I understand having a locked-down version of mass-produced tech that is for the general consumer. However, I also firmly believe that anyone who wants to should be able to bypass that. Make it void the warranty, don't allow customer support, whatever you want. But make it a free option to have complete control. If I buy a piece of hardware, I should own it.
(I say this as I am currently charging a cheap doorbell camera I bought, so that I can start dumping data from it and reverse engineer its protocol, solely so that I can lock it down to my local network...We needed something at the time, or I would have bought something more expensive that had an open protocol...)
> Make it void the warranty, don't allow customer support, whatever you want.
That would be a regression in terms of consumer rights, in my opinion. I don’t see why the EU shouldn’t legislate such that the right to control owned hardware becomes fundamental.
Technically, even in the US a warranty is only void if it's caused by something the consumer did; a 1 year warranty for production defects can't be voided.
Although I think it's fair that the company not have to deal with a defect that is almost certainly caused by something you do to your device. Like, strawman, but early iPhones sometimes encountered issues while doing an untethered jailbreak, or people would install tweaks that were less than stable (even sometimes on relatives' or friends' phones), then they would walk into an Apple Store with weird behavior and expect the fix to be free. That shouldn't be covered by warranty.
In large, powerful and potentially dangerous machines, the firmware may embody safety features. Like preventing dangerous doses of radiation or overspeed conditions on motors or overcharging of batteries.
Why should you have a right to operate the device in a dangerous way that the manufacturer engineered to prevent?
You may be happy to injure yourself and to disclaim your right to warranty but the manufacturer could suffer immense reputational damage if, say, your hacking the firmware of their humanoid robot results in it tearing off your head.
That reminds of this company that used to provide a body implant for people with certain issues. The company ended up closing down and had to go in and remove those implants from those people.
Those people rightfully were like why can’t we keep it and the company was like we have to run the services to manage it. Why not just open up the hardware and let it continue being used? Well if you put the wrong software and it ends up killing the person, the hardware company can be held liable.
Made me realize my dream of having an open-source car is never going to happen.
All the ECU reprogramming "tuners" have been treating cars like open source for a while now. Any old car has a limited amount of SW too, and people have simply switched parts around and hacked them however they see fit.
Basically, we already live a reality where dangerous machines like cars have been hacked and are operated on the street among us.
This is the same argument that was being made that FOSS is less secure because it's open in the 90s or 2000s. Yet the most of critical infra today runs on open source.
Don't you think it'd be safer if these tuners had access to the source code?
From the perspective of a researcher: there is a clear 'yes'. Void the warranty, make sure all certification for operarion is invalid.
That is to a certain point. If deemed misuse would be harm against other people or circumvent export control. You may also restrict, who is allowed to do it. However, if software is the only protection against dual-use, tler might have a general problem.
When people get a tool, they can perfectly well hurt themselves with it.
But at the same time, risk profiles between different tools are different, and it is common to have special rules for some of them. Eg. guns already do.
While we might need to stop an unlicensed SW engineer to accidentally or purposely turn your housekeeping robot into a killer robot, the risk of them messing up their fridge is lower. Yes, your food could spoil and kill you, but your fridge could face a power cut and do the same.
So establish which devices have a higher risk and limit changes to those with more expertise — if it means licensed engineers, so be it.
> So establish which devices have a higher risk and limit changes to those with more expertise — if it means licensed engineers, so be it.
I think the main thing to grapple with is the idea that even laypeople who aren't security or SWE experts may want to protect against the highest risk profile possible, even if they don't personally understand what they're giving up. (And, for most of these people, I imagine they're giving up a freedom they might not have ever thought of using in the first place)
Strawman but, If you want to make a device called "securePhone 2027", where not even an evil maid attacker (say, a national security agency who has spied on you over your shoulder for 180 days and has thus seen all of your passwords) can install spyware on your phone, what sort of qualifications do you need to have in order to purchase (or qualifications for a manufacturer to sell) such device?
