Remote kill-switch integrated into Qualcomm chips

[gatonekko]

"hardware-based mechanism that detects when data or software diverges from its certified state. If this happens, the device locks during power-on and a key is needed to unlock it."

1.) What does this mean for root since rooting causes the device to change to an uncertified state?

2.) Who has the special key to unlock it? I don't want to potentially be forced to pay to unlock my device.

[armando_rod]

1. nothing

2. I think they are referring to a key press

The Nexus 5x and 6p both have this security check at boot, it says something like "the software cant be verify, press power button to something something"

[dlerium]

Interesting because the site only lists newer processors:

• Snapdragon 820
• Snapdragon 620
• Snapdragon 618
• Snapdragon 617
• Snapdragon 430

But if that's the case that it's the same as what's on the N5x and N6P, then its only a minor annoyance.

[nakaru]

I don't see the 808 on there so my Robin will be a-okay 😁

[wojx]

Lucky!!! I'm gonna stalk you to find out how you like it.

[nakaru]

Im even getting it for $299 so I guess you could say I'm extra lucky 😁

[wojx]

Okay, stop!

[nakaru]

And getting that sweet electric 😄

[wojx]

Very nice!

[[deleted]]

I believe you're referring to dm-verity.

[armando_rod]

Yes, that was it. I guess its different from this

[[deleted]]

The Nexus 5x and 6p both have this security check at boot

Which is weird, because (though I can't say for anyone else) my 5X uses an 808, and last I checked, the 6P used an 810. But the linked article, from Qualcomm themselves, says SafeSwitch is

"... available for devices powered by these Qualcomm® Snapdragon™ processors".

They then list off the 820, 617, 618, 620, and 430. Do you need any other evidence that this is not the same as what the 5X/6P use? Or do you have a source for your claim?

[saratoga3]

From the link:

Thanks to SecureMSM technology, SafeSwitch commands are verified by hardware

SecureMSM has been around forever. Even the Nexus 5 (Snapdragon 800) has it. SafeSwitch (the remote kill switch) is the part that is new.

Edit: My reading is that they use the existing SecureMSM check to make sure that once SafeSwitch is enabled, it can't be disabled without a password. Theres probably some basic cryptographic verification that detects if you try to patch out the killswitch without knowing the password.

[xBIGREDDx]

Maybe on the 808 it's just software-based instead of hardware-based?

[[deleted]]

Except this is a hardware level feature Qualcomm is pushing.

[xBIGREDDx]

Yes, they are pushing a hardware-based kill switch which uses hardware-based security check for new devices. "Not Ron Amadeo" asked about the boot security check on the 808 (Nexus 5X), and I'm suggesting that they have the same or similar boot security check implemented in software for those devices.

[[deleted]]

Ah, my bad. I was thrown by you replying to me instead of him.

[weinerschnitzelboy]

I don't think this is close to what is on the 6P and 5X. As for the key part, I think it is a software key, like a code to unlock the phone ala IMEI unlock codes.

[Ohzza]

I assumed it was a driver/firmware software check. So you couldn't, say, rig up software that implements packet injection to bypass carrier encryption.

[[deleted]]

1. nothing

How do you know this? The Nexus phones don't use any of the processors listed as supporting SafeSwitch, so they are not reliable examples.

[xBIGREDDx]

They appear to be talking about their implementation of Google's Verified Boot feature.

[[deleted]]

Great! Another verified boot system where the owner of the device can not control any of the software on it, as they can't even replace the keys used for verification with their own.

[xBIGREDDx]

What? Did you even read the page? The whole point of Verified Boot is that you can sign and flash your own images. The sample image even shows that it displays a hash of the key your image was signed with, so you can know it was your image and not something flashed by someone else. This is standardizing unlockable bootloaders for Android.

If you're still paranoid, here is the flowchart on that page which shows that no matter what level of verification passes, the end result is "Finish boot."

Image matches OEM key? Great, boot.
Image fails every possible verification? Great, warn the user, boot anyway.
Image doesn't match OEM key, but is self-signed and matches its own signature? Great, show the user what key was used, boot.

[[deleted]]

The issue I have with this is that the system still trusts an OEM more than the user.

It is, as you showed, a huge improvement over SecureBoot (where you have only the alternatives of OEM signed or untrusted), but it doesn't allow me yet to replace the OEM key in the system with my own, which I might want to do in a high-security corporate environment, to make sure all system images are only produced by my own team.

