Samsung’s Android app-signing key has leaked, is being used to sign malware • Hacker News Board

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#131

Post by cptskippy » Mon, Dec 05, 2022, 4:12 PM UTC

charles_f wrote: post #90

cptskippy wrote: post #63

Earlier quoted context omitted.

> I would love to know what this "somehow" is. Multiple independent business units developing apps and needing to share the same signing key. Probably contracting out development to other firms. Neither Google or Apple offer robust ways to effectively delegate App develop while retaining secrets needed to publish an App. So you effectively need a FTE managing and supporting all of these groups.

Or, and it's crazy but hear me out, use an HSM to sign these apps instead of distributing keys

Can you do that for App/Play Store Apps? How does that work with companies that don't have offices. As a result of COVID, our org is permanently WFH and we shifted all of our datacenters to cloud providers.

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#132

Post by GeekyBear » Mon, Dec 05, 2022, 7:42 PM UTC

celsoazevedo wrote: post #130

GeekyBear wrote: post #129

Earlier quoted context omitted.

> The difference is that updates are delivered via the Play Store and not as system updates. You're claiming that the security issue detailed in the article will be fixed through the Play Store, for devices no longer receiving updates from the device maker? There are advantages to the iOS model of six years of full support followed by security updates for many years later, especially when an actively exploited issue…

> You're claiming that the security issue detailed in the article will be fixed through the Play Store, for devices no longer receiving updates from the device maker? Yes. The Webkit equivalent (Webview) is updated via the Play Store ( https://play.google.com/store/apps/details?id=com.google.and... ). A bug on Webview would be fixed with an app update, which doesn't even require a restart. Makes sense if we think abo…

> A bug on Webview would be fixed with an app update

TFA isn't about web browsers. It's about the security keys for multiple vendors leaking to the public.

>Łukasz Siewierski, a member of Google's Android Security Team, has a post on the Android Partner Vulnerability Initiative (AVPI) issue tracker detailing leaked platform certificate keys that are actively being used to sign malware. The post is just a list of the keys, but running each one through APKMirror or Google's VirusTotal site will put names to some of the compromised keys: Samsung, LG, and Mediatek are the heavy hitters on the list of leaked keys, along with some smaller OEMs like Revoview and Szroco, which makes Walmart's Onn tablets.

These companies somehow had their signing keys leaked to outsiders, and now you can't trust that apps that claim to be from these companies are really from them. To make matters worse, the "platform certificate keys" that they lost have some serious permissions.

https://arstechnica.com/gadgets/2022/12/samsungs-android-app...

Are you claiming that the Play Store will push an update to fix this issue on unsupported devices?

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#133

Post by fulafel » Tue, Dec 06, 2022, 2:45 PM UTC

ehhthing wrote: post #98

carl_dr wrote: post #4

> “Samsung takes the security of Galaxy devices seriously. We have issued security patches since 2016 upon being made aware of the issue“ They’ve known about it since 2016!?!

The article is rather misleading. It is almost certain that Samsung used HSMs to sign their APKs, so the key itself could never actually leak unless someone had physical access to the HSMs themselves and managed to somehow delid it and then put it back together without anyone noticing. I'm not too familiar with the documented attacks on delidding HSMs, but I believe that delidding chips causes permanent damage to the…

Can you expand reasoning or evidence behind this guess that the keys would be stored (only) in HSM?

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#134

Post by fulafel » Tue, Dec 06, 2022, 2:48 PM UTC

kyrra wrote: post #6

Fyi, this is related to the story from 2 days ago: https://news.ycombinator.com/item?id=33823946 An important comment from the original story: > OEMs have mitigated the issues above in previous updates. A new security update from Android is not required to mitigate these issues. Ensuring your device is running the latest version of Android is a general best security practice for users. Though the ars story says Samsu…

Sounds like the mitigation might be just blacklisting the publically seen malware sideloadable APKs, that's a pretty weak mitigation if the keys have leaked.