Part of the issue in arguments like this is in saying that, because the iPhone is the most popular phone in the United States, they should be forced to compromise on security because enough buyers aren't aware of the compromises they're making in order to have the iPhone. So if you still want companies to be able to sell a brick that never runs unsanctioned7 code, you either need
(A) setting an upper bounds (market share?) to how big a company can get before they must compromise on security and allow people to self-compromise via going through multiple hoops to disable security protections (e.g. disabling SIP on a Mac).
(B) means-testing that the customer understands that what they're buying could compromise their security
(C) some key ceremony for allowing said device to be unlocked. I imagine a 1 month waiting period plus needing to show passport and proof-of-non-coercion across multiple nation-states could work? maybe only if they're not apart of a shared intelligence network coallition (like five/nine/fourteen eyes)?
The fact that the iPhone is incredibly resistant to all forms of widespread malware is really good for society at large. Like, the only known widespread malware (outside of web-based scams calling Alert("Apple has compromised your device, call this number")) has been developer-distributed malware due to chinese developers releasing apps via a malicious unsigned Xcode app [0].
I am not saying it is easy, but an open device can still leverage a secure element, sandbox any applications and have granular permissions.
Just like PKI infrastructure, vendors could embed and tie into a TPM similar key infrastructure that would be the only part you couldn't touch (key storage + key validation and signing implementation so it can't be tampered with). I mean, even there the code could be open and only the key material would be secret.
There are a lot of devices where I agree with you, but smart glasses are an appliance category where this categorically needs to be considered a vulnerability. The main thing that currently stands between them being truly amazing and useful (e.g. for people with impaired vision or hearing) and a spying/peeping tool is the firmware on the device.
Smartglasses have an amazing potential to improve lives when done right and used right. But that relies on a sophisticated sensor hardware package that is barely distinguishable from a covert recording tool, simply because of the reality of the problem space. I don't want to see that tech totally canned as assistive technology because of backlash.
I think this is an area where society is going to adjust to fit the technology. The idea that you can not be recorded in places where eyeballs can see you is going to seem pretty quaint before long. Uncomfortable to our sensibilities, but probably not uncomfortable after the next few generations.
I am a proponent of giving users an option to root their devices through a one-way process that would surrender warranty coverage and print a big safety warning at every boot.
The problem with allowing easy shell access is that any arbitrary command execution would be used by exploits, too. There are also a lot of social engineering schemes that bait users into running commands on devices. We don’t think about these risks as engineers, but you wouldn’t believe how many people will follow instructions to open something like the Chrome developer console and paste code blocks into it because some website told them to.
So a secure device is also a locked down device. Getting a shell is a vulnerability because it’s the avenue that exploits would use.
That’s why I’d be in favor of a one-way developer mode, which provided shell access but printed a big unavoidable warning screen in the boot loader.
Unfortunately, it’s not that simple. Asking people to give up their warrant isn’t legal, generally, so outside of very specific circumstances you have to cover warranty claims on the device, too. I have worked at companies that tried to offer some developer access like this, and the number of people abusing customer service because they got in over their heads with modifications and wanted a fresh unit or want CS to support their mods would make you face palm. So the compromises end up being things like only allowing ephemeral mods that get wiped at each reboot and other default-safe behaviors, but that doesn’t make people happy either.
Following the reasoning behind the magnuson-moss act, it should not automatically void the warranty. That puts users who want software freedom at a financial disadvantage.
I agree some big obvious scare message is good but actually voiding the warranty restricts user freedom.
> Following the reasoning behind the magnuson-moss act, it should not automatically void the warranty. That puts users who want software freedom at a financial disadvantage.
Only thing is, if the company releases software updates to fix issues, they should by no means be expected/required to backport bug fixes to older versions just so that compromised devices can. There are certain warranty claims where the issues would be solved via software update, but thus are unavailable to people who are insistent on staying on a rootable version of the firmware.
