Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pokemon Go, Security, and Obsolescence

community.rapid7.com

Post reply on HN
Print view View original

71–80 of 109 posts

Re: Pokemon Go, Security, and Obsolescence

#71

Post by pwnna »

tombrossman wrote: post #12
pwnna wrote: post #2

Now Niantic's decision to disallow root devices, imo, is pretty regretful, as serious botters will likely be able to get around that restriction regardless. This only serves to punish users who are stuck between having a root-enabled custom ROM or a stock ROM where critical root exploits may exist. One thing that I observed is that no one seems to be interested in producing a ROM that is both stable, has a variety of…

> I personally got around this problem by compiling a build of CyanogenMod without root enabled, but with things like FDroid (with PrivilegeExtension) and adblock built-in to the ROM itself... I just bought a Nexus 5x and loaded CopperheadOS on it, and to my dismay I see Ad-Away from F-Droid requires root to function (plus a couple other apps I really like). How much of a hassle is it really, because I absolutely wan…

> How much of a hassle is it really, because I absolutely want system wide ad blocking and I worry that I will be defeating the purpose of using a hardened OS in the first place?

Ad-away works by using a host file to block. The hosts file is generally not writable by the user without root as it lives on a read only partition (/system).

Another way to block ads is to connect to a VPN that blocks thoses hosts for you, however that is more cumbersome to setup.

While hosts blocking is not perfect... my thought on this was to expose a limited API that allows apps to update the hosts file without having root. This could be sketchy and a security risk on its own tho, because you're essentially hijacking DNS... In addition, I don't think the community is interested in this because they all love root..

> Do you rebuild and flash each OS update as a new ROM?

Every month, immediately after the security bulletin and a resync.

> Is all your data on the phone persistent or backed up & restored each time?

So android has a /system partition and a /data partition. When you reflash your system, the data partition (where all your apps, settings, what not are stored) is left untouched. Android will detect this and perform an upgrade operation on the /data partition, if applicable.

Re: Pokemon Go, Security, and Obsolescence

#72

Post by lucb1e »

roywiggins wrote: post #66
lucb1e wrote: post #59

Earlier quoted context omitted.

Almost every country has something like that. The Dutch Agentschap Telecom will hunt you down for transmitting a fake GPS signal too. The thing is, nobody cares if you send a signal too weak to go beyond a meter of your pocket. That's why it's totally legal to send FM on registered frequencies as long as your output is under a certain amount. Same with WiFi even. I heard about someone looking into GPS spoofing once i…

This is not always true - FM transmitters were not legal in the UK, regardless of power, until 2011 or so. Can't imagine anyone was actually prosecuted for using one, though.

If there is no chance of getting caught anyway, there is only moral law. Since you're not disturbing anyone with an FM transmitter in your car that transmits only as far as you car radio, it passes moral law.

Interesting to learn that it wasn't legal in the UK though. I wouldn't know of the legality in the Netherlands, but I know they're in use and nobody's complaining.

Re: Pokemon Go, Security, and Obsolescence

#73

Post by trakout »

deanclatworthy wrote: post #15
lini wrote: post #8

Earlier quoted context omitted.

The problem is that you don't need root for GPS spoofing. Botters also don't care about SafetyNet (used to detect root before the game starts), since they reverse engineer the API and make REST calls directly. Furthermore, there are ways around the root check - mostly involving hiding the su binary and some additional tweaks.

Furthermore, you can buy GPS spoofing devices anwyay which you can just carry around with you in your pocket.

Furthermore, you don't need a device at all if you want to bot. The unofficial API (and client-side signing) was figured out a while back.

Re: Pokemon Go, Security, and Obsolescence

#74

Post by evilDagmar »

Yes, Niantic was very lazy in their attempts to stop spoofers and botters. Rather than write some code to actually look for the few pieces of software the cheaters are using, they just started invoking Android's SafetyNet. Notably, very little was accomplished.

