This is a very neat and approachable write-up, but is the final result really a hack? If I understand correctly, you're getting an unprivileged shell on a device you own and have paired with your smartphone; more or less equivalent to installing a terminal emulator on your smartphone, except it's smart glasses in this case.
Should the ability to own one's devices really be treated as a vulnerability and reported to security teams?
How is it not a hack to do something on a device that doesn't let you do it? Yes, the device should let you do whatever you want, but it doesn't, therefore this is a hack.
I'm going to try it on my glasses, and disable autoupdating ASAP.
Sure but nowadays can you get unprivileged shell to your smartphone no matter the brand and model? Your TV? Your car infotainment system? Your smart fridge? I can continue on and on.
Actually having unprivileged access to something is quite rare nowadays in non-strictly computer products nowadays.
I understand having a locked-down version of mass-produced tech that is for the general consumer. However, I also firmly believe that anyone who wants to should be able to bypass that. Make it void the warranty, don't allow customer support, whatever you want. But make it a free option to have complete control. If I buy a piece of hardware, I should own it.
(I say this as I am currently charging a cheap doorbell camera I bought, so that I can start dumping data from it and reverse engineer its protocol, solely so that I can lock it down to my local network...We needed something at the time, or I would have bought something more expensive that had an open protocol...)
> Make it void the warranty, don't allow customer support, whatever you want.
That would be a regression in terms of consumer rights, in my opinion. I don’t see why the EU shouldn’t legislate such that the right to control owned hardware becomes fundamental.
Technically, even in the US a warranty is only void if it's caused by something the consumer did; a 1 year warranty for production defects can't be voided.
Although I think it's fair that the company not have to deal with a defect that is almost certainly caused by something you do to your device. Like, strawman, but early iPhones sometimes encountered issues while doing an untethered jailbreak, or people would install tweaks that were less than stable (even sometimes on relatives' or friends' phones), then they would walk into an Apple Store with weird behavior and expect the fix to be free. That shouldn't be covered by warranty.
It 100% should be covered in the event the user is okay with the equivalent of a factory reset (they lose all their data). I agree Apple isn't on the hook for restoring the data you saved with a sketchy mod, but restoring the phone to factory functionality is 100% their problem.
I struggle to think of a reason why a phone can't be factory reset to fix those issues that doesn't involve "the manufacturer fucked around trying to prevent 3rd party changes". It's their problem and fault if their attempts to prevent 3rd party software ended up bricking the phone. I can't be bothered to give a shit that they've done weird things to the bootloader and now it won't boot because the bootloader doesn't have the right magic keys. Fix it or issue a refund, it's their software breaking the damn thing.
That does exclude "your software physically burnt out hardware" but that's such a rare occurrence it's practically not worth mentioning. I can't remember the last time I heard of a ROM that physically killed a part.
You're not likely to physically damage a computer by running your own software on it. There's no excuse for not having an easy "reset to factory settings" and a bootloader that's hard to brick. Anything with an SD card slot or a USB port can boot from it; anything with wifi can download a fresh factory image; anything at all can have a "recovery mode" that you don't need to touch to tinker with it. Tinkering is only dangerous when the manufacturer makes it so.
In large, powerful and potentially dangerous machines, the firmware may embody safety features. Like preventing dangerous doses of radiation or overspeed conditions on motors or overcharging of batteries.
Why should you have a right to operate the device in a dangerous way that the manufacturer engineered to prevent?
You may be happy to injure yourself and to disclaim your right to warranty but the manufacturer could suffer immense reputational damage if, say, your hacking the firmware of their humanoid robot results in it tearing off your head.
That reminds of this company that used to provide a body implant for people with certain issues. The company ended up closing down and had to go in and remove those implants from those people.
Those people rightfully were like why can’t we keep it and the company was like we have to run the services to manage it. Why not just open up the hardware and let it continue being used? Well if you put the wrong software and it ends up killing the person, the hardware company can be held liable.