At some point in the software as a service world (driven by web apps), we started accepting that a manufacturer can break the software we use (change it so it does not have the same features or even just UX we are used to), and is now mandated to provide security maintence but can still do that by simply forcing a customer to their new version.
I understand the economics of this, but this is why I loved LTS releases and their commitment to backport security vulnerability fixes.
Hopefully with GenAI, companies sprout that will support this for consumers too!
This is a very neat and approachable write-up, but is the final result really a hack? If I understand correctly, you're getting an unprivileged shell on a device you own and have paired with your smartphone; more or less equivalent to installing a terminal emulator on your smartphone, except it's smart glasses in this case.
Should the ability to own one's devices really be treated as a vulnerability and reported to security teams?
"hack" on hackernews essentially means "I used my computer to do something". The overwhelming population of people here aren't security engineers, but rather developers.
Sure but nowadays can you get unprivileged shell to your smartphone no matter the brand and model? Your TV? Your car infotainment system? Your smart fridge? I can continue on and on.
Actually having unprivileged access to something is quite rare nowadays in non-strictly computer products nowadays.
How is it not a hack to do something on a device that doesn't let you do it? Yes, the device should let you do whatever you want, but it doesn't, therefore this is a hack.
I'm going to try it on my glasses, and disable autoupdating ASAP.
Maybe I’ve still got the old PS3/PSP-exploit mentality, but reporting an arbitrary code execution vuln to the OEM is kind of sad… that deliberately closes a door for people to use their devices as they see fit.
Of course, the “don’t update after this firmware version” bit would always be the case (since any widely-distributed such vuln will be patched eventually), but deliberately moving the timeline to the left is sad.
So many things are done with the end of making some profit, either directly monetary (bounties) or career.
People like these hope to get the recognition by the big companies to get the fat paychecks they dream to also pull in.
On the other hand, many others hack stuff and at most tell their closest friends.
Of course, it's availability bias: if this person wasn't disclosing it somehow, you wouldn't know. And even just a random article online is basically a disclosure minus the other benefits, so people contact the OEM while they are at it.
> "I used android.media.ToneGenerator in my DAT APK to signal which part of the code was executing:"
I've heard that morse code allows for easier debugging than beep counting, if you have to use audio. Not had a chance to put it into practice myself, but since digits especially are simple in morse code, it might be useful to someone
Regardless of the exploit, I wonder if there's a market for similar looking smartglasses that let you do whatever you want. Some competition in the space would be good for inviting regulation.
The non-displaying kind is just Bluetooth headsets with cameras and some hype. There are plenty of cheap knockoffs for those.
The display kind is full of exotic parts, materials and manufacturing techniques. Building those is not a product design problem but funding and engineering problems.
I haven't even seen a market for these, much less something that takes more work. It's probably hobby level at best to a very select hacker-focused crowd, but even they have historically been anti-sousveillance.
It's really sad that getting a shell on a device you own is now considered a vulnerability.
I understand having a locked-down version of mass-produced tech that is for the general consumer. However, I also firmly believe that anyone who wants to should be able to bypass that. Make it void the warranty, don't allow customer support, whatever you want. But make it a free option to have complete control. If I buy a piece of hardware, I should own it.
(I say this as I am currently charging a cheap doorbell camera I bought, so that I can start dumping data from it and reverse engineer its protocol, solely so that I can lock it down to my local network...We needed something at the time, or I would have bought something more expensive that had an open protocol...)
> Make it void the warranty, don't allow customer support, whatever you want.
That would be a regression in terms of consumer rights, in my opinion. I don’t see why the EU shouldn’t legislate such that the right to control owned hardware becomes fundamental.
Technically, even in the US a warranty is only void if it's caused by something the consumer did; a 1 year warranty for production defects can't be voided.
