Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trusting clients is probably a security flaw

liberda.nl

Post reply on HN
Print view View original

111–120 of 150 posts

Re: Trusting clients is probably a security flaw

#111

Post by some_random »

yjftsjthsd-h wrote: post #99
rollcat wrote: post #89

Earlier quoted context omitted.

One good reason why "honest" app vendors do this is because providing tech support for custom OS's (in addition to the wide variety of popular handsets) is more costly. They also might not want the responsibility - in case something like your banking app gets pwned by random malware, they want to blame the OS vendor. CYA is always a good strategy. But if someone is seriously thinking client-side security works, yeah…

> One good reason why "honest" app vendors do this is because providing tech support for custom OS's (in addition to the wide variety of popular handsets) is more costly. I am reasonably confident that some almost-AOSP aftermarket ROM is a less weird operating environment than the weird hacked-up things official vendors are shipping.

Yes but you have an appreciable number of customers who are running wacky mid-market android devices.

Re: Trusting clients is probably a security flaw

#112

Post by gabeio »

JimDabell wrote: post #90
maeil wrote: post #72

I'm about 90% sure that for some inane reason, McDonalds outsources and creates separate apps for each country/region with these disastrous security flaws, except that at HQ they universally demand horrifically counter-productive "anti-root" measures for every locale, to a larger extent than even finance apps. Why am I so sure about this? I live on the other side of the world, the app is almost certainly an entirely…

I’ve worked on apps like this for companies like this. What happens is that their IT department mandates an expensive pen test for suppliers, anti-root requirements are on the pen-tester’s generic checklist, and most companies won’t push back on the pen test results. If you do, they normally fold and admit it’s not required.

Pen-testers? People do it for auditors as well! $OLD_JOB literally took one of the auditor’s questions to heart and decided that the question meant they needed to separate the databases physically for each client, they didn’t realize they could have just said “logically separated”. People are more scared of these checklists than they really should be.

Re: Trusting clients is probably a security flaw

#113

Post by rikthevik »

planb wrote: post #42
pedrovhb wrote: post #41

> [the extensive anti-reverse engineering measures are] more annoying than any financial app I've had, and I have 5 of them on my phone Ah, this reminds me of the Tuya app. I've done some ssl unpinning and mitm to see requests going in and out of my phone, it's pretty fun and there's often really nice and easy to use restful APIs underneath. Among them I've also done a couple of banking apps and they weren't particul…

The problem with Tuya is that they don't manufacture the devices themselves. Instead, they provide a standardized interface for all those low-cost manufacturers and get paid by them. If it were easy to fake Tuya requests or set up your own account (trust me, I tried this to integrate a Fingerbot into Home Assistant, but you have to jump through countless hoops, and the developer account keeps expiring every few weeks…

> they provide a standardized interface for all those low-cost manufacturers and get paid by them

As far as trends in IoT goes, I feel like Tuya is mostly positive. I bought some cheap smart plugs at Costco and the default app was worthless. When I learned that they were Tuya-compatible, I managed to get a half-decent (relative to cost) experience out of them. It seems to me that the alternative are a bunch of unmaintained one-off apps for each fly-by-night manufacturer. With a standard protocol and app I think old devices will live a bit longer at least.

Perfect (better) world it's all open source, but c'est la vie.

Re: Trusting clients is probably a security flaw

#114

Post by creer »

prmph wrote: post #16

I thought not trusting clients was already security 101?

> I thought not trusting clients was already security 101?

Of course it is. Always has been.

The security field is riddled with complete nonsense. Much of it even couched in terms of "best practices". It's the perfect field for people with zero specific knowledge or experience to be trusted with management or engineering - since it doesn't matter until it did matter, at which point a mild non-apology is usually sufficient.

Re: Trusting clients is probably a security flaw

#115

Post by throawayonthe »

maeil wrote: post #72

I'm about 90% sure that for some inane reason, McDonalds outsources and creates separate apps for each country/region with these disastrous security flaws, except that at HQ they universally demand horrifically counter-productive "anti-root" measures for every locale, to a larger extent than even finance apps. Why am I so sure about this? I live on the other side of the world, the app is almost certainly an entirely…

[dead]

Re: Trusting clients is probably a security flaw

#117

Post by neallindsay »

ryao wrote: post #105

This applies to games too, and the games have even more ridiculous measures such as putting malware into end user kernels to try to compensate for it.

Games that aren't turn-based at least have the excuse that they can't afford the latency. They have explicitly decided not to be secure so they can pretend to "know" client-side that you ran around the corner and can be sniped by your opponent in a timeframe that's impossible because of the speed of light.

Re: Trusting clients is probably a security flaw

#118

Post by dv_dt »

dspillett wrote: post #44
robertlagrant wrote: post #28

Earlier quoted context omitted.

> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I wa…

It has certainly been locked down a bit. This makes easily backing up all your data using some techniques harder/impossible. I can't include podcasts in the backup I do via rsync via termux anymore, unless I switch to an app that uses a shared storage area instead, as termux can not longer read app directories only its own and shared storage. You have to rely on each app that used app-local storage to have its own ba…

That's doesn't make sense either - not an android iser or dev but shouldn't there be a system level backup interface. Even if its storing the app-local storage as an opaque blob with a label?

Re: Trusting clients is probably a security flaw

#119

Post by baobun »

planb wrote: post #42
pedrovhb wrote: post #41

> [the extensive anti-reverse engineering measures are] more annoying than any financial app I've had, and I have 5 of them on my phone Ah, this reminds me of the Tuya app. I've done some ssl unpinning and mitm to see requests going in and out of my phone, it's pretty fun and there's often really nice and easy to use restful APIs underneath. Among them I've also done a couple of banking apps and they weren't particul…

The problem with Tuya is that they don't manufacture the devices themselves. Instead, they provide a standardized interface for all those low-cost manufacturers and get paid by them. If it were easy to fake Tuya requests or set up your own account (trust me, I tried this to integrate a Fingerbot into Home Assistant, but you have to jump through countless hoops, and the developer account keeps expiring every few weeks…

This sounds somewhat backwards to me but maybe missing something... We got a bunch of Tuya devices and was barely aware they even have an app. They paired out of the box to a zigbee2mqtt gateway on the local airgapped network without fuss. No apps, online servers, api keys, vendor signature checks, or such shenanigans at all. I don't think the motion sensors we have from them have the capability to send dhcp over ip even if they wanted.

The Fingerbot also seems to operate over zigbee? Why would you need a developer account in the first place? And why would anyone but Tuya themselves want to hook into their cloud?

Re: Trusting clients is probably a security flaw

#120

Post by baobun »

rikthevik wrote: post #113
planb wrote: post #42

Earlier quoted context omitted.

The problem with Tuya is that they don't manufacture the devices themselves. Instead, they provide a standardized interface for all those low-cost manufacturers and get paid by them. If it were easy to fake Tuya requests or set up your own account (trust me, I tried this to integrate a Fingerbot into Home Assistant, but you have to jump through countless hoops, and the developer account keeps expiring every few weeks…

> they provide a standardized interface for all those low-cost manufacturers and get paid by them As far as trends in IoT goes, I feel like Tuya is mostly positive. I bought some cheap smart plugs at Costco and the default app was worthless. When I learned that they were Tuya-compatible, I managed to get a half-decent (relative to cost) experience out of them. It seems to me that the alternative are a bunch of unmain…

> It seems to me that the alternative are a bunch of unmaintained one-off apps for each fly-by-night manufacturer

Nah, there are options!

HomeAssistant, zigbee2mqtt, ZHA,deCONZ.

Post reply on HN