Made me realize my dream of having an open-source car is never going to happen.
All the ECU reprogramming "tuners" have been treating cars like open source for a while now. Any old car has a limited amount of SW too, and people have simply switched parts around and hacked them however they see fit.
Basically, we already live a reality where dangerous machines like cars have been hacked and are operated on the street among us.
This is the same argument that was being made that FOSS is less secure because it's open in the 90s or 2000s. Yet the most of critical infra today runs on open source.
Don't you think it'd be safer if these tuners had access to the source code?
The point at which we are performing unnecessary surgery to remove perfectly functional assistive technology from people because of some legal fantasy is the point where we need to seriously ask ourselves whether the legal fantasy is really doing anything useful, or whether it's merely some self sustaining cancer on society.
When people get a tool, they can perfectly well hurt themselves with it.
But at the same time, risk profiles between different tools are different, and it is common to have special rules for some of them. Eg. guns already do.
While we might need to stop an unlicensed SW engineer to accidentally or purposely turn your housekeeping robot into a killer robot, the risk of them messing up their fridge is lower. Yes, your food could spoil and kill you, but your fridge could face a power cut and do the same.
So establish which devices have a higher risk and limit changes to those with more expertise — if it means licensed engineers, so be it.
> So establish which devices have a higher risk and limit changes to those with more expertise — if it means licensed engineers, so be it.
I think the main thing to grapple with is the idea that even laypeople who aren't security or SWE experts may want to protect against the highest risk profile possible, even if they don't personally understand what they're giving up. (And, for most of these people, I imagine they're giving up a freedom they might not have ever thought of using in the first place)
Strawman but, If you want to make a device called "securePhone 2027", where not even an evil maid attacker (say, a national security agency who has spied on you over your shoulder for 180 days and has thus seen all of your passwords) can install spyware on your phone, what sort of qualifications do you need to have in order to purchase (or qualifications for a manufacturer to sell) such device?
Part of the issue in arguments like this is in saying that, because the iPhone is the most popular phone in the United States, they should be forced to compromise on security because enough buyers aren't aware of the compromises they're making in order to have the iPhone. So if you still want companies to be able to sell a brick that never runs unsanctioned7 code, you either need
(A) setting an upper bounds (market share?) to how big a company can get before they must compromise on security and allow people to self-compromise via going through multiple hoops to disable security protections (e.g. disabling SIP on a Mac).
(B) means-testing that the customer understands that what they're buying could compromise their security
(C) some key ceremony for allowing said device to be unlocked. I imagine a 1 month waiting period plus needing to show passport and proof-of-non-coercion across multiple nation-states could work? maybe only if they're not apart of a shared intelligence network coallition (like five/nine/fourteen eyes)?
The fact that the iPhone is incredibly resistant to all forms of widespread malware is really good for society at large. Like, the only known widespread malware (outside of web-based scams calling Alert("Apple has compromised your device, call this number")) has been developer-distributed malware due to chinese developers releasing apps via a malicious unsigned Xcode app [0].
I am not saying it is easy, but an open device can still leverage a secure element, sandbox any applications and have granular permissions.
Just like PKI infrastructure, vendors could embed and tie into a TPM similar key infrastructure that would be the only part you couldn't touch (key storage + key validation and signing implementation so it can't be tampered with). I mean, even there the code could be open and only the key material would be secret.
From the perspective of a researcher: there is a clear 'yes'. Void the warranty, make sure all certification for operarion is invalid.
That is to a certain point. If deemed misuse would be harm against other people or circumvent export control. You may also restrict, who is allowed to do it. However, if software is the only protection against dual-use, tler might have a general problem.
I am a proponent of giving users an option to root their devices through a one-way process that would surrender warranty coverage and print a big safety warning at every boot.
The problem with allowing easy shell access is that any arbitrary command execution would be used by exploits, too. There are also a lot of social engineering schemes that bait users into running commands on devices. We don’t think about these risks as engineers, but you wouldn’t believe how many people will follow instructions to open something like the Chrome developer console and paste code blocks into it because some website told them to.