Although I think it's fair that the company not have to deal with a defect that is almost certainly caused by something you do to your device. Like, strawman, but early iPhones sometimes encountered issues while doing an untethered jailbreak, or people would install tweaks that were less than stable (even sometimes on relatives' or friends' phones), then they would walk into an Apple Store with weird behavior and expect the fix to be free. That shouldn't be covered by warranty.
In large, powerful and potentially dangerous machines, the firmware may embody safety features. Like preventing dangerous doses of radiation or overspeed conditions on motors or overcharging of batteries.
Why should you have a right to operate the device in a dangerous way that the manufacturer engineered to prevent?
You may be happy to injure yourself and to disclaim your right to warranty but the manufacturer could suffer immense reputational damage if, say, your hacking the firmware of their humanoid robot results in it tearing off your head.
That reminds of this company that used to provide a body implant for people with certain issues. The company ended up closing down and had to go in and remove those implants from those people.
Those people rightfully were like why can’t we keep it and the company was like we have to run the services to manage it. Why not just open up the hardware and let it continue being used? Well if you put the wrong software and it ends up killing the person, the hardware company can be held liable.
Made me realize my dream of having an open-source car is never going to happen.
All the ECU reprogramming "tuners" have been treating cars like open source for a while now. Any old car has a limited amount of SW too, and people have simply switched parts around and hacked them however they see fit.
Basically, we already live a reality where dangerous machines like cars have been hacked and are operated on the street among us.
This is the same argument that was being made that FOSS is less secure because it's open in the 90s or 2000s. Yet the most of critical infra today runs on open source.
Don't you think it'd be safer if these tuners had access to the source code?
That never made sense to me, if a company is closing you can't sue it because it no longer exists.
From the perspective of a researcher: there is a clear 'yes'. Void the warranty, make sure all certification for operarion is invalid.
That is to a certain point. If deemed misuse would be harm against other people or circumvent export control. You may also restrict, who is allowed to do it. However, if software is the only protection against dual-use, tler might have a general problem.
[dead]
When people get a tool, they can perfectly well hurt themselves with it.
But at the same time, risk profiles between different tools are different, and it is common to have special rules for some of them. Eg. guns already do.
While we might need to stop an unlicensed SW engineer to accidentally or purposely turn your housekeeping robot into a killer robot, the risk of them messing up their fridge is lower. Yes, your food could spoil and kill you, but your fridge could face a power cut and do the same.
So establish which devices have a higher risk and limit changes to those with more expertise — if it means licensed engineers, so be it.
> So establish which devices have a higher risk and limit changes to those with more expertise — if it means licensed engineers, so be it.
I think the main thing to grapple with is the idea that even laypeople who aren't security or SWE experts may want to protect against the highest risk profile possible, even if they don't personally understand what they're giving up. (And, for most of these people, I imagine they're giving up a freedom they might not have ever thought of using in the first place)
Strawman but, If you want to make a device called "securePhone 2027", where not even an evil maid attacker (say, a national security agency who has spied on you over your shoulder for 180 days and has thus seen all of your passwords) can install spyware on your phone, what sort of qualifications do you need to have in order to purchase (or qualifications for a manufacturer to sell) such device?
Part of the issue in arguments like this is in saying that, because the iPhone is the most popular phone in the United States, they should be forced to compromise on security because enough buyers aren't aware of the compromises they're making in order to have the iPhone. So if you still want companies to be able to sell a brick that never runs unsanctioned7 code, you either need
(A) setting an upper bounds (market share?) to how big a company can get before they must compromise on security and allow people to self-compromise via going through multiple hoops to disable security protections (e.g. disabling SIP on a Mac). (B) means-testing that the customer understands that what they're buying could compromise their security (C) some key ceremony for allowing said device to be unlocked. I imagine a 1 month waiting period plus needing to show passport and proof-of-non-coercion across multiple nation-states could work? maybe only if they're not apart of a shared intelligence network coallition (like five/nine/fourteen eyes)?