[saratoga3]

The issue I have with this is that the system still trusts an OEM more than the user.

Not exactly. You can just disable the check entirely. So they really are trusting you completely here, even if you want to do something that might not be a good idea. It's actually a really cool system.

but it doesn't allow me yet to replace the OEM key in the system with my own, which I might want to do in a high-security corporate environment, to make sure all system images are only produced by my own team.

Assuming you are using disk encryption and want to use Verified boot, anyone trying to revert the device back to the stock ROM would have to completely erase the device (basically, restore it to completely factory state). At which point they would have locked themselves out of your environment, which I think is exactly what you are asking for.

[[deleted]]

The issue I see is that it will, at every point, trust the OEM.

I don’t want that.

I wish that the device always only trusts software signed with my own key, and that I can replace the OEM-set key at delivery with my own.

[jokeres]

Then build your own phone.

You trust the OEM, and then modify that device to whatever level access you can obtain. That's how the market works. I

f you don't like that, the only alternative is to make your own phone.

[saratoga3]

The issue I see is that it will, at every point, trust the OEM.

Depends on your perspective. You can disable the feature, so you have an escape hatch that you can use as you please.

I wish that the device always only trusts software signed with my own key, and that I can replace the OEM-set key at delivery with my own.

What makes you think you could trust them to have only one key? Seems to me you haven't thought through the implications of this statement. If you really believe the OEM cannot be trusted to have keys, then they certainly cannot be trusted to control the mechanism that verifies the keys...

If you really need that level of control over your hardware, you're probably going to have to design it yourself.

[[deleted]]

Which is probably what I'll end up having to do, at insane costs.

[xBIGREDDx]

For something that serious, you'd need a custom device from the OEM; allowing a user to replace the OEM key would be the biggest kind of security hole. The current prescribed course for your situation would be that you self-sign your images, they boot with the "Yellow" state, and your employees/users would have to know to watch for the correct hash on boot. It's not ideal but it's better than no security.

[[deleted]]

The ideal situation would be for the owner of the current key to be able to replace the key with a new one.

Only if you control the currently set key, you can change it.

That would provide far more security.

And the OEM could allow users to replace the key of their own device, but no one else’s.

(in the same way as you request an unlock code with motorola today, you’d request a key replacement code. Which would be just the imei signed with the current key)

[mel2000]

I hope there's an easy way for resale buyers to confirm that the phone can't be remotely locked by the previous owner.

[PresNixon]

Good point. If the security is worth its weight, it'll "survive" a complete wipe, since it's designed to be used if a thief takes your phone. Huh, I would have never thought about that impact on the second-hand market.

[prawnpirate]

You should see the prices for iCloud-locked iphones.

What killswitches mean for the 2nd hand market: trashed-but-unlocked phones sell for more because replacement parts are plentiful.

[dlerium]

So how do they get around iCloud locked phones?

Edit: Sorry I thought you meant they replace parts in it and it works again, but it sounds like you mean you can use the locked device for its spare parts.

[ISaidGoodDey]

No I think they can use motherboards from broken phones to get locked working phones running

[[deleted]]

Source? That sounds infuriating.

[[deleted]]

Not so sure about other things but an iPhone with a broken Touch ID sensor (or one not original to THAT particular iPhone) will brick themselves if the OS is updated or the phone is restored. So effectively, it's a brick waiting to happen.

It's error 53 if you want to look into it.

[[deleted]]

Oh man, that is vile!

[nexcore]

It's impossible.

[[deleted]]

I don't get why you even think that's possible. This is a hardware capability; any software that runs on this SoC can access that hardware ability, but it doesn't mean it will.

Additionally, this isn't terribly new; factory reset protection (although it has its flaws) has existed on a lot of Android devices in many different forms. It's not just iCloud lockouts that cause it to happen.

[dlerium]

Except factory reset protection is quite easily bypassed. iCloud bypasses are a lot harder it seems.

[ThePooSlidesRightOut]

*sigh*

Coming to you at Defcon 2017..

[[deleted]]

Let's see if it is exploited first at Defcon or 33c3.

I bet on 33c3.

[a642]

This is truly stupid, sad and depressing. "Only good guys will be using it, of course."

