Hacker News Reader

Comment by gjsman-1000 | Hacker News Reader

I had speculated for a while that Secure Boot, Widevine, Trusted Computing, all of it seems like they have some pretty serious central points of failure. So much so, that it would be a modern heist of the century if they were stolen.

If someone (for example) got Apple's iOS signing key and Apple's HTTPS certificate, Apple could suffer catastrophic damage. If someone got the PlayStation 5 signing key or the Xbox One signing key, catastrophic damage there. In a way, it's a beautiful, super-secure house... built on a single ludicrously powerful point of failure. Good thing we don't have any corrupt government agencies who might want to bribe someone for keys... yet... hopefully...

This is actually something I would fear for the future. There have been countless physical heists - most recently in Antwerp, Belgium, where over $100 million in diamonds were stolen in 2003. We haven't had a major signing key stolen yet, but there's always that first day... if you can't keep $100M in diamonds safe, can you really be sure that you can keep a hardware signing key safe forever? Heck, the logistics of stealing the diamonds is insane - but stealing a key only takes a pencil and a piece of paper.

View on HN

I would also like to add to this the recent paper documenting the attacks on the 4K Blu-ray ecosystem for another reason this could happen.

It was actually really secure, until... PowerDVD. It included the AACS 2.0 Copy-Protection Scheme as an encrypted, obfuscated DLL. Which would've been fine - except they accidentally were shipping an unencrypted, unobfuscated DLL containing all the algorithms alongside it. Big oops there. As for the key material itself - it used SGX [a Secure Enclave for Intel CPUs], but it turns out it didn't check for known old insecure hacked SGX firmware, any SGX firmware would do despite Intel strongly warning that isn't safe. So for pirates, Inadvertently unencrypted DLL + bad SGX provisioning = Ripping movies ~1 year after release despite completely new DRM.

There's always the possibility for stupidity to leak a key.

One engineer's "stupidity" is another engineer's "plausible deniability". ;)

A passing thank you to gjsman-1000 as his words resurfaced some history. As one with many years behind the curtain I recall an old trick that many glanced over since only 'advanced developers' long ago understood the impact: Compiling public releases as debug. Many a software would fail to strip the debug symbols from their code and so the games began. Using Softice and ollydbg along with ones favorite hex editor capable of sprinkling a few nop nops where needed and boom. The really bad ones were the companies that failed to comprehend what the pdb file was and shipped that with releases in debug mode - OOPS, there goes the i.p.

Similar to how Bethesda shipped the DRM-free version of Doom Eternal alongside the download for the DRM version.

AACS is designed to expect some keys will leak, so they have revocation mechanism for new titles.

Right... but here's the hilarious (for a pirate) bit.

AACS knew player keys would leak and hardened their system against it... but they didn't realize that BDXL readers, which existed before 4K Blu-ray was released, could actually read 4K discs with modified firmware. Also, said BDXL readers had no Secure Boot and could be easily modified.

With a modified player (which they didn't expect), you can read directly from the disc the data, which is (at the end of the encryption chain) encrypted with a per-disc key that is unchangeable. Normally this wouldn't matter because you can't read the disc directly - but with the modified player, you can. The player key goes through a long, complex process to end up with that unchangeable, unrevokable unique disc key. The pirates solution? Keep the drive keys when they discover them secret, and just generate the disc-unique keys and post them online for every disc. Then, with the modified drives, every disc in the list is permanently broken, and AACS LA has no idea what drive key is leaked and can't revoke it.

And so here we are... AACS LA doesn't know which drive key the pirates are using, and when disc keys are generated, the disc is cracked forever. Worst of all worlds for AACS...

>but stealing a key only takes a pencil and a piece of paper.

You need to have a serious discussion with your HSM vendor if that is the case.

In 2019, Ledger investigated their HSMs, and got it to the point where they achieved a persistent backdoor. On the HSM. Because the HSM they targeted didn’t actually have working Secure Boot(!). It was also FIPS-certified if that comforts you.

https://i.blackhat.com/USA-19/Thursday/us-19-Campana-Everybo...