The fact that the iPhone is incredibly resistant to all forms of widespread malware is really good for society at large. Like, the only known widespread malware (outside of web-based scams calling Alert("Apple has compromised your device, call this number")) has been developer-distributed malware due to chinese developers releasing apps via a malicious unsigned Xcode app [0].
0: https://youtu.be/tJeEuxn9mug?t=1502
I am not saying it is easy, but an open device can still leverage a secure element, sandbox any applications and have granular permissions.
Just like PKI infrastructure, vendors could embed and tie into a TPM similar key infrastructure that would be the only part you couldn't touch (key storage + key validation and signing implementation so it can't be tampered with). I mean, even there the code could be open and only the key material would be secret.
(I find revocation a harder problem, really)
[flagged]
There are a lot of devices where I agree with you, but smart glasses are an appliance category where this categorically needs to be considered a vulnerability. The main thing that currently stands between them being truly amazing and useful (e.g. for people with impaired vision or hearing) and a spying/peeping tool is the firmware on the device.
Smartglasses have an amazing potential to improve lives when done right and used right. But that relies on a sophisticated sensor hardware package that is barely distinguishable from a covert recording tool, simply because of the reality of the problem space. I don't want to see that tech totally canned as assistive technology because of backlash.
I think this is an area where society is going to adjust to fit the technology. The idea that you can not be recorded in places where eyeballs can see you is going to seem pretty quaint before long. Uncomfortable to our sensibilities, but probably not uncomfortable after the next few generations.
I am a proponent of giving users an option to root their devices through a one-way process that would surrender warranty coverage and print a big safety warning at every boot.
The problem with allowing easy shell access is that any arbitrary command execution would be used by exploits, too. There are also a lot of social engineering schemes that bait users into running commands on devices. We don’t think about these risks as engineers, but you wouldn’t believe how many people will follow instructions to open something like the Chrome developer console and paste code blocks into it because some website told them to.
So a secure device is also a locked down device. Getting a shell is a vulnerability because it’s the avenue that exploits would use.
That’s why I’d be in favor of a one-way developer mode, which provided shell access but printed a big unavoidable warning screen in the boot loader.
Unfortunately, it’s not that simple. Asking people to give up their warrant isn’t legal, generally, so outside of very specific circumstances you have to cover warranty claims on the device, too. I have worked at companies that tried to offer some developer access like this, and the number of people abusing customer service because they got in over their heads with modifications and wanted a fresh unit or want CS to support their mods would make you face palm. So the compromises end up being things like only allowing ephemeral mods that get wiped at each reboot and other default-safe behaviors, but that doesn’t make people happy either.
Following the reasoning behind the magnuson-moss act, it should not automatically void the warranty. That puts users who want software freedom at a financial disadvantage.
I agree some big obvious scare message is good but actually voiding the warranty restricts user freedom.
> Following the reasoning behind the magnuson-moss act, it should not automatically void the warranty. That puts users who want software freedom at a financial disadvantage.
Only thing is, if the company releases software updates to fix issues, they should by no means be expected/required to backport bug fixes to older versions just so that compromised devices can. There are certain warranty claims where the issues would be solved via software update, but thus are unavailable to people who are insistent on staying on a rootable version of the firmware.
I think a case could be made that they should.
At some point in the software as a service world (driven by web apps), we started accepting that a manufacturer can break the software we use (change it so it does not have the same features or even just UX we are used to), and is now mandated to provide security maintence but can still do that by simply forcing a customer to their new version.
I understand the economics of this, but this is why I loved LTS releases and their commitment to backport security vulnerability fixes.
Hopefully with GenAI, companies sprout that will support this for consumers too!
> bait users into running commands on devices. We don’t think about these risks as engineers
As an engineer, you wouldn't believe how many times I've recently used `curl | bash` to install a piece of software
"They might do something stupid with it" is just authoritarian. You would take our sticks
When something goes wrong, they blame you. They don’t care if anything they did caused it.
