internal storage.

4. if there is a built-in mic, can that be physically disconnected too? and the speakers? or are they easily detachable from the board?

5. is there any other flash memory in the Pyra? I know the modem chip has a reflashable firmware. and the eMMC likely has more internal flash than it exposes as disk blocks.

 

[TrashyMG]

@hns is prob the only one that can answer most of these questions until the design is released.
I know for sure the START button is just another button in the keyboard matrix handled by the TCA8418 keymat to i2c chip... The power button may be what you're talking about.

 

[Askarus]

4. if there is a built-in mic, can that be physically disconnected too? and the speakers? or are they easily detachable from the board?

I don't see why you should not be able to desolder the microphone.

For booting:
You can choose if you want to boot from the internal microSD or Nand flash.

For security:
Simple put your OS onto the microSD and boot from it.
Don't see any reason why you should not be able to encrypt it.

And to be perfectly secure: Simply put your data onto the SD-Cards and the OS onto the micro sd-card and remove them whenever you give your Pyra away (or only use them if you need to).

that's neat, as it allows to unbrick a device if the MLO bootloader on the internal eMMC is corrupted, or to restore a trustworthy bootloader if you suspect it is infected with malware.

At least the Pandora is unbrickbar.
You can always reflash the NAND or restore the bootloader.

 

[rygD]

To answer all your questions of "can this thing be physically disconnected" the answer to all of them is yes. As you mentioned, in some cases you may need to cut traces or otherwise remove it.

 

[Neelix]

4. if there is a built-in mic, can that be physically disconnected too? and the speakers? or are they easily detachable from the board?

If I understand correctly the speakers are not physically attached to the board to begin with, they are held in place by the case, and connected through spring contacts.

-Neelix

 

[Grench]

So - I have this great handheld computer and I made it super secure. I disabled the microphone by drilling a hole through it. Since speakers are essentially microphones run backwards, I pulled them out. So I don't have to trust internal memory, I cut the traces on the eMMC. I didn't want anyone to be able to load data through card slots or USB - so those are gone as well. We've all seen the spy shows where someone will figure out a pass code by examining the wear pattern on buttons, so I removed the keymat. Wireless networking isn't secure enough so I pulled the antenna and wrapped the whole case in a Faraday cage. Some portions of the HDMI spec are bi-directional so I used a chisel and a hammer to remove the port. I read an article where people can figure out what is on your monitor by the RF interference pattern that it generates so I used the hammer again to scramble it. All that went well, but the thing doesn't work anymore so I'll need an RMA number please?

Open platforms are inherently more secure than most. Encryption can be useful, though the act of encrypting data makes your data 'interesting' by default. At some point, though, we all need to have some element of trust in our electronics platforms. It is that or use a pen, paper and a stamp. Depending on where you're at, it can be more difficult for law enforcement get authorization to open a hand written addressed and stamped envelope than to confiscate a computer. Bureaucratic restrictions can sometimes be more effective than technological ones.

 

[levi]

There's a reason why the password schema Diceware recommends the use of real dice to set a passphrase, but I do fall back to the computer when it comes to implementing the cyphers used to encrypt my text and communications.

 

[Djoga'Ro]

What do we do, when quantum computing becomes a thing, rendering passphrases useless? Will the Pyra user be prepared? What comes after qc? Can we get there first, before qc?

 

[TrashyMG]

What do we do, when quantum computing becomes a thing, rendering passphrases useless? Will the Pyra user be prepared? What comes after qc? Can we get there first, before qc?

Well Quantum went out of business unfortunately even with their beloved Bigfoot line of HDDs...

 

[ible]

not everything can be easily cracked by a quantum computer, just encryption based on factoring large numbers...

 

[stevenc99]

At some point, though, we all need to have some element of trust in our electronics platforms.

People will draw that line in different places. I'm not suggesting people buy a Pyra then cripple it. I'm trying to figure out how easily it can be adapted for particular needs, because some people's security needs or desires will be greater than yours.

Some might like to have location anonymity at times, and some have already said being able to kill power to the modem is a nice feature, better than leaving the Pyra at home or it never having mobile Internet at all.

If you take the Pyra to a hacker conference, and you know it could be infected with malware with 10 seconds of physical access, you might like to figure a way to defend against that possibility. Similarly, leaving the device at home instead, makes it less useful.