Better hope Apple didn’t use that one - and that they regularly apply updates… odds of Apple trucking along with a several-year-old HSM don’t seem that low…

"only takes a pencil and a piece of paper"

The attacker: - controls the host - can communicate with the PCI card

I wasn't saying you could just steal it as though it was on paper - you'd need to run terminal commands on even the least-secured system. I'm more talking about how, if you were an insider at a company (or managed to sneak in), you could potentially attack the HSM on-premises and dump the key, then smuggle it out with pencil and paper instead of having to sneak out the entire HSM (which would be quite bulky, likely to be detected as stolen)...

If Apple was using that HSM model (which is only FIPS-2 Level 3, which is still bad but maybe not as secure as a FIPS-4 they would use), an employee could potentially acquire a similar model at home, discover the vulnerabilities, and then exploit it on-premesis under the guise of a firmware update or maintenance. After that, jot the key down on an index card and put the HSM back like nothing happened. Sleep on it for 3 years so nobody remembers, and then wreak havoc.

OK, but even then ... an offline root CA should be powered down and locked inside a safe. An online CA should be inside a data-center that has specific staff with badge access, audit trails, surveillance video and probably be in its own separately locked cage.

I don't believe they do.

Getting to it might be very, very hard. But once it's in your hand you've got it. Diamonds can found as you're leaving the building, or you can be stopped at the airport, or the big pile in your house can be found, etc.

A signing key is like, 4096 bits at most? 4 sms messages will do it.

So the plan is to ... what ... break the physical security precautions of the HSM during a burglary and then leave without the operator noticing? When I say "break the physical security precautions" that typically involves things like grinding open the casing, depotting the innards, avoiding trigger the self-zeroing mechanism etc etc. and doing so while avoiding the anti-tamper sensors.

The threat is more of an insider one, and the human element is always the weakest link in the chain.

If the key is located only in the HSM, and there are no known flaws in the HSM, yep, that's a hard nut to crack, I'm not going to claim I could do it. But given enough resources, with time and planning and insiders? Take a look at https://cryptosense.com/blog/how-ledger-hacked-an-hsm - and that's a remote attack.

Or have a corporate spy join the security team 3 years prior, and do just one subtle thing?

The Googles and Apples of the world are probably safe against even their own people, but do you trust Tracfone?

No hand waving: what “one subtle thing” will this insider do to make this attack possible? I’m guessing FIPS 140-2 has already thought about it.

HSMs are hardened against individual bad actors. Their threat model envisages the presence of nation state actors.

Is it possible that an HSM attack happened here? I wouldn’t bet on it.

I think their point is that it's easier because you don't need to do the "leave without the operator noticing" that you need to for physical items. Once you have access to those 4096 bits you don't have to escape with them, you just need to transmit 4 sms messages.

An HSM is going to make that difficult. The whole point of an HSM is that you can’t get the key from the HSM, you can only take the entire HSM with you.

Of course it is possible to read a key from an HSM, it’s just designed to be incredibly difficult. I don’t think I would be able to do it, at all, even if I could bring the HSM home with me for a couple weeks.

And in the case of the HSMs I've dealt with, just taking it home is enough to render it useless without some incredibly specific and difficult precautions.

Are you familiar with the threat model an HSM is designed to counter?

Are they though? I doubt that Apple, or Xbox, or PlayStation, use HSMs for storing their most sensitive keys. If something goes wrong with the HSM, can you recover the keys, or did you just bork your update system forever? In which case, does the key exist outside the HSM? If it only exists on multiple HSMs, how is it protected in transit between them, and is that vulnerable?

All this, and more, have been successfully implemented many times. Watch the videos of the DNSSEC key ceremonies to get a bit of an idea about how deeply thought out these processes around hardware roots of trust work.

Unfortunately, the HSM vendors are generally just as shifty as a typical SaaS vendor, so don’t believe their promises of secret inviolability if you can get uninterrupted time alone with a device.

Realistically, any decent shop manages all of these risks pretty well, but there’s a loting rigmarole to do it robustly.

That's why your HSM supports, for example, the ability for an appropriate entitled crypto officer to export the private key onto multiple different smart cards for separate custody with M of N required to restore the key, and all that other good stuff.

Right... but at the same time, does that mean that if I break into the homes of Phil Schiller, Tim Cook, Craig Federighi, Greg Joswiak, Jeff Williams, and Johny Srouji and steal their keys, that I could reassemble the key that would normally be stored on a HSM in Apple Park?

In some ways attacking the homes might be easier than attacking Apple Park. (Just thinking out loud...)

