Hacker News Reader

Comment by zinekeller | Hacker News Reader

I do sometimes laugh at the naïvety of some here. Sorry, what? There is no value of actually securing systems here? It is frustrating to know that in real life, some developers are not really concerned about the security of their dev machines.

Try to install Android Studio (make sure to initialise it!) or Eclipse on your system and tell me where it put its executables. Go and indulge in the horror that your local adb binary can be replaced silently without your knowledge. When most mobile operating systems are designed to isolate components together, we collectively are hindering effective security by allowing these low-hanging fruit on our systems.

Sorry but often I just see countless developers that are not that concerned about security and then ask themselves why are users irresponsible about security.

View on HN

So the ADB binary can be replaced silently by anything running as your user account?

But anything running as your user account can also steal your ssh keys and gain persistence via cron or .bash_profiles or any of a multitude of other methods. How does a writable ADB binary let an attacker do anything more than they could do before?

> But anything running as your user account can also steal your ssh keys and gain persistence via cron or .bash_profiles or any of a multitude of other methods. How does a writable ADB binary let an attacker do anything more than they could do before?

I have no answers on Linux sadly (but you can disable user-side cron so that you can ensure that cron entries are not editable), but on Windows you can lock down your system by not allowing to run executables from non-whitelisted directories (AppLock), so you can only execute programs from specific directories. Does not really prevent stupidity ("I accidentally run NotAVirus.exe from our build directory") but you frustrate attackers from running their own executable (especially that most drive-by attacks rely on the Download folder or Temporary folder being executable). Of course, you need to monitor your build directories for harmful executables but you significantly reduce the attackers' footprint into the system. Additionally SSH keys can be stored in a format where you need to have an active password in order to decrypt them.

The point you were replying to is: Who cares that you can replace the adb binary? Once you have code execution as my user, you have access to my browser data (banking, google developer accounts), my ssh keys, etc.

We need capability-based privilege separation on network-connected machines.

> Once you have code execution as my user

The question is "how"? If you are indeed targeted by state-level attackers, there should be more precautions because you are actively attacked. However, I have stated that "there are low-hanging fruits". I have written up a more extensive reply (https://news.ycombinator.com/item?id=25914440) but the short answer is that you can actually prevent code execution on arbitrary areas on Windows. Upon further research, I now know that there is an analogous equivalent (and maybe competition) for Linux: AppArmor and SELinux. However, I will still see someone replying "there is no solution to this mess" despite having a solution, just unused by developers. It is made harder by other developers who by their choice makes security-conscious developers' lives harder.

> We need capability-based privilege separation on network-connected machines.

Yes, you're correct on that. But abandoning reliable-but-unused security for shiny new thing seems wrong on so many levels.

Reply on news.ycombinator.com