> You would take our sticks
Did you just completely ignore the entire point of my comment where I said I advocate giving people developer access?
Have all the sticks you want, but don’t come crying to the company if you hurt yourself.
> Have all the sticks you want, but
No deal.
Okay but that's how so many systems including banking are set up to safeguard users
[flagged]
This is a very neat and approachable write-up, but is the final result really a hack? If I understand correctly, you're getting an unprivileged shell on a device you own and have paired with your smartphone; more or less equivalent to installing a terminal emulator on your smartphone, except it's smart glasses in this case.
Should the ability to own one's devices really be treated as a vulnerability and reported to security teams?
Manipulating a system to get unintended access is a hack under any common definition.
The intent of the owner of the artifact is the only consideration. The wish of some previous owner is irrelevant.
The part you’re missing is your assumption that only the owner of the artifact would attempt to get access to the system.
Yes. Assumptions are being made.
It sounds like I should be considered a criminal because someone else might indeed be a criminal and I disagree.
If the next argument is you are unable to tell the difference myself and the criminal, then that is on you not me.
"hack" on hackernews essentially means "I used my computer to do something". The overwhelming population of people here aren't security engineers, but rather developers.
I considered that, but the mentions of pwn2own and the bug bounty program have me thinking "hack" is used in the security/mainstream sense.
Hack as a term predates the concept of cyber security. It was originally "a quick and dirty solution that is clever"
https://en.wiktionary.org/wiki/hack
[dead]
Sure but nowadays can you get unprivileged shell to your smartphone no matter the brand and model? Your TV? Your car infotainment system? Your smart fridge? I can continue on and on.
Actually having unprivileged access to something is quite rare nowadays in non-strictly computer products nowadays.
How is it not a hack to do something on a device that doesn't let you do it? Yes, the device should let you do whatever you want, but it doesn't, therefore this is a hack.
I'm going to try it on my glasses, and disable autoupdating ASAP.
Maybe I’ve still got the old PS3/PSP-exploit mentality, but reporting an arbitrary code execution vuln to the OEM is kind of sad… that deliberately closes a door for people to use their devices as they see fit.
Of course, the “don’t update after this firmware version” bit would always be the case (since any widely-distributed such vuln will be patched eventually), but deliberately moving the timeline to the left is sad.
So many things are done with the end of making some profit, either directly monetary (bounties) or career.
People like these hope to get the recognition by the big companies to get the fat paychecks they dream to also pull in.
On the other hand, many others hack stuff and at most tell their closest friends.
Of course, it's availability bias: if this person wasn't disclosing it somehow, you wouldn't know. And even just a random article online is basically a disclosure minus the other benefits, so people contact the OEM while they are at it.
> "I used android.media.ToneGenerator in my DAT APK to signal which part of the code was executing:"
I've heard that morse code allows for easier debugging than beep counting, if you have to use audio. Not had a chance to put it into practice myself, but since digits especially are simple in morse code, it might be useful to someone
Nice. How robust is this with software upgrades though? Also looks like arbitrary code execution in the app sandbox, so no persistance?
Imagine shipping a firmware update to enforce APK signatures, only for the enforcement itself to be controlled by an unauthenticated config value
Regardless of the exploit, I wonder if there's a market for similar looking smartglasses that let you do whatever you want. Some competition in the space would be good for inviting regulation.
The non-displaying kind is just Bluetooth headsets with cameras and some hype. There are plenty of cheap knockoffs for those.
The display kind is full of exotic parts, materials and manufacturing techniques. Building those is not a product design problem but funding and engineering problems.
I haven't even seen a market for these, much less something that takes more work. It's probably hobby level at best to a very select hacker-focused crowd, but even they have historically been anti-sousveillance.
(dupe) https://news.ycombinator.com/item?id=50406224
That's this thread. Did you mean to link another?
HN does post merges sometimes. Could be that?
[flagged]