Assuming that you also can get those people to disclose the eight-digit PINs that were required by the crypto officer at the time the custodians enrolled their smart cards?

Getting the pins would be the easiest part.

If you think attacking the homes of billionaires is easy or novel, I suggest that perhaps you have not considered that you are not the first person with that idea.

Private homes of the ultra wealthy and powerful are usually protected in non-obvious ways that most houses on most streets are not, to put it mildly. It turns out that machine guns are legal for private citizens (such as a 24/7 armed private security team), even in California, if you are wealthy and connected enough.

Yes... and no. Worth remembering according to the Steve Jobs biography he had no security in his suburban home and left the back door unlocked every night, and all the neighbors knew that's where Steve Jobs lives. (Bill Gates once visited and remarked, "You live here? All of you?") On the other hand, for an attacker, this may have been an obvious sign Steve Jobs didn't keep anything useful at home.

But assuming that's not the case now, my point still stands about how it would be maybe easier than attacking Apple Park, relatively speaking. Though, according to Apple's WWDC videos, invading Apple Park to swap an M1 between a MacBook and an iPad is easy when you are the CEO and wearing a rubber mask ;)

I doubt that they are entrusted with keys.

I've heard that Xbox used HSMs for the signing keys way back in the days of the original Xbox. I'm not sure why they'd have stopped.

And if Xbox was doing that 20 years ago, I'd expect Apple to be as well.

It'd make sense for Sony, but some of their approaches to software security have been lol inducing, so it wouldn't shock me if they aren't.

I know that at least some of those companies use HSMs. Multiple, actually.

This is why they make backup HSMs.

But if I understand it right, it was Google that screwed up this one. I always thought that they were not taking their responsibility as an OS vendor seriously and they should have taken this horse in back of the barn and shot it years ago.

Given what we know so far, there's no indication that Google is associated with this at all.

If I was a betting man: some smaller fish in the Android ecosystem practiced exquisitely terrible key management outside an HSM, got burnt, and will have to slip KPMG or Deloitte an extra big kickback if they ever want to see a clean SOC 2 again.

A theoretical piece of paper and pen

> We haven't had a major signing key stolen yet

The DigiNotar case seems fairly close ...

https://en.wikipedia.org/wiki/DigiNotar

https://darknetdiaries.com/transcript/3/

There’s also the HDCP key getting leaked.

https://www.themarysue.com/hdcp-master-key-confirmed-blu-ray...

This summarizes a thought I had for a while.

Muggings and robberies happen every single day, probably by the millions.

Hacks also happen, although not that frequently.

Now, what would happen if you combined both? Say a rogue criminal group threatens/kidnaps/holds a sysadmin at gunpoint and forces them to export all the private keys, the keys to the kingdom.

It would be like the explosive mints in Mission Impossible, where if you make the two ends touch, BOOM!

Make the hacking world and the physical mugging/robbing worlds intersect and you probably got an extremely dangerous combination, a nuclear bomb waiting to explode.

This is a well know, and I'd imagine well used technique

see https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

> Make the hacking world and the physical mugging/robbing worlds intersect and you probably got an extremely dangerous combination, a nuclear bomb waiting to explode.

This is easily within the capabilities of any state level actor. And unlike a nuclear bomb, it can be kept out of the news. I’d wager it’s already been done.

I haven't heard the government complain about encryption since early 2000s. I'd wager you're correct.

I think you're describing the plot of Firewall with Harrison Ford.

And you know nobody actually has their high-value signing key protected by a series of complex offline vaults and checks and balances like you'd see in Ocean's 11 - at best it's on the other side of a room on an air gapped computer.

The IANA key ceremony is pretty close to best practice: https://kimdavies.com/key-ceremony-primer

This is the second time today that I've seen reference to a "key ceremony", which I hadn't heard of before. Sure I expected root key holders to have some kind of formality around key management, but not a 5 hour event live-streamed on youtube! https://www.iana.org/dnssec/ceremonies/45

Right... because the more you lock the key down and try to secure it, the greater the risk something in your security will go wrong, and then you will lose it yourself. Losing the key is not as bad, though still catastrophic, from a corporate perspective. Imagine if Apple couldn't distribute a software update ever again. Much better to not invest in super-strong security that has that risk... but then you have an increased risk of theft...