The problem? SafetyNet does not care about game spoofers/cheaters. That's literally not what it was designed to do. Pokemon Go does not represent "planned obsolescence". It represents Niantic being too damn lazy to search an array result for "Xposed" and instead invoking something that will make it look like they expended some effort.

It takes about five minutes to make a stock CyanogenMod device "compatible" with SafetyNet. All you have to do is rename two files, specifically /system/xbin/su and /system/bin/su. Boot into recovery (TWRP or whatever you have), and start a terminal from there (where you are as "root" as root gets, and this will always be so) and type `mount /system` to start. Next, rename those two files. Lastly unmount /system and boot normally. SafetyNet will be happy, which means Pokemon Go and Android Pay will also be happy. If you want "root access" back on your phone, all you have to do is go back into recovery and rename those two files back to what they were.

Re: Pokemon Go, Security, and Obsolescence

#75

Post by mynameisvlad »

rickyc091 wrote: post #51
Drdrdrq wrote: post #36

Earlier quoted context omitted.

Not really. It doesn't matter if the phone is rooted or not, what matters is whether it is feeding false gps data or not. Bots will soon find a way around this (non-rooted) restriction anyway. That said, proper protection against cheating would involve using markers (other phones?) in vicinity, so it should be possible too.

Yes, bots will most likely always find a way, but I think it's more about thwarting the casual users. If you could gps hack by simply installing an app more people would do it. By making it extremely tedious, the causal user won't be as inclined to do it since the time it takes to figure it out won't be worth it. I don't condone Niantic's behavior, but I understand it.

To me, it would make more sense if they weren't also banning users their auto-detection system thinks are spoofing GPS. A system which is fairly overzealous, might I add. I was banned for being in Japan, for example. One day out of the blue on my vacation, got the ToS violation notification which still hasn't been reversed, two weeks later.

Re: Pokemon Go, Security, and Obsolescence

#76

Post by evilDagmar »

pwnna wrote: post #2

Now Niantic's decision to disallow root devices, imo, is pretty regretful, as serious botters will likely be able to get around that restriction regardless. This only serves to punish users who are stuck between having a root-enabled custom ROM or a stock ROM where critical root exploits may exist. One thing that I observed is that no one seems to be interested in producing a ROM that is both stable, has a variety of…

You literally didn't need to do any of this (and I'm astonished someone would wait through a CM build rather than do ten minutes of research). Also, I'd like to remind you that SEAndroid (i.e., SELinux) doesn't give a fig about "root" so your statements about that are quite wrong.

You can simply rename your su binaries through the recovery environment to disable them, which neatly disables "root access" and makes the SafetyNet check Niantic is invoking pass with flying colors. Should you need them again, they're only a reboot and couple of mv invocations away.

Re: Pokemon Go, Security, and Obsolescence

#77

Post by evilDagmar »

djsumdog wrote: post #4
pwnna wrote: post #2

Now Niantic's decision to disallow root devices, imo, is pretty regretful, as serious botters will likely be able to get around that restriction regardless. This only serves to punish users who are stuck between having a root-enabled custom ROM or a stock ROM where critical root exploits may exist. One thing that I observed is that no one seems to be interested in producing a ROM that is both stable, has a variety of…

I wrote this about Android a while back: http://penguindreams.org/blog/android-fragmentation/ The TLDR is that it'd be nice if Android was more like Windows/Intel: install the OS (i.e. AOSP), drivers (or binary driver package format and an SDK to auto-build it) and boom you're done. Clean, stock, standard. Same with many Linux distros on x86/64. I need to write an update to the article though. Lately I've been strugg…

Android kernels are built differently from PC kernels because unlike a PC where you might upgrade the motherboard, or add/remove hardware that would change what kernel modules are needed (and still expect the PC to boot), a cell phone almost never changes its hardware configuration after installation. If the phone is a Wombat 4s, it'll have X, Y, and Z hardware components and these will never ever change. If it's a Foobar 8000, it'll have X, Y, and Q, and there might be two different sizes of W which aren't even something that requires a driver and those will never change either. Including all the modules that might be present on any device compatible with the same CPU architecture would mean wildly more than 90% of the space used by the kernel/drivers would be completely and utterly wasted (and theres at least four more types of resources that would also be wasted that come to mind). This is not a thing one does with a device expected to run as long as it possibly can with a very limited supply of power and less RAM than pretty much any desktop machine you'd care to use.