So a secure device is also a locked down device. Getting a shell is a vulnerability because it’s the avenue that exploits would use.
That’s why I’d be in favor of a one-way developer mode, which provided shell access but printed a big unavoidable warning screen in the boot loader.
Unfortunately, it’s not that simple. Asking people to give up their warrant isn’t legal, generally, so outside of very specific circumstances you have to cover warranty claims on the device, too. I have worked at companies that tried to offer some developer access like this, and the number of people abusing customer service because they got in over their heads with modifications and wanted a fresh unit or want CS to support their mods would make you face palm. So the compromises end up being things like only allowing ephemeral mods that get wiped at each reboot and other default-safe behaviors, but that doesn’t make people happy either.
Following the reasoning behind the magnuson-moss act, it should not automatically void the warranty. That puts users who want software freedom at a financial disadvantage.
I agree some big obvious scare message is good but actually voiding the warranty restricts user freedom.
> Following the reasoning behind the magnuson-moss act, it should not automatically void the warranty. That puts users who want software freedom at a financial disadvantage.
Only thing is, if the company releases software updates to fix issues, they should by no means be expected/required to backport bug fixes to older versions just so that compromised devices can. There are certain warranty claims where the issues would be solved via software update, but thus are unavailable to people who are insistent on staying on a rootable version of the firmware.
At some point in the software as a service world (driven by web apps), we started accepting that a manufacturer can break the software we use (change it so it does not have the same features or even just UX we are used to), and is now mandated to provide security maintence but can still do that by simply forcing a customer to their new version.
I understand the economics of this, but this is why I loved LTS releases and their commitment to backport security vulnerability fixes.
Hopefully with GenAI, companies sprout that will support this for consumers too!
Do I really "have root" if you've put an "unavoidable warning" in the bootloader that I can't remove? It sounds like you're still asserting primary control over the device and giving me a limited playground. Your suggestion is "we're going to run code you don't control on your device, and it's going to run before any of your code, and there's nothing you can do about it, but don't worry we pinky promise to only make it print a warning scolding you for wanting root."
Nah. No thanks. I want actual freedom, not a longer chain.
There are a lot of devices where I agree with you, but smart glasses are an appliance category where this categorically needs to be considered a vulnerability. The main thing that currently stands between them being truly amazing and useful (e.g. for people with impaired vision or hearing) and a spying/peeping tool is the firmware on the device.
Smartglasses have an amazing potential to improve lives when done right and used right. But that relies on a sophisticated sensor hardware package that is barely distinguishable from a covert recording tool, simply because of the reality of the problem space. I don't want to see that tech totally canned as assistive technology because of backlash.
I think this is an area where society is going to adjust to fit the technology. The idea that you can not be recorded in places where eyeballs can see you is going to seem pretty quaint before long. Uncomfortable to our sensibilities, but probably not uncomfortable after the next few generations.
You’re describing a dystopia. Being constantly recorded is not “uncomfortable”, it’s a violation of our private space and changes our behaviour. There are several studies on the psychology of being recorded.
We’ll never improve society as long as we keep rolling over and saying “it’s the way it’s going to be, we just have to adjust”. Nothing made by humans is inevitable¹. We don’t have to bend over to massive corporations and go “thank you sir, may I have another”.
Chat Control having been repeatedly repealed is proof that resistance is not futile. We’re in a bad spot, yes, but we should fight to defeat the bad outcomes or delay them as much as possible.
If you asked someone 100 years ago to review current music or invited them to watch the average violent action movie both would be appalling. If you were to go back in time and review social status and expectations of women or minorities you would presumably be horrified.
someone 100 years from now might be horrified by the idea that murders and rapes were very often unsolved because the AI wasn't around to see them happen.
Just about everything you hold as sacred an indelible features of a just and normal universe is actually a societal preference subject to the tastes and sensibilities of the people of that time.