If you acquired a second-hand unit, you might want to ensure it's in factory-default state before saving passwords or encryption keys on it. In many laptops, malware can persist in flash chips and require disassembly and a re-flash to erase it. It seems with the Pyra it may be as simple as inserting an SD card and pressing two buttons, an excellent feature for users who care about that.

If you have deep understanding of the device you could feel confident it is not bugging your private conversation. But if the mic is on spring contacts and removable, you could remove it and not have to worry about it either way. That's a feature, it allows to have more security without permanently crippling the device, and might make the Pyra more attractive to an investigative journalist for example.

So some of these are really trivial things but to some people they could matter a lot.

 

[Silent-Hunter]

Well Quantum went out of business unfortunately even with their beloved Bigfoot line of HDDs...

Did they? I'm seeing them still. http://www.quantum.com/

 

[TrashyMG]

Did they? I'm seeing them still. http://www.quantum.com/

I guess they just sold their Storage business, however they've been pretty out of the view of the rest of the industry for some time now.

 

[Silent-Hunter]

I guess they just sold their Storage business, however they've been pretty out of the view of the rest of the industry for some time now.

I did have one of their drives ages ago, it lasted a long time. In fact it never actually broke I just stopped using it.

 

[stevenc99]

What do we do, when quantum computing becomes a thing, rendering passphrases useless? Will the Pyra user be prepared? What comes after qc? Can we get there first, before qc?

Passphrases are quite useless already. For authentication, we've been moving toward Elliptic Curve, but it may be broken post-QC, and we widely use RSA, which might be broken even sooner. If you want to see some ideas for post-QC strong algorithms, you could look at: https://events.ccc.de/congress/2015/Fahrplan/events/7210.html

Disk encryption... is actually not much affected by QC I think. For Pyra users who do that, I think an "evil maid" attack or bootloader malware would be a much quicker way to break it anyway.

 

[comradekingu]

So if you have an SD card that boots up into some jtag mode, print the uboot settings and checksum the executable, you would know the state it is in. (?)

And if your install is encrypted and lays claim to the whole internal storage space, it wouldnt be impossible to wipe it, but then you would know.

 

[stevenc99]

So if you have an SD card that boots up into some jtag mode, print the uboot settings and checksum the executable, you would know the state it is in. (?)

If you can boot from an SD card you trust, yes you could use that to read the internal eMMC, verify checksums and reflash if necessary. That may be the best defence the Pyra offers against "evil maid", and that is a way easier procedure than with most laptops, which unconditionally boot from internal SPI flash *before* you can boot from any external drive (malware could already be running while you try to verify or reflash).

And if your install is encrypted and lays claim to the whole internal storage space, it wouldnt be impossible to wipe it, but then you would know.

Disk encryption can protect the integrity of the OS, as long as you've verified everything in the boot process before unlocking the disk - probably the bootloader, kernel and initramfs.

You could forget about using the eMMC and use *only* removable SD for the bootloader and OS if it is fast enough.

Where it gets really complicated though, is that SD cards or eMMC each contain a processor and firmware, which could be made to lie and return something different at boot than what it allows you to read/write later on. Disk firmware implants (malware) we now know were the state-of-the-art of some Nation State Attacker's tradecraft a few years ago, but hopefully most of us won't be a target of those. There still might be ways to address those risks, but it's late and I'm tired... most of you will just play games on the thing anyway

 

[rygD]

If you take the Pyra to a hacker conference, and you know it could be infected with malware with 10 seconds of physical access, you might like to figure a way to defend against that possibility. Similarly, leaving the device at home instead, makes it less useful.

That seems like it would be one of the worst places to leave your Pyra sitting around or handing it off to people. I guess a worse place to leave it would be in the middle of a street with heavy automotive traffic, or at the bottom of the ocean (insert Pyrate joke).

 

[stevenc99]

That seems like it would be one of the worst places to leave your Pyra sitting around ...

Although this is where the Pyra is niche: I *have* to leave my laptop unattended in lots of places, because it's usually charging, and doesn't fit in any of my pockets. The Pyra's portability is a physical security feature in itself.

 

[rygD]

I *have* to leave my laptop unattended in lots of places, because it's usually charging, and doesn't fit in any of my pockets.

I am talking about in public. If you are too then I think you might be asking the wrong questions in this thread. I never leave my laptops unattended in public. If they are dead, oh well.