Hacker News Reader

Comment by awqrre | Hacker News Reader

Locked bootloader should not have anything to do with encrypted user data being accessible or not... With a locked bootloader on Android devices, it can be difficult to flash a Custom ROM but your password won't help in that case... your password/pin should be used to decrypt your data.

View on HN

Unlocking the bootloader - a prequisite for loading the ram dumping software - causes the data partitions and cache to be wiped. This might not clear the keys from ram, but now the attacker has to find a way to dump the data from flash before unlocking the bootloader for the keys to be of use.

It does, because they can't retrieve the keys from memory otherwise - Unlocking the bootloader is essentially opening the phone up to malicious code execution by anyone with physical access.

It would be more difficult and model-specific, but couldn't they attach a device to read the RAM chips directly? To perform this on most modern phones, they have to disassemble it anyway to be able to toggle the power quickly enough (since there's no user-replaceable battery).

They probably wouldn't be able to attach anything to the ram directly, as the ram chips on modern phones are soldered down BGAs. To get at the pins, they'd have to de-solder them, which would heat up the chips in the process. It might be possible to get at the ram over JTAG or some other debug bus in some devices, though.

This is probably in the realm of "if you're subject to this level of attack you have bigger problems", but, I wonder if it would be possible to laser drill after-the-fact micro vias through the PCB to get at all the BGA pads with absurdly small probes.

There are a couple more dimensions on recent (more recent than this article) models running M. There's a TEE (~android TPM equivalent) chip involved in encrypting user data, it knows whether your bootloader is locked or not, and it will not yield the keys to locked user data when running in unlocked mode.

Your right, it doesn't have anything to do with user data being accessible, but an unlocked bootloader will mean the barrier to finding a vulnerability is much lower than otherwise.

A locked bootloader is an essential line of defense.

Reply on news.ycombinator.com