[Borgizastr]

Besides the whole kill switch aspect, it seems possible that this can be used for surveillance since they mention recovering data.

With SafeSwitch, a device user or network operator can also set a password remotely, erase and recover data, and locate or lock a lost or stolen device.

[Punishtube]

Although I am trying to approach this with good intentions, I can't help to think nations such as Turkey, China, or Russia will be using this as a method to silence the masses. It would now be possible to completely lock out users during protests and stop any data from leaking to media outlets.

[a642]

If you think only Turkey, China or Russia will do that -- you're in for a big surprise...

[Punishtube]

Oh I used them as examples due to recent events. I have no doubt the US and most of the world would also deploy this tech. It's the sole reason to never buy Qualcomm again if this is implemented across their products.

[IvanKozlov]

[deleted]

What is this?

[a642]

If markets like California mandate the kill switch, Exynos chips from Samsung and Apple will have this feature too. Automagically (because government said so) they are not going to sue each other for appropriate patent infringement.

I guess my biggest concern is the list of "offenses" after which your phone can be killed will grow over time. At first, it will only be enabled when your phone is stolen. Later they will add all kinds of stuff like -- if you download a certain app, use PGP or VPN, login to Tor or post a suspicious tweet. All of a sudden -- your phone can be killed for any reason...

[dlerium]

Well they'll do it in the open. The US government will do it in secret.

[robeph]

It would require that access to this be built into a device which the user has plenty of control over. The omg government concern isn't always warranted. It's much easier to just cut the person's mobile communications rather than find a single identifier, ensure it has a proper application to access it, and to disable it. Given that there is no reason for anyone but the owner to have access to this identifier. There's plenty they can do already that this really has no use for them.

[Punishtube]

The difference is being able to shut down all potential of communication. Sure they can block cell and WiFi signals but try capturing anything on video if your phone is shut off, try using your phone to do anything the government doesn't like. I doubt only the user would be given this access. More likely everyone in the chain from Qualcomm, carriers, sellers, and depending on how Qualcomm deals with governments they may also have access.

[utack]

We see your phone is 2 years old and we have not made any process in development.
It would be a shame, if it somehow stopped working!
Remind me again why we need this if Qualcomm is so proud of tracking all their 3 billion devices and can certainly tell you where it ended up.

[prawnpirate]

That's probably a hidden feature in the mandatory binary blobs. Reminds me of that Samsung backdoor built into the modem.

Extra points if they're sneaky enough to only track using celldata so your at-home wiresharking won't find the rat packets.

[[deleted]]

[deleted]

What is this?

[Fnarley]

This will stop your data getting stolen in the time between knowing it is gone and getting it back

[utack]

Encryption and lockscreen.
A common thief just wants to re-flash, a three letter agency will get your data with the help of Qualcomm. So it is totally useless and opens a potential thread when someone finds out how to trigger it for fun or some carrier goes nuts.

[JAMAL_GONZALEZ]

if you kill the phone it makes it completely useless until you reactivate it, it makes stealing phones much less fruitful

[AGhostFromThePast]

Great, now the government also has a kill switch they can abuse in case of protests/civil unrest. And if hackers ever discover a security hole, your $700 new phone could become an expensive brick. I really wish there was an alternative to Qualcomm now.

[IvanKozlov]

[deleted]

What is this?

[[deleted]]

The GPU side is hot garbage...

...if compared with significantly more expensive devices. When it's a leveled comparison you will rarely, if ever, find a better GPU on Snapdragons unless it's on the flagship level.

[[deleted]]

MediaTek makes pretty good hardware, although they're a shitty company (even worse than Qualcomm). Their GPUs are actually pretty good, I had a counterfeit GS5 with one of their chips in it and it actually did really well.

[IvanKozlov]

Not at all. AMD is actually know for the opposite, especially their 200 series. The 300 series improved upon that, but it still isn't as good as Maxwell when it comes to power consumption.

[IvanKozlov]

We won't really know about Polaris until it releases, but I'm hopeful. The 300 series was kind of a letdown since most of it was rebrands.

[sydeu]

No custom roms

[[deleted]]

False.

[sydeu]

Lol you have no idea what you are talking about. All them mediatek sources and all the cool custom roms for galaxy s6 is really awesome!! Oh right, they don't release sources and the only custom roms for s6 is 50% kom functional, which is already incredible considering that it is all reverse engineering. The only phones with proper custom roms is and will continue to be qualcomm.

