Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you trust that your personal machine is not compromised?

news.ycombinator.com

Post reply on HN
Print view View original

451–460 of 469 posts

Re: Ask HN: How do you trust that your personal machine is not compromised?

#451

Post by sliken »

INTPenis wrote: post #78

I have several layers of security, including an infosec mindset that comes naturally, but at the end of the day I don't really know. I have faith that if I were to be infected statistically it would be by some malware that would give itself away by mining crypto or doing something else very loud and disruptive. Fun story but my laptop was actually hacked remotely once, without me knowing. It was almost 20 years ago,…

Be warned that even 20 years ago when I was doing research on this stuff, that it was standard procedure to exploit the kernel. This included things like read or stat showing a valid file, but exec would run an exploited file. It also allowed hidden directories and files. So you couldn't find a sub directory with ls, but you could cd into it.

So you really have to boot from trusted media with a trusted kernel and no untrusted modules to be sure what you are seeing. Generally this involves rebooting onto trusted readonly media, doing a scan, then rebooting back into production. The HOWTO mentioned finding an unused kernel module like floppy.ko and replacing it with a malicious payload and ensuring it loaded on boot.

Also keep in mind that attackers are well aware of tripwire and some attack kits I saw specifically looked for tripwire like approaches and would hook into the update the checksums process after patching so their exploited binaries would look just like valid binaries.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#452

Post by mikewarot »

lukan wrote: post #449
mikewarot wrote: post #441

Earlier quoted context omitted.

That's not capability based security, though everyone seems to think it is. (Perhaps it's just survivor bias effecting replies?) You never get nagged to take $5 out of your wallet to hand to an untrusted person, why should you get nagged to drop a file into an application you don't trust.

"You never get nagged to take $5 out of your wallet to hand to an untrusted person" I suppose, you never have been to a significantly poorer country? (outside of the protected tourist areas). Or well, spend time with kids, who really want something. Begging can get very intense. And about file permissions, well - are you aware, what kind of permissions the standard free app on the google play store will ask of people…

That's not capabilities... your light doesn't ask for permission to get power.

The clerk at the store doesn't ask for permission to take your payment.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#453

Post by mikewarot »

TeMPOraL wrote: post #443
mikewarot wrote: post #441

Earlier quoted context omitted.

That's not capability based security, though everyone seems to think it is. (Perhaps it's just survivor bias effecting replies?) You never get nagged to take $5 out of your wallet to hand to an untrusted person, why should you get nagged to drop a file into an application you don't trust.

onSave() => fh1 = GetFileWritePerm($documents + "/project.foo"); fh2 = GetFileReadWritePerm($myFolder + "/cache.db"); while(!fh3) { fh3 = GetFileReadWritePerm("/etc/passwd"); }

The operating system should allow you to make the choice, then enforce it. Open file X, save file Y.... the user should make those choices (via the OS) and the OS should enforce those decisions... the way applications are currently run, that's not true.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#454

Post by TeMPOraL »

mikewarot wrote: post #453
TeMPOraL wrote: post #443

Earlier quoted context omitted.

onSave() => fh1 = GetFileWritePerm($documents + "/project.foo"); fh2 = GetFileReadWritePerm($myFolder + "/cache.db"); while(!fh3) { fh3 = GetFileReadWritePerm("/etc/passwd"); }

The operating system should allow you to make the choice, then enforce it. Open file X, save file Y.... the user should make those choices (via the OS) and the OS should enforce those decisions... the way applications are currently run, that's not true.

The application still needs to communicate the things it needs, the things on which the OS/the user should make choices. And if the application can communicate this, it can communicate it again. And again. And again. Or flat out refuse to work with "incorrect" choices, and bully the users into compliance.

You'd think that would be really rude of the app. That may have mattered 20-30 years ago. Today, most consumer-facing tech companies - big corporation and small startups alike - adopted "being a rude, obnoxious asshole" as a business model.

Note that this includes all the major commercial OS vendors too - i.e. Apple, Google and Microsoft. This creates a new challenge: how do we design secure systems when neither the apps nor the OS itself are trusted parties? How do we develop this security framework, when untrusted parties are the ones gatekeeping adoption, and also most likely to be developing it?

In other words: how do we maintain security for hens, when the foxes are guarding the hen house?