Respectfully, that’s a massive, nonsensical, non-sequitur. Even if that were true—which you don’t and can’t know, only speculate—taste in music and movies has nothing to do with the point. Thinking that murder and rape will be “solved” by AI is laughable in the worst way (as if there’s any mystery to sexual assault; it has an issue of enforcement not of being “unsolved”). Finally, there’s nothing I’m even so much as suggesting is a “sacred and indelible feature of a just and normal universe”. Even so, there are things which have been constant throughout humanity’s development and we can be pretty sure will continue to be true, such as (for example) people on the whole not enjoying being tortured. Suggesting that would in any way depend on the tastes and sensibilities of the time would be absurd.
I think the current line in the sand is surreptitious recording with their glasses and the light. They have anti-tamper stuff around that, and I can see why they intentionally make root difficult.
People don't like recording, and there's usually a patchwork of laws that give many people some protection against it.
Not related to meta but the privacy angle is stuff like the Plaud recorders. Normal non-techies have had these, including personal run-ins of my own with people using these dedicated smartphone recorders where it was neither acceptable nor consensual.
I'm curious if ubiquitous and hidden personal recording collapses the technical or social lines set up against it first.
Maybe I’ve still got the old PS3/PSP-exploit mentality, but reporting an arbitrary code execution vuln to the OEM is kind of sad… that deliberately closes a door for people to use their devices as they see fit.
Of course, the “don’t update after this firmware version” bit would always be the case (since any widely-distributed such vuln will be patched eventually), but deliberately moving the timeline to the left is sad.
So many things are done with the end of making some profit, either directly monetary (bounties) or career.
People like these hope to get the recognition by the big companies to get the fat paychecks they dream to also pull in.
On the other hand, many others hack stuff and at most tell their closest friends.
Of course, it's availability bias: if this person wasn't disclosing it somehow, you wouldn't know. And even just a random article online is basically a disclosure minus the other benefits, so people contact the OEM while they are at it.
Regardless of the exploit, I wonder if there's a market for similar looking smartglasses that let you do whatever you want. Some competition in the space would be good for inviting regulation.
I haven't even seen a market for these, much less something that takes more work. It's probably hobby level at best to a very select hacker-focused crowd, but even they have historically been anti-sousveillance.
> "I used android.media.ToneGenerator in my DAT APK to signal which part of the code was executing:"
I've heard that morse code allows for easier debugging than beep counting, if you have to use audio. Not had a chance to put it into practice myself, but since digits especially are simple in morse code, it might be useful to someone
56 comments
[ 0.22 ms ] story [ 49.6 ms ] threadShould the ability to own one's devices really be treated as a vulnerability and reported to security teams?
I'm going to try it on my glasses, and disable autoupdating ASAP.
Actually having unprivileged access to something is quite rare nowadays in non-strictly computer products nowadays.
(I say this as I am currently charging a cheap doorbell camera I bought, so that I can start dumping data from it and reverse engineer its protocol, solely so that I can lock it down to my local network...We needed something at the time, or I would have bought something more expensive that had an open protocol...)
That would be a regression in terms of consumer rights, in my opinion. I don’t see why the EU shouldn’t legislate such that the right to control owned hardware becomes fundamental.
Although I think it's fair that the company not have to deal with a defect that is almost certainly caused by something you do to your device. Like, strawman, but early iPhones sometimes encountered issues while doing an untethered jailbreak, or people would install tweaks that were less than stable (even sometimes on relatives' or friends' phones), then they would walk into an Apple Store with weird behavior and expect the fix to be free. That shouldn't be covered by warranty.
I struggle to think of a reason why a phone can't be factory reset to fix those issues that doesn't involve "the manufacturer fucked around trying to prevent 3rd party changes". It's their problem and fault if their attempts to prevent 3rd party software ended up bricking the phone. I can't be bothered to give a shit that they've done weird things to the bootloader and now it won't boot because the bootloader doesn't have the right magic keys. Fix it or issue a refund, it's their software breaking the damn thing.