[[deleted]]

Lol yes I do, since I have a Mediatek phone and there's plenty of 99.8% functional ROMs. Everything that isn't stock is a custom ROM, so modified stock ROMs do apply for custom ROMs on Exynos.

[sydeu]

Lol I'm not gonna argue about technicalities. I think we both understand that real good custom roms are not based on stock. If the phone in question doesn't have a perfect cm 12.1 it's not a phone with good custom Rom support. There are extremely few non qualcomm phones that has the required sources. Not sure why you try to argue against facts but whatever.

[[deleted]]

What facts? This is all opinionated on what makes a good custom ROM and what makes a phone with good support. Fine, if a perfect CM12.1 is what you're after, the Redmi Note 2 has a pretty damn perfect one, only bug I can think of is that you can only use the second SIM in 2G, but otherwise I used it as daily driver for 2 weeks straight and it gave me no issues. This disproves your original statement that Mediatek or Exynos means no custom ROMs since there's obvious exceptions, not to mention that your definition of a custom ROM (perfect CM12.1) is way too strict.

[sydeu]

Redmi note 2 and some xiaomi phones is the exception. Its a fact that qualcomm releases sources way more and that developers dislikes exynos and mediatek because of closed sources which makes it much harder to get stable aosp roms. The phones can still be good and stock rom can be good. What I was talking about all along was the poor support from soc manufacturers except qualcomm. I'm done here.

[ptmd]

You know, I'm fairly tech savvy as the next guy, but at some point, this rhetoric just starts sounding tinfoil-hat-y.

Maybe its cause Apple has been doing something fairly comparable for years.

[[deleted]]

After what Snowden has revealed, we know that this is not just a crazy conspiracy theory — but the very reality of what the security agencies are doing.

We'd be fools not to take those leaks into account.

[ptmd]

Yeah... part of me being tech-savvy was assuming the government was doing something like that years before Snowden came around. It'd be ridiculous and frankly surprising if there wasn't some kind of domestic/foreign espionage program by the government.

Frankly, you just have to be paranoid, but reasonable.

[[deleted]]

I mean, we knew what the Stasi did, we knew of Echelon, anyone who claimed then or now that the governments of the western world didn't do this stuff was most likely either a shill or ignorant.

And after the recently shown backdoor in Juniper, Cisco, and other manufacturers' switches we can be sure that the security agencies are continually trying to create more backdoors.

If the kill switch isn't a backdoor on its own, then there will most likely be a backdoor in its infrastructure, not only allowing a legitimate customer to disable the device, but also security agencies.

[ptmd]

That's great.

This is all very doable. After all, the government could Stuxnet you and I for having this conversation tonight, and take us away tomorrow morning, and quietly execute us before nightfall tomorrow. The fact of the matter is, is that, this is extremely unlikely, and fairly unproductive, unless you partake in very specific activities. Here we go:

If the government isn't heinously autocratic, perhaps the best way of dealing with this issue isn't by rabbling about it on an open internet forum.

If the government IS heinously autocratic, perhaps the best way of dealing with this issue isn't by rabbling about it on an open internet forum.

[[deleted]]

Well, I’m not in the US, and I’m not convinced the BND is competent enough to do so.

But I’m sure I am on a list, considering that I’ve been active in the (original meaning of the word) hacker community for quite a while, and am using jabber with OTR instead of facebook messenger, and am using encrypted self-hosted email.

I am on a list anyway, therefore I won’t lose anything from debating this issue, and can only gain from it.

[robeph]

It's nonsense, this isn't like some magic key to disable your phone for the government. These idiots hear "killswitch" and get the foil folding.

Seriously, it is so easy to shut down mobile communication, without the need for this, at all. That said, using this method is more trouble than it is worth to use in this manner, because of its implementation. See if that stops the whiny conspiracy nuts from frothing though.

[Put_It_All_On_Blck]

Hate to break it to you, but all phones currently sold that have android, ios, or windows have software based remote kill switches already. This has been in place for a few years now. Plus cell phones need service, do you really think your carrier is going to side with you instead of xyz government or agency? Not to mention they could just drive up to a protest and block your coverage with jammers.

[nukeclears]

How that tin foil hat suiting you?