It's almost like cryptographic signing keys are the modern day Ring of Power...

https://www.iana.org/dnssec/ceremonies

The Simpsons got it right: https://youtu.be/eU2Or5rCN_Y

that matches my experience of an unnamed large multinational datacentre company

to get to the floor needed to go through the multilayer security, id checks, etc

the cleaner had left their mop in one of the secure doors, bypassing most of it

That's not strictly true. At one point, my desk was next to the room that held the vault for one particular signing key. You'd have to get through the building security, through a room guarded by one access control mechanism, and then into a vault secured by a second mechanism. It wasn't guards and guns but it also seemd sufficient for the task at hand.

For a many million dollar key, a few armored robbers with guns would solve this problem. Or to quote xkcd: get the hammer

Depends on if you are concerned mostly about covert access or overt access. I'd argue the former is quite a bit more serious in the case that keys can be revoked online.

Depends how long they need it for.

"Hi, we have your family hostage for a week and if you tell anyone we have this key we'll ship you back parts"

More than enough time for a nation state backed actor to spread a lot of damage.

Yeah covert is the main issue - you need to be sure that dgacmu didn’t wander into the office one door over and grab a copy of the keys.

Some sort of read-only memory that logged how many times it had been read might help.

more like sleeper cell agents

“But the plans were on display…”

“On display? I eventually had to go down to the cellar to find them.”

“That’s the display department.”

“With a flashlight.”

“Ah, well, the lights had probably gone.”

“So had the stairs.”

“But look, you found the notice, didn’t you?”

“Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”

That's kind of how I feel trying to access the text of this article. All I can see when I look at the page or view source is a bunch of executable code. You have to do quite a bit to be able to read this security warning.

The places that care store them in HSMs which few people have physical access to.

> If someone (for example) got Apple's iOS signing key and Apple's HTTPS certificate, Apple could suffer catastrophic damage.

...people could see what's going on on their phone. I think this could be a good thing.

Can we call this Death Star security? Invincible quintillion-dollar project, unless you hit the tiny trash vent at the back of canyon 35.

> recently in Antwerp, Belgium, where over $100 million in diamonds were stolen in 2003

One of my favourite books I’ve read was about this heist

https://www.goodreads.com/en/book/show/7071759-flawless

Given how much modern hardware is on check-for-updates-online mode by default, how long would a stolen signing key be valuable? I'd imagine the OEM would respond to the theft by cutting new keys and pushing an update to supplant the old key. There'd be some details to hammer out (retroactively declaring the old key untrustworthy past date of theft, allow-listing a bunch of software and peripherals that couldn't be updated to accept if they matched key + checksum), but it feels like stealing such keys would have a very short window of utility.

To be clear, this is not to imply resolving the theft is trivial... Some engineers will have a bad week. It's more that it's solvable from the aggrieved party's side in a way that a diamond theft isn't.

If you stole a hardware key (which I am speaking of), you've just smashed Secure Boot on all the devices that use it, forever. You can boot whatever software you want on your PlayStation, or Xbox, or Windows Secure-Boot-Enabled PC, or iPad, or similar. Every device with that key has had their locks smashed and there's no going back. Once you've done that, downgrading firmware, modifying firmware, undoing software updates, it all becomes a lot easier.

Bonus points if you stole a Windows signing key and a Windows Update CDN Certificate. Send out fake Windows updates, approved by Microsoft, to do whatever you want. Maybe even force them to use your own middleman update server and only recognize your own keys. Fun stuff.

Got the Apple signing key? Revoke any app you like and have it instantly lock out from millions of iPhones. Break every app for everybody on iPhone and give Apple employees and users a miserable week and cause a political panic. Sky's the limit.

UEFI Secure Boot signing keys can be updated at runtime, and old keys can be explicitly marked as untrusted. Validation of key updates is performed by the firmware, not the OS, so this can't be trivially subverted.

Right, agree. What I'm asking is: why can't the OEM over-the-air-update Secure Boot on all the online devices? Is there no channel to re-key Secure Boot from an online source?

I agree that anyone who wants to muck about their device on purpose could just not connect to the Internet, but I'm focused on protecting the users who don't want to be victims of hacks.

(My only mental model for this is the bugs in the early protection on the original XBox and how Microsoft fixed it with OTA updates and specific games they released that patched the bug).

> Is there no channel to re-key Secure Boot from an online source?

