Hacker News Reader

Comment by carl_dr | Hacker News Reader

> “Samsung takes the security of Galaxy devices seriously. We have issued security patches since 2016 upon being made aware of the issue“

They’ve known about it since 2016!?!

View on HN

The article is rather misleading. It is almost certain that Samsung used HSMs to sign their APKs, so the key itself could never actually leak unless someone had physical access to the HSMs themselves and managed to somehow delid it and then put it back together without anyone noticing. I'm not too familiar with the documented attacks on delidding HSMs, but I believe that delidding chips causes permanent damage to them in such a way that they will never function properly again.

It's much more likely that an employee's account was compromised and then used to sign malicious APKs, or something similar. Once Samsung realized, they could get the logs of every APK signed with the HSM and then revoke those certificates individually through a software update. Not really sure if they actually did that or not, but either way the key doesn't necessarily need to be replaced.

> revoke those certificates individually through a software update

Android doesn't really do revoking certificates in this way. The only way to fix a leak of a system key is to generate a new key and use replace the entire system image.

I hope you're right that this is merely a remote signing account being compromised, because I don't see Samsung building six years of new system images.

Can you expand reasoning or evidence behind this guess that the keys would be stored (only) in HSM?

I think the more generous take is that they resigned all their security patches back to 2016 with a new key?

Maybe for all devices published since 2016?

Who's in charge of certificate stuff in these situations?

Some intern at the corporate HQ

Which corporation though? Samsung or GOOG?

Google can add certificates to the CRLs (certification revocation lists) for things they control, but generally, Samsung owns and keeps their private keys, including this one.

I don't know if this has changed since I last looked a few years ago (around 2018-2019), but:

The app-signing key can't be changed without just creating a new app, and creating a new app means you users won't be able to upgrade - they have to manually uninstall, go to the app store, and install the new one.

It's not just an app store thing, I think I remember Android itself verifies that the upgrades have the same key as the old version.

You can do certificate rotation in signing scheme V3 and Android 9+.

https://source.android.com/docs/security/features/apksigning...

Reply on news.ycombinator.com