Hacker News Reader

Comment by ARandomerDude | Hacker News Reader

> Power the device off and on weekly.

Thoughts, HN? I can see how this might be good for performance, but how is it good for security?

It's possible to have a security exploit which can compromise a running device, but is not able to make itself permanent across restarts (e.g. changes programs in RAM but not in flash)

That's my best guess.

Concrete example: all the recent ios jailbreaks (aka sandbox escape and/or EoP exploits) are tethered, which means they're undone/reset after a reboot.

This is a good tip to avoid persistence. Lots of exploits won’t survive a reboot and so the target would have to be exploited again.

beermonster has it right.

For a very recent example of this, see the NSO Pegasus scandal from the past couple of weeks.

A reboot "unloads" the malware (until the adversary sends another payload, anyway.)

Running your malicious actions without writing to disk is a very effective way of bypassing a lot of security and forensics technologies.

As soon as you make changes have persistence you have proof and some operators are not oaky with that.

Makes it harder to maintain persistence on the device, I believe. Whether it solves the problem in question is another matter.

I highly doubt this is as complicated as persistence.

1) even on mobiles you still get the occasional webview or other core library update and need to reboot to complete the patch.

2) modern versions of Android use per-file encryption. Periodically rebooting flushes unencrypted buffers.

There is a whole category of potentially exploitable bugs that result from programs simply running. Slow memory leaks, floating point precision loss, and integer overflows to name a few. But this is more likely about clearing caches.

It’s to get rid of exploits that have no persistence.

For example, your running kernel space may be compromised but your on-disk kernel image may be still pristine due to a secure boot chain. That’s why rebooting can help remove such exploits.

a lot of exploits deliberately avoid persistence as an extra layer of protection from detection. Since most folks rarely restart their phones these bugs can live on your phone until a restart. So by restarting your phone on a weekly basis you are potentially wiping out memory only infections.

Another explanation is the hardware root of trust. On iOS, for example, hardware root of trust in a separate physical security processor validates all code in a chain. An exploit cannot gain persistence across a reboot unless it has access to the private signing keys of Apple

Reply on news.ycombinator.com