Schneier on Security

Clive Robinson • August 30, 2023 1:35 PM

@ y_flores, ALL,

Re : You can not stop what you do not see.

“And something Apple says they do for everything in their app store.”

Only we know two things,

1, Apple take about 30% of the value.
2, Apple repeatedly fail to detect malware in that walled garden of theirs.

Now back a long time ago when “code signing” was newish I’d thought through how I would go about attacking it. At every stage I found vulnerabilities and most but by no means all have since been used.

As far as I’m aware my conversations on why “code signing” was a bad idea with @NickP are as far as I’m aware still up on this site, so you can go back and check.

Appart from over zellous corporate profits, walled gardrns off the developer nothing and the user not much more.

If we as an industry had actually thought about things in the last decade and a half, maybe we would have come up with a better solution.

But the mega corps of silicone valley actually do not want a better solution. To then “code signing” saves them billions and makes billions as well because now they can just get you to “download” not just apps but patches, as well as effectively pushing auto-upgrades that many find undesirable (the recent Win 11 fail being just the latest). Then there is that near a third probably illegal profit they make as well…

But as was seen with the FTD USB to Serial chip driver update, many can have their working systems bricked by other people via auto-updates. And more recently the string of “supply chain” attacks have not helped improve confidence, in fact the very opposite.

We need better, but we’ve been encoraged not to think how to go about it…

Clive Robinson • August 30, 2023 10:33 PM

@ Q, ALL,

“A night mode program doesn’t need network access. And it won’t need “security” updates if it doesn’t have network access.”

Not quite true, you should say,

“if the system doesn’t have network access.”

If the system has network access through the OS then the entire system and all that’s on it is still vulnerable, as you can “end run” any security measures at or below the OS level.

People tend to forget that if you have an application on your system and if an attacker can get even quite limited access to the system communications –say via MITM– then the attacker can in both theory and practice replace the application with a vulnerable version.

It has been done in the past yet people appear to have not “learnt from the past” something the ICTsec industry suffers badly from.

I’ll leave it to others to decide if it’s down to,

1, Poor Education
2, Collective Amnesia
3, Cognative bias

But the simple fact is that “communications hole” is still open in one way or another.

In the past I’ve demonstrated how to “modify a driver” this way as part of what we used to call a “shim attack” but would now call it a “supply chain attack”. The name or specific method realy do not matter, what we have to know is,

1, The existing app can be replaced.
2, It can obviate code signing.
3, The user probably won’t notice.
4, It requires some level of communications.

All we realy need to know here is that there are several ways in which it can be done, but ONLY with “communications” of some kind.

So you need to “kill communications” by hard “segregation” unless you absolutely must have some communications. In which case I would recommend a “sacrificial communications end point” approach using two seperate devices as I have talked about in the past.