Re: Ask HN: How do you trust that your personal machine is not compromised?

#455

Post by actionfromafar »

mike_hearn wrote: post #431
mwcampbell wrote: post #428

Earlier quoted context omitted.

Is Helium mandatory for MSIX-packaged apps?

I think they recently added a way to opt out of it entirely. That said, it does very little and because it's not a sandbox it's easy to 'escape': • Copy an EXE to %TEMP% and run it from there. • Use a Win32 API flag to start a process (of any path) outside the app container. There are only a few cases where Helium is an issue and they're all easy to work around. One example is writing a log file to your app private U…

Thanks, that's very useful info for me.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#456

Post by speed_spread »

lumb63 wrote: post #403
oneplane wrote: post #397

Earlier quoted context omitted.

I don't think you can trust any commercial baseband, period. They all have to adhere to complex radio standards, nobody wants to implement them because their design-by-committee stuff is boring/lame/hard/painful, so what you get is a few stacks that pass the tests and everyone builds on top of that. Same goes for any other RTOS-style firmware, it's really hard to get right, and because most of them are built by/for t…

I agree with your point about how the personality of (technology) companies doesn’t fit the security minded person well. As a software engineer, I feel I am in the small minority whenever I mention security or privacy concerns at work. I feel that most technology is evil at this point because of the immense ability of it to violate people’s privacy. It is sad to me that this is the state of the modern tech ecosystem.

It's just back to the worldview of the 1960's. The only computers were mainframes and were seen as the tools of "The Man", conspiring in the shadows against a free humanity. PCs were a liberating force, making computing accessible to the common man. Modern total reliance on global networks reversed the power balance back to central instances.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#457

Post by mindslight »

nl wrote: post #398
mindslight wrote: post #277

Earlier quoted context omitted.

Sure, but full disk encryption was also enabled on my Mom's Ubuntu laptop 15 years ago, because I chose the correct options when I set it up. What commercial vendors offer out of the box has never been a good yardstick for talking about security features, and it's only gotten worse with the rise of the surveillance economy. My fundamental problem with Graphene/Calyx is that I don't trust the devs have enough bandwidt…

> What commercial vendors offer out of the box has never been a good yardstick for talking about security features It absolutely is. Default setting matter a lot! It's great to have extra security features too. But even experienced users won't change defaults if they have too much cost. If things are turned on by default then those costs diminish because other software has to work within them.

Sure, defaults matter.

My point was that when talking about commercial security offerings, the security models generally end up relying on on "trust the company", which has never worked out well. So corporate offerings finally coming around to having full disk encryption is more catching up with something they lacked, rather than advancing the state of he art. (Contrast with Android's process sandboxing, which seems like a genuine advancement and could be worthwhile to port to desktop Linux)

In the context of talking about individual actions one can take to trust their personal machine, it's reasonable to assume this involves appropriately configuring your software environment. If this was instead a thread about what products would be good to recommend to your parents, then what was commercially available off the shelf would be relevant.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#458

Post by zestyping »

ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

These are all part of the operating system and unrelated to the biggest attack surface: apps.

Users install apps and grant them full access all the time. Android phones are wide open no matter how secure the operating system itself is, because the security model for apps is so weak from a user experience point of view.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#459

Post by helloooooooo »

mike_hearn wrote: post #423
pl4nty wrote: post #352

Earlier quoted context omitted.

Windows struggles with feature adoption though. Win11 helped with the TPM requirement and features on by default, but MSIX apps are still underrepresented so userspace sandboxing is weaker. Windows virtualization-based security is great though, imo it's a significant advantage over Android

MSIX doesn't implement sandboxing. Apps can opt in to being sandboxed via that tech, but you can also write totally unsandboxed apps. There's also a very light weight app container mode called (internally) Helium which just redirects some filesystem and registry stuff, but the goal is to make uninstalls clean, not security. The Windows kernel does offer an impressive number of options to lock down processes. Look at…

App silos are pretty neat, I also find it kind of shameful that server silos are locked down to server SKUs. I would figure there could be some significant benefit to using them in browser renderer processes.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#460

Post by SkyMarshal »

ignoramous wrote: post #111

ex-AOSP dev here Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader. Pixels have several protections in place: - Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built. - Cryptographic verifi…

How does iOS compare to Android and ChromiumOS these days?
Post reply on HN