Re: Pokemon Go, Security, and Obsolescence

#78

Post by evilDagmar »

Drdrdrq wrote: post #36
legulere wrote: post #18

Earlier quoted context omitted.

A few botters don't hurt Pokémon go. But when it's easy to bot, lots of people will bot. It's easy to circumvent anti root, but it's impossible to use the same way for lots of devices without niantic being able to block it again. So it really makes sense for them to go this way IMO.

Not really. It doesn't matter if the phone is rooted or not, what matters is whether it is feeding false gps data or not. Bots will soon find a way around this (non-rooted) restriction anyway. That said, proper protection against cheating would involve using markers (other phones?) in vicinity, so it should be possible too.

The spoofers have had a way around this for some time now, as GPS spoofing simply does not require root privileges.

Niantic is not actually making any attempt to look for GPS spoofing software. They simply invoke Android's SafetyNet which doesn't care about GPS at all but does care about other things which happen to coincide with what's on some cheater's phones. It will never be anything like an effective measure against GPS spoofing.

Re: Pokemon Go, Security, and Obsolescence

#79

Post by nradov »

pwnna wrote: post #71
tombrossman wrote: post #12

Earlier quoted context omitted.

> I personally got around this problem by compiling a build of CyanogenMod without root enabled, but with things like FDroid (with PrivilegeExtension) and adblock built-in to the ROM itself... I just bought a Nexus 5x and loaded CopperheadOS on it, and to my dismay I see Ad-Away from F-Droid requires root to function (plus a couple other apps I really like). How much of a hassle is it really, because I absolutely wan…

> How much of a hassle is it really, because I absolutely want system wide ad blocking and I worry that I will be defeating the purpose of using a hardened OS in the first place? Ad-away works by using a host file to block. The hosts file is generally not writable by the user without root as it lives on a read only partition (/system). Another way to block ads is to connect to a VPN that blocks thoses hosts for you,…

Apple added specific ad blocking features to iOS 9, and I don't think those rely on editing the hosts file. So in principle a similar design could work for Android, although I doubt Google would ever support that.

Re: Pokemon Go, Security, and Obsolescence

#80

Post by evilDagmar »

tedmiston wrote: post #5
pwnna wrote: post #2

Now Niantic's decision to disallow root devices, imo, is pretty regretful, as serious botters will likely be able to get around that restriction regardless. This only serves to punish users who are stuck between having a root-enabled custom ROM or a stock ROM where critical root exploits may exist. One thing that I observed is that no one seems to be interested in producing a ROM that is both stable, has a variety of…

They've gotta stop the GPS spoofers somehow. It's not like this was the first solution they jumped to to stop cheaters. Maybe this was the 80/20 solution over more advanced location anomaly detection methods against their database.

Wow. You really have to stop drinking the Kool-Aid. This actually was the first thing they did, and very possibly the only thing they've done specific to Pokemon.

Niantic uses the same techniques they used for Ingress to deal with GPS spoofers, and they're not that advanced. Play for an unrealistically long period of time without stopping and you might get a tempban and flagged for careful examination. Appear to travel at jet plane speeds by performing non-idempotent actions without stopping by an airport first, or doing this too many times in a short period, and you'll also get flagged for possible banning. Beyond that, they're really not doing much and it doesn't really qualify as "advanced localtion anomaly detection". You're giving Niantic far too much credit.

Post reply on HN