Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CopperheadOS: A hardened open-source operating system based on Android

copperhead.co

Post reply on HN
Print view View original

81–90 of 105 posts

Re: CopperheadOS: A hardened open-source operating system based on Android

#81

Post by viraptor »

nickpsecurity wrote: post #79
viraptor wrote: post #64

Earlier quoted context omitted.

All systems need it. All systems are already insecure. All desktops systems already implement it. This has been the situation for years now.

No, they need tech that either contains the attack in its own partition or prevents it entirely by language/compiler-level action on the target. Both exist in academia and commercial sector with varying capabilities, prices, maturity levels, and so on. Most such things are rejected in favor of band-aids like ASLR. And the systems continue to get hacked through the very holes covered in bandaids. As he said, if you're…

That's not a practical solution. Sure - you could write super-secure (Ada-style?) code in a verified environment (?), running on verified kernel (SL4?), on secure hardware (got any ideas how to solve rowhammer?). Realistically though - nobody does that (in a product which we can buy). Producing any application in that kind of environment would be too expensive and not possible for most companies. We don't even have secure hardware available. Academia will experiment with that. Some industries will care enough to apply it.

But in a mass-produced software/hardware? Realistically my choice for productive desktop is OSX/Win/Lin. We can talk about cool, perfect solutions for a very long time. In the meantime I'm making sure my apps are running with ASLR. I hope you're not actually advising people not to use it, just because there's some ideal solution maybe possible on the horizon, that doesn't run any apps they need?

Re: CopperheadOS: A hardened open-source operating system based on Android

#82

Post by dsl »

conradev wrote: post #78
dsl wrote: post #76

You had me interested until "..based on Android." What we need is more original codebases in the mobile ecosystem, not endless modifications on top of the same old shaky foundation.

That shaky foundation also has a large ecosystem of useful software. I guess it doesn't need to be "based on Android" to run Android apps, though. I'm not too familiar with security on Android (much more familiar with iOS) – what are the weakest links?

Android 0days at this point are so numerous, I find they are relatively worthless compared to time invested elsewhere. Other people seem to have the same experience (i've seen offers of double that amount for iOS remotes): http://blogs-images.forbes.com/andygreenberg/files/2012/11/e...

Re: CopperheadOS: A hardened open-source operating system based on Android

#83

Post by nickpsecurity »

viraptor wrote: post #81
nickpsecurity wrote: post #79

Earlier quoted context omitted.

No, they need tech that either contains the attack in its own partition or prevents it entirely by language/compiler-level action on the target. Both exist in academia and commercial sector with varying capabilities, prices, maturity levels, and so on. Most such things are rejected in favor of band-aids like ASLR. And the systems continue to get hacked through the very holes covered in bandaids. As he said, if you're…

That's not a practical solution. Sure - you could write super-secure (Ada-style?) code in a verified environment (?), running on verified kernel (SL4?), on secure hardware (got any ideas how to solve rowhammer?). Realistically though - nobody does that (in a product which we can buy). Producing any application in that kind of environment would be too expensive and not possible for most companies. We don't even have s…

I'm talking things as simple as Code-Pointer Integrity, common tools recoded in safer language, or app-level sandboxing with or without microkernels. People rarely use strong stuff even if it's a straight-foward download, recompile, or configuration. Hell, most wont use protected messaging when it's as easy as Signal. It's a demand-driven problem largely about convenience and access to insecure apps.

Btw, solutions like OKL4 exist already and are fielded w/ Android + other OS support. Android hardening tech also exists. Cryptophones also exist. Not perfect, future tech so much as existing tech companies and FOSS developers mostly ignore. With exception of Blackberry that tried something decent by integrating QNX with stellar results.

Re: CopperheadOS: A hardened open-source operating system based on Android

#84

Post by strcat »

dsl wrote: post #82
conradev wrote: post #78

Earlier quoted context omitted.

That shaky foundation also has a large ecosystem of useful software. I guess it doesn't need to be "based on Android" to run Android apps, though. I'm not too familiar with security on Android (much more familiar with iOS) – what are the weakest links?

Android 0days at this point are so numerous, I find they are relatively worthless compared to time invested elsewhere. Other people seem to have the same experience (i've seen offers of double that amount for iOS remotes): http://blogs-images.forbes.com/andygreenberg/files/2012/11/e...

Android vulnerabilities aren't more numerous than iOS vulnerabilities. The key difference is that 97% of Android devices do not get security updates. There is no need for 0 day vulnerabilities for attackers, in general. Few users have Nexus devices.

Re: CopperheadOS: A hardened open-source operating system based on Android

#85

Post by pcwalton »

viraptor wrote: post #81
nickpsecurity wrote: post #79

Earlier quoted context omitted.

