Virtual Machine as a core Android Primitive • Hacker News Board

Re: Virtual Machine as a core Android Primitive

#151

Post by Animats » Wed, Dec 06, 2023, 6:40 PM UTC

codedokode wrote: post #116

Animats wrote: post #79

So what is something running in this virtual machine allowed to do? Talk to the Internet? Talk to the screen? Talk only to whatever started it? How much of this is closed source?

This is probably for playing DRM content, apps like Netflix will provide an encrypted VM image to play a movie.

How does the video get out? That implies a strong connection to the screen, which has a big attack surface.

This is the classic problem with isolation via virtual machines. To do anything, they have to talk to something, and that's where the security breaches occur.

Re: Virtual Machine as a core Android Primitive

#152

Post by pjmlp » Wed, Dec 06, 2023, 7:14 PM UTC

themoonisachees wrote: post #147

pjmlp wrote: post #118

Earlier quoted context omitted.

Anyone that misuses their root account to have an exploit taking place inside the organization gets shown the door.

And what is "getting shown the door" with your own device? A Fullscreen message telling you you are now banned from the device you spent a months wages on?

Ransonware, or a systray full of little applications the nephew has to fix during Christmas vacations.

Re: Virtual Machine as a core Android Primitive

#153

Post by bonzini » Wed, Dec 06, 2023, 9:31 PM UTC

worthless-trash wrote: post #129

bonzini wrote: post #91

Earlier quoted context omitted.

Yes, and the policy of QEMU is to not assign CVEs for bugs that would generally be hit only when QEMU is used as a development platform, as opposed to using it to offer virtualization services. https://www.qemu.org/contribute/security-process/ We are colleagues by the way. :)

> We are colleagues by the way. :) I'm aware, I see you comment here regularly. QEMU doesn't have to assign CVE's but any other CNA can. I do not believe that its good security or even good practice to negotiate out of exploitable flaws. Its a dis-service to users. I don't have enough skin in the game to change upstream QEMU's mind on this, systems in exploitable configurations are just as exploitable with or without…

The question is whether something is exploitable or just a crash. It is also a disservice to user to worry them about having to do an immediate update and evacuation of all hosts because of an out of bounds access in Gravis Ultrasound emulation.

Would any crash in GCC be a vulnerability because compilers are fed untrusted source code? Perhaps, but in practice godbolt.org is going to be the only case in which you care.

Re: Virtual Machine as a core Android Primitive

#154

Post by rstat1 » Wed, Dec 06, 2023, 11:05 PM UTC

3abiton wrote: post #105

rstat1 wrote: post #51

Its annoying that I can't use this without greater-than-normal-user access.

It is still baffling that root is so shunned upon in the Android communities. Imagine not having root access to your linux laptop. Magisk users are persecuted and punished by Google for getting root access, which is the bare minimun for a device you own.

>> It is still baffling that root is so shunned upon in the Android communities.

I haven't seen this personally (not saying it isn't a thing to be clear, just I haven't seen it).

My major issue is that for some reason there are carriers in the US that seem to think a user having control over their own device is something to frown on. I get the potential support and warrently nightmare involved but on the other hand it's not a super easy process that one would do accidentally.

Re: Virtual Machine as a core Android Primitive

#155

Post by remram » Wed, Dec 06, 2023, 11:39 PM UTC

teleforce wrote: post #123

usrusr wrote: post #92

Back at university one lecture included an infographic about how CPU and operating system features like MMU, increasing register width and the like all started at mainframe-scale installations and trickled down to desktop scale systems and later to handheld devices at a surprisingly consistent pace. It was the time w2k was trying to make NT features mainstream and J2ME arrived on phones. I extrapolated a little and m…

The multi-user part for Android OS is not an extrapolation, it is inevitable. Fun facts, Unix name is a joke to Multics, where Multi stands for multi-user, and everyone know what happened soon to Unix single user name indication.

Multics stands for Multiplexed Information and Computer Services (not multi-user).