That does exclude "your software physically burnt out hardware" but that's such a rare occurrence it's practically not worth mentioning. I can't remember the last time I heard of a ROM that physically killed a part.
Why should you have a right to operate the device in a dangerous way that the manufacturer engineered to prevent?
You may be happy to injure yourself and to disclaim your right to warranty but the manufacturer could suffer immense reputational damage if, say, your hacking the firmware of their humanoid robot results in it tearing off your head.
Those people rightfully were like why can’t we keep it and the company was like we have to run the services to manage it. Why not just open up the hardware and let it continue being used? Well if you put the wrong software and it ends up killing the person, the hardware company can be held liable.
Made me realize my dream of having an open-source car is never going to happen.
Basically, we already live a reality where dangerous machines like cars have been hacked and are operated on the street among us.
This is the same argument that was being made that FOSS is less secure because it's open in the 90s or 2000s. Yet the most of critical infra today runs on open source.
Don't you think it'd be safer if these tuners had access to the source code?
But at the same time, risk profiles between different tools are different, and it is common to have special rules for some of them. Eg. guns already do.
While we might need to stop an unlicensed SW engineer to accidentally or purposely turn your housekeeping robot into a killer robot, the risk of them messing up their fridge is lower. Yes, your food could spoil and kill you, but your fridge could face a power cut and do the same.
So establish which devices have a higher risk and limit changes to those with more expertise — if it means licensed engineers, so be it.
I think the main thing to grapple with is the idea that even laypeople who aren't security or SWE experts may want to protect against the highest risk profile possible, even if they don't personally understand what they're giving up. (And, for most of these people, I imagine they're giving up a freedom they might not have ever thought of using in the first place)
Strawman but, If you want to make a device called "securePhone 2027", where not even an evil maid attacker (say, a national security agency who has spied on you over your shoulder for 180 days and has thus seen all of your passwords) can install spyware on your phone, what sort of qualifications do you need to have in order to purchase (or qualifications for a manufacturer to sell) such device?
Part of the issue in arguments like this is in saying that, because the iPhone is the most popular phone in the United States, they should be forced to compromise on security because enough buyers aren't aware of the compromises they're making in order to have the iPhone. So if you still want companies to be able to sell a brick that never runs unsanctioned7 code, you either need
(A) setting an upper bounds (market share?) to how big a company can get before they must compromise on security and allow people to self-compromise via going through multiple hoops to disable security protections (e.g. disabling SIP on a Mac). (B) means-testing that the customer understands that what they're buying could compromise their security (C) some key ceremony for allowing said device to be unlocked. I imagine a 1 month waiting period plus needing to show passport and proof-of-non-coercion across multiple nation-states could work? maybe only if they're not apart of a shared intelligence network coallition (like five/nine/fourteen eyes)?
The fact that the iPhone is incredibly resistant to all forms of widespread malware is really good for society at large. Like, the only known widespread malware (outside of web-based scams calling Alert("Apple has compromised your device, call this number")) has been developer-distributed malware due to chinese developers releasing apps via a malicious unsigned Xcode app [0].
0: https://youtu.be/tJeEuxn9mug?t=1502
Just like PKI infrastructure, vendors could embed and tie into a TPM similar key infrastructure that would be the only part you couldn't touch (key storage + key validation and signing implementation so it can't be tampered with). I mean, even there the code could be open and only the key material would be secret.
(I find revocation a harder problem, really)
That is to a certain point. If deemed misuse would be harm against other people or circumvent export control. You may also restrict, who is allowed to do it. However, if software is the only protection against dual-use, tler might have a general problem.
The problem with allowing easy shell access is that any arbitrary command execution would be used by exploits, too. There are also a lot of social engineering schemes that bait users into running commands on devices. We don’t think about these risks as engineers, but you wouldn’t believe how many people will follow instructions to open something like the Chrome developer console and paste code blocks into it because some website told them to.