No, they need tech that either contains the attack in its own partition or prevents it entirely by language/compiler-level action on the target. Both exist in academia and commercial sector with varying capabilities, prices, maturity levels, and so on. Most such things are rejected in favor of band-aids like ASLR. And the systems continue to get hacked through the very holes covered in bandaids. As he said, if you're…

That's not a practical solution. Sure - you could write super-secure (Ada-style?) code in a verified environment (?), running on verified kernel (SL4?), on secure hardware (got any ideas how to solve rowhammer?). Realistically though - nobody does that (in a product which we can buy). Producing any application in that kind of environment would be too expensive and not possible for most companies. We don't even have s…

Whoa there. There's an entire spectrum of options in between "ASLR" and "formally verified everything" that defend against memory safety related RCE. Such as, for instance, writing in a memory-safe, high-level language where reasonable (which is in fact not only practical, it's what Android does).

(That's not to say ASLR isn't great as a way to harden the C and C++ code at the core levels of the system, of course. Daniel Micay's work here is very solid.)

Re: CopperheadOS: A hardened open-source operating system based on Android

#86

Post by hackuser »

strcat wrote: post #70
hackuser wrote: post #62

Copperhead seems designed to protect against malicious attackers, but does it protect confidentiality against commercial tracking (another kind of attack)? I'll add: I haven't come across another fork of Android that focuses on security so I'm rooting for these guys.

Privacy enhancements are definitely within the scope of the project. Most of the current features are exploit mitigations though. If you look through https://copperhead.co/android/docs/technical_overview you'll see that there are a few privacy features already, and there are many in-progress. They won't be listed there until they're actually completed though.

Are you connected to the project somehow?

Re: CopperheadOS: A hardened open-source operating system based on Android

#87

Post by viraptor »

pcwalton wrote: post #85
viraptor wrote: post #81

Earlier quoted context omitted.

That's not a practical solution. Sure - you could write super-secure (Ada-style?) code in a verified environment (?), running on verified kernel (SL4?), on secure hardware (got any ideas how to solve rowhammer?). Realistically though - nobody does that (in a product which we can buy). Producing any application in that kind of environment would be too expensive and not possible for most companies. We don't even have s…

Whoa there. There's an entire spectrum of options in between "ASLR" and "formally verified everything" that defend against memory safety related RCE. Such as, for instance, writing in a memory-safe, high-level language where reasonable (which is in fact not only practical, it's what Android does ). (That's not to say ASLR isn't great as a way to harden the C and C++ code at the core levels of the system, of course. D…

I was refering to "prevents it entirely by language/compiler-level action on the target". I understand there's a whole spectrum in prevention and mitigation. But "prevents it entirely" is an extreme, just as "formally verified everything" is an extreme.

I'm just ticked off by people lately repeating that ASLR is a bandaid, like it's a bad thing. It's a bandaid, but it can still crash-instead-of-own your app/system with 99.XX% probability. Why complain about it being accepted rather than say: "great, we're nowhere near secure, but at least we have something that works most of the time, now we can work on better protection". Safe runtimes can fail too (CVE-2015-3837 / serialization bug).

Basically, if anyone reads threads like this and thinks "it's a bandaid, it's not needed / it doesn't protect me", then we're all worse off.

Re: CopperheadOS: A hardened open-source operating system based on Android

#88

Post by hackuser »

naasking wrote: post #73
tkinom wrote: post #14

I like to see it enable the user to logs and optionally block connections attempt base on IP/dns names with both whitelist and blacklist. And track/logs all of them per Apk.

Whitelists and blacklists are useless security theatre. Any non-blacklisted IP could proxy to a blacklisted IP, and whitelisting just means you have to jump through hoops just to get your work done, which users will always do.

> Any non-blacklisted IP could proxy to a blacklisted IP

There always are ways to defeat any security; the goal is to make it more difficult and costly for the attacker, and blacklists do that.

> whitelisting just means you have to jump through hoops just to get your work done, which users will //always// do.

I agree that's true for most end-users, but the HN crowd and other power users could make good use of it.

Re: CopperheadOS: A hardened open-source operating system based on Android

#89

Post by strcat »

hackuser wrote: post #86
strcat wrote: post #70

Earlier quoted context omitted.

Privacy enhancements are definitely within the scope of the project. Most of the current features are exploit mitigations though. If you look through https://copperhead.co/android/docs/technical_overview you'll see that there are a few privacy features already, and there are many in-progress. They won't be listed there until they're actually completed though.

Are you connected to the project somehow?

Yes, I'm the (lead) developer of the OS.

Re: CopperheadOS: A hardened open-source operating system based on Android

#90

Post by hackuser »

hackuser wrote: post #62

Copperhead seems designed to protect against malicious attackers, but does it protect confidentiality against commercial tracking (another kind of attack)? I'll add: I haven't come across another fork of Android that focuses on security so I'm rooting for these guys.

Partly in answer to my own question, they don't plan to disable Android's connections to Google.

https://github.com/copperhead/bugtracker/issues/184

https://github.com/copperhead/bugtracker/issues/194

EDIT: To avoid any possible confusion, Google Apps / services aren't included in Copperhead; I'm talking about other connections to Google.

Post reply on HN