There is no such method. Any such method would be potentially vulnerable if the device was jailbroken (from a purely software hack) - in which case, you would need some sort of permanent key to verify the re-keying which defeats the point. As a result, the Secure Boot key is burned into the chip and unchangeable.

They key is burned into the device.

> Got the Apple signing key? Revoke any app you like and have it instantly lock out from millions of iPhones. Break every app for everybody on iPhone and give Apple employees and users a miserable week and cause a political panic. Sky's the limit.

How are you getting to the iPhones? You need to be able to intercept any internet connection too.

nb I'm not sure there is such a single signing key.

> Send out fake Windows updates, approved by Microsoft, to do whatever you want.

Send them... How? You're planning on setting up a MITM attack on everyone's internet access?

At a nation state level attack that is completely possible.

If a state wants something from you, they'll send armed agents at your door.

If 'your' state that is. There are any number of states unfriendly to each other.

Having stolen the key, the thieves themselves could push such an update and lock the OEM out. Imagine millions of Apple devices getting an update, locking Apple out while simultaneously installing some nefarious code which uploads all saved credentials to the thieves' server. Sure, the time window is short (if the breakin was detected), but having full-access to millions of people personal data could be a long term money-trove while simultaneously bankrupting Apple through damages. One could short-sell companies by leaking sensitive data, impersonate people and send messages, blackmail people, even simple ransomware would be devastatingly profitable.

You’d have to impersonate Google’s web servers to push the update, wouldn’t you? That would mean both hijacking the DNS and faking or stealing the TLS cert. That’s not impossible, but it’s pretty much a moderately-well-equipped-nation level attack.

If a 'heist' to steal such a key would be pulled off, adding credentials (or stealing them) to the update-server (even for a one-time update push) doesn't seem out of the realm of possibilities.

If you own the OS, you should be able to install updates from anywhere.

If someone copies the key with pencil and paper, the original remains in place. There will be nothing to show that anything happened... until signed malware is detected in the field. (Which is exactly where we are now - with signed malware from a bunch of different keys.) The amount of damage depends on how long the signed malware was out there, and what its uptake rate is.

Sure, it won't destroy or infect the entire world. It's still pretty bad, though. And so far I haven't seen anything saying how long it was out there.

Also: How did so many keys get compromised? There may be a bigger (or more systemic) problem.

" ... cutting new keys and pushing an update to supplant the old key ..."

What about the keys to say Windows updates?

If someone manages to nick the key you can be sure that they would push a new one and revoke the "old" one whilst simultaneously deploying nasties.

100M (whatevs) is chicken feed compared to the rewards from compromising something like Windows updates. Bear in mind that a simple pecuniary minded criminal gang might leverage a lot of coin mining or whatever for a while and generate an awful lot of electricity usage but a state level actor gets the real crown jewels: information.

Anyway, that's far too complicated when there are far easier ways to crack rather a lot of the world. Look at the Solarwinds compromise. That sort of thing won't (and wasn't) be the last.

Supply chain attacks in the IT world are probably the worst in terms of fall out and the potential losses are vast in comparison to a bit of shiny carbon falling down the back of a sofa. However, for some reason, in this most bizarre modern world we find ourselves in, we still fixate on a bloody diamond!

The beauty of stealing a signing key is you don't necessarily tip off the company by getting yourself a copy of it. (The diamonds were removed, but the key stays where it is)

If you were clever enough to get the key you might hold it until it was truly valuable for your exploit.

Bonus points for letting everyone think, the diamonds are still there.

Depends on which key is stolen. You can't update the certs on distributed users without some root certificate key. If that key is compromised, there is no trust root which the clients can trust anymore. The thief can revoke all the keys the original institution holds, so they have no path for changing keys.

To do that revocation, they'd have to be able to attack the update channel itself. And practically speaking, that attack is hard to pull off; you can probably successfully update most devices, which might be good enough.

> government agencies who might want to bribe someone for keys

Why would they need a bribe? They have a whole mechanism for "do what we want, and you're not allowed to tell anyone about it". I would be shocked if NSA/FVEY didn't already have every signing key they could get their hands on, especially from companies that are friendly to them like Microsoft https://en.wikipedia.org/wiki/National_security_letter

As you may know, PS3 was the example of failure.

Reply on news.ycombinator.com