So a secure device is also a locked down device. Getting a shell is a vulnerability because it’s the avenue that exploits would use.
That’s why I’d be in favor of a one-way developer mode, which provided shell access but printed a big unavoidable warning screen in the boot loader.
Unfortunately, it’s not that simple. Asking people to give up their warrant isn’t legal, generally, so outside of very specific circumstances you have to cover warranty claims on the device, too. I have worked at companies that tried to offer some developer access like this, and the number of people abusing customer service because they got in over their heads with modifications and wanted a fresh unit or want CS to support their mods would make you face palm. So the compromises end up being things like only allowing ephemeral mods that get wiped at each reboot and other default-safe behaviors, but that doesn’t make people happy either.
Also did you just completely ignore the entire part of my comment where I said I advocate giving people developer access?
No deal.
I agree some big obvious scare message is good but actually voiding the warranty restricts user freedom.
Only thing is, if the company releases software updates to fix issues, they should by no means be expected/required to backport bug fixes to older versions just so that compromised devices can. There are certain warranty claims where the issues would be solved via software update, but thus are unavailable to people who are insistent on staying on a rootable version of the firmware.
At some point in the software as a service world (driven by web apps), we started accepting that a manufacturer can break the software we use (change it so it does not have the same features or even just UX we are used to), and is now mandated to provide security maintence but can still do that by simply forcing a customer to their new version.
I understand the economics of this, but this is why I loved LTS releases and their commitment to backport security vulnerability fixes.
Hopefully with GenAI, companies sprout that will support this for consumers too!
As an engineer, you wouldn't believe how many times I've recently used `curl | bash` to install a piece of software
Nah. No thanks. I want actual freedom, not a longer chain.
Smartglasses have an amazing potential to improve lives when done right and used right. But that relies on a sophisticated sensor hardware package that is barely distinguishable from a covert recording tool, simply because of the reality of the problem space. I don't want to see that tech totally canned as assistive technology because of backlash.
We’ll never improve society as long as we keep rolling over and saying “it’s the way it’s going to be, we just have to adjust”. Nothing made by humans is inevitable¹. We don’t have to bend over to massive corporations and go “thank you sir, may I have another”.
Chat Control having been repeatedly repealed is proof that resistance is not futile. We’re in a bad spot, yes, but we should fight to defeat the bad outcomes or delay them as much as possible.
someone 100 years from now might be horrified by the idea that murders and rapes were very often unsolved because the AI wasn't around to see them happen.
Just about everything you hold as sacred an indelible features of a just and normal universe is actually a societal preference subject to the tastes and sensibilities of the people of that time.
Would people using them because of visual impairment be OK with them being bright green?
https://www.theverge.com/gadgets/962514/meta-privacy-light-t...
People don't like recording, and there's usually a patchwork of laws that give many people some protection against it.
Not related to meta but the privacy angle is stuff like the Plaud recorders. Normal non-techies have had these, including personal run-ins of my own with people using these dedicated smartphone recorders where it was neither acceptable nor consensual.
I'm curious if ubiquitous and hidden personal recording collapses the technical or social lines set up against it first.
Of course, the “don’t update after this firmware version” bit would always be the case (since any widely-distributed such vuln will be patched eventually), but deliberately moving the timeline to the left is sad.
People like these hope to get the recognition by the big companies to get the fat paychecks they dream to also pull in.
On the other hand, many others hack stuff and at most tell their closest friends.
Of course, it's availability bias: if this person wasn't disclosing it somehow, you wouldn't know. And even just a random article online is basically a disclosure minus the other benefits, so people contact the OEM while they are at it.
I've heard that morse code allows for easier debugging than beep counting, if you have to use audio. Not had a chance to put it into practice myself, but since digits especially are simple in morse code, it might be useful to someone
Not for anyone that put PCs together in the 90's. Beep is also the old printf.