I don't think UNIX was ever meant to be single-user. This interview suggests that's not where the name came from anyway: https://www.linuxjournal.com/article/7035

Re: Virtual Machine as a core Android Primitive

#156

Post by nl » Thu, Dec 07, 2023, 12:02 AM UTC

saagarjha wrote: post #89

nl wrote: post #53

Earlier quoted context omitted.

So I'm most familiar with using this in cases like machine learning on private data in cloud environments where you want to make it impossible for the cloud operator to see the data you are using. I think there are usecases like this outside the mobile _phone_ that are interesting. For example on-device learning for edge devices where the device is not under your control.

See the thing here is that if the device is not under "your" control ("you" being a company or something, and the device being owned by a user) I don't think they will really appreciate you using their hardware to train your model in a way they don't get to see. Why would I want to support this on my own phone?

> I don't think they will really appreciate you using their hardware to train your model in a way they don't get to see.

This absolutely isn't the case. I know a number of vendors who are deploying edge ML capacity in satellites where the use case is for "agencies" to deploy ML algorithms that they (the vendors) cannot see.

Re: Virtual Machine as a core Android Primitive

#157

Post by nl » Thu, Dec 07, 2023, 12:05 AM UTC

saagarjha wrote: post #87

nl wrote: post #54

Earlier quoted context omitted.

As I said in my other response, I make heavy use of trusted (confidential) VMs for machine learning in cloud environments. There are also vendors that are doing smart contract execution in trusted computing devices so you can get the benefits of trusted execution without the overhead of everyone executing the same code.

There are a handful of potential uses for confidential VMs, but not many of them really seem to make sense on phones?

The issue here isn't the technology though, it's imagination.

Think about gaming in VR. You might want to make a game where the ML can adapt to the physical peculiarities of a person (think like personalized audio for airpods) but want to guarantee it isn't giving the person an advantage. Even simple things like setting up a VR system (or any physical computing device) can give an advantage to someone if corruptible.

At the moment there are lots of "anti-cheat" technologies that attempt to solve this, but really it needs trusted execution.

Re: Virtual Machine as a core Android Primitive

#158

Post by fooker » Thu, Dec 07, 2023, 12:08 AM UTC

fgoesbrrr wrote: post #99

Shoop wrote: post #52

How does two way isolation work? How do you prevent the host kernel (which presumably has full control of the hardware?) from inspecting the guest VM?

I don't know about Android, but AMD CPUs support encrypting regions of physical memory with different keys which are accessible only to one particular VM running, but also not accessible to the host: AMD Secure Encrypted Virtualization (SEV) https://www.amd.com/en/developer/sev.html

Does every memory read/write have to go through decryption/encryption or just the paging mechanism?

Re: Virtual Machine as a core Android Primitive

#159

Post by ndriscoll » Thu, Dec 07, 2023, 12:10 AM UTC

pjmlp wrote: post #146

josephcsible wrote: post #143

Earlier quoted context omitted.

Sure, you shouldn't always get to be root on other people's computers. But you absolutely should get to be root whenever you want on your own computers.

Depends, that is how normies get Ask Jeeves toolbars.

Now the ad- and spyware just come bundled into the OS, so the main difference is that you at least have some ability to mitigate malware with root.

Re: Virtual Machine as a core Android Primitive

#160

Post by nl » Thu, Dec 07, 2023, 12:12 AM UTC

refulgentis wrote: post #57

nl wrote: post #25

Earlier quoted context omitted.

I agree there are currently better ways of doing this (because as you mention the resource/protection trade off for this technology on this application is sub-optimal), but the context here is as an example on HN where the data privacy is obvious so I didn't have to write a whole paper explaining it.

Its "not even wrong", if you had a million monkeys on a million typewriters with a million trillion millenia, still, none would come up with a paper long enough to explain how that'd help anything (ex. trivially, microphone)

> trivially, microphone

Qualcomm has trusted input for at least touch sensors into their trusted enclave (unsure about microphone input at this point). Look for "TUI" in https://www.qualcomm.com/content/dam/qcomm-martech/dm-assets...