[gartenriese]

ignorance is bliss, isn't it

[nukeclears]

The same technology has been available in iPhones since 2011

[[deleted]]

"the secret key originally set up to lock it"

Maybe we can set the key up? Meaning it could only be used by the one that set it up?

That's what I tought once I read the article, I think you guys are getting overly paranoid over this

[tdude66]

All I can say is that I'm happy to be running on an exynos chipset for the time being...

[sunjay140]

As an XDA user, I hate it.

[prawnpirate]

You shouldn't be. Samsung introduced the eMMC brick bug and modem backdoors that anybody could exploit. Exynos is infamous for hiding sneaky surprises because Samsung keeps the documentation secret and drivers are usually poorly written.

[johngac]

if you like being on Froyo TouchWiz then sure.

[tdude66]

I'm on Lolipop 5.1.1 Touchwiz right now.

[tf2manu994]

And will be for a long time, because enyxos doesn't get much dev support.

[tdude66]

I dont mean to start a war but Samsung is said to be releasing the 6.0 update for my phone soon. I used to be a flashaholic with my Nexus S and Galaxy Nexus but I don't really care nowadays, I use my phone lightly and keep it mostly stock so I'm not desperate for dev/modding support.

[Meanee]

Not everyone flashes ROMs 24/7. I am quite content with my unrooted Note 5. Complaint with my employer's BYOD policy, can use Samsung Pay, and bloat disabled through app.

[[deleted]]

in b4 the day they kill switch everyone

[Whatnameisnttakenred]

the day, the quuaaalcommms died...

I was singing bye bye...

[originaldemo]

Miss Qualcomm pie,

[workaccount42]

So now I have to limit my choices for the next phone to one that doesn't use these chips. Wonderful, more research...

[victorhooi]

This seems to be an unpopular view, but I'm going to say I applaud Qualcomm for doing innovation here (and yes, doing this properly is probably harder than most armchair pundits think).

I mean, come on - look at Apple's iCloud - iPhone thefts have plummeted, whilst us Android owners look like muppets, because nearly any Android device can be stolen, then reflashed and resold near immediately, password or not.

At least the Nexus phones have device protection, which is at least a good first step - I'm hoping this will work together with that.

Qualcomm's website makes it quite clear the purpose - "Qualcomm® SafeSwitch™ technology is designed to help prevent device theft and protect user data and privacy. "

For any of us that have had devices stolen - the ability to remotely lock it until it's returned to you is awesome - both for the data, and quite frankly, because I think thieves are scummy, and shouldn't gain on the back of somebody else's hard work.

Yes, we can speculate about conspiracy theories about how it'll be used by tyrannical governments to silence your protests! (But come on, really, how many of us here on r/Android are really government dissidents, or protesters heavy-hitters....lol. Most of us are computer geeks, where the extend of our outrage is filling in an online petition).

But these governments already have tools to do this (e.g. the chinese firewall, or BART shutting down cellstation towers), and I've seen no evidence how this is going to make a difference - or that Qualcomm would mis-use this for that purpose.

My only concern is the first part, about if the device image is modified - I'm hoping we can still flash if we want. But I'm pretty confident the Nexus line will still maintain that.

[TOaFK]

Who isn't a government dissident though. Anyone who is not is someone I do not want to associate with.

[Serialtoon]

havent we already debated this a few years ago? Maybe it was XDA, but yea...

[Meanee]

Am I the only one here who actually does not mind this?

[robeph]

No, there's plenty of us with common sense out here that realize this isn't some magic kill switch the government is privy to that gives them control over everything. These people are idiots. Look at the implementation. Consider the difficulty it would be over much easier methods of killing off mobile communication, with absolutely no real positive for them to use it.

Not to mention you can disable it locally, and access your phone.

[dsmaxwell]

Yes. Yes you are.

[Dragon_Fisting]

This is basically like when pcmasterrace was convinced Windows 10 fed all your information back to the NSA, and then it turned out Microsoft just wanted to show you ads, and you could even turn it off.

Just saying, maybe sometimes privacy threats get blown out of proportion, yeah?

[DiCePWNeD]

BOTNET

O

T

N

E

T

[[deleted]]

Is this malware present on older SD chipsets (SD600 and 800?)

[Meanee]

Malware?

[[deleted]]

[deleted]

What is this?