Firmware (XBL and other non OS components) are versioned with anti rollback values. If the version is less than the version burned into the fuses the firmware is rejected. The “boot” partition is typically the Linux kernel. Android Verified Boot loads and hashes the kernel image and compares it to the expected hash in the vbmeta partition. The signature of the hash of the entire vbmeta metadata is compared to a public key coded into the secondary boot loader (typically abl (fastboot before fastbootd was done in user space to support super partitions))
The abl firmware contains an anti rollback version that is checked with the eFuse version.
The super partition is a bunch of lvm logical partitions on top of a single physical partition. Of these, is the main root filesystem which is mounted read only and protected with dm-verity device mapping. The root hash of this verity rootfs is also stored in the signed vbmeta.
Android Verified Boot also has an anti rollback feature. The vbmeta partition is versioned and the minimum version value is stored cryptographically in a special flash partition called the Replay Protected Memory Block (rpmb). This prevents rollback of boot and super as vbmeta itself cannot be rolled back.
I've been seeing "that's vibe coded" comments a lot lately on posts. Comments that call out code that may or may not be vibe-coded. At what point should these types of posts start getting down-voted? It's not constructive, and IMO imparts a negative connotation.
HN: Show HN Awesome New LLM can Code!!
Also HN: TFA is vibe coded angry pitchfork or ugh
/s the breakthrough: A basic car with that happens to have EV power train.
The anti-secret: EV power train that accelerated 0-60 in 1s and all the software engineering going into a software defined, internet connected autonomous vehicle with subscription services and such that balloon the costs of a modern vehicle?
Ugh, already have to deal with filtering out interviewees who are obviously using AI to answer questions. It's annoying when you ask someone how they go about troubleshooting a misbehaving SPI peripheral. Instead of their personal routine, they give a bulleted and summarized AI response. It's obvious, first they fumble the answer to buy time, while looking away from the camera, then they read off the bullet points.
Wonder if you could measure your breathing rate and heartbeat and cryptographically sign the time series data as ground truth. Then post process the video with Eulerian Video Magnification to recover the values and compare.
RCT, Railroad Tycoon 2 (which has scripted scenarios and sandbox ), SimCopter and Streets of Sim City were great
RRT2 has it scenarios like Hell or High Water where you have fill in a giant crater with cement by orchestrating trains before ocean levels rise or just sandbox play building railways buying up business and watching connected cities boom. Always loved using cheats to make all competitors trains break down then take over their bankrupt company.
SimCopter and Streets of Sim City had missions/scenarios. Or you could just go fly/drive around any SimCity2000 map.
Remember a SimCopter cheat would essentially nuke the city and set everything in fire.
And Street let you blow up buildings by adding weapons to your car.
I always used the Do Not Enter marquee signs such that once guests entered the park they could never leave. Great for helping meet the total park population scenarios.
That and before The Minecraft Movie came out, you could play multiplayer LAN from Xbox to PC cross platform without an XBox Live subscription.
Once the movie was released and they updated the game to add movie related content, this feature stopped working. Now to play multiplayer cross platform LAN, you have to pay for M$ servers you don’t use.
You couldn’t even load your world locally on the XBox if it was marked for multiplayer unless you had an Xbox Live account, meaning you got locked out of your world.
Fortunately you can edit the world setting to remove the multiplayer option to recover, but this was not documented at the time encountered.
Making physical goods low quality, cheap, and therefore disposable is the equivalent of rent seeking.
Instead of growth and innovation, it’s how can the Company get recurring revenue after first sale.
The balance for the Company is finding a quality to price point ratio where either 1) the customer doesn’t care if it breaks because it was cheap and they know it’s cheap or 2) it’s cheap and breaks but the utility of it to the customer warrants (or with some goods, necessitates) them buying a replacement.
In the second case, the trade off would also include brand risk, but in the world of Amazon and TEMU, you can just sell the same thing under a new random name, there is no brand identity.
The Debug Policy apdp partition is flashed with an ELF “mbn” file. It is possible that sections are encrypted. At the very least it is likely signed. From a security perspective, hopefully the vendor signed with a prod key and not a test key.
In my experience, it is possible read to the fuses with a TrustZone TA, at least on a non-secure device.
Learning Rust ATM and using bindgen on a C header. Just looked and it generates Rust enums from C enums. I'm not sure what the default behavior of bindgen is, but it seems there is option for constifying enums
--constified-enum <REGEX>
Mark any enum whose name matches REGEX as a series of constants
--constified-enum-module <REGEX>
Mark any enum whose name matches REGEX as a module of constants
IMO, saying bindgen avoids the issue presented in the article is not accurate.
Would be cool to see integration of landlock with configuration file in a way that a service launched by systemd can apply the configuration to the executable.
Android too in a way via Android Verified Boot. I think ChromeOS uses AVB as well.
Android Verified Boot extends the System on chip Hardware based secure boot to the kernel and rootfs.
Root of trust is fused into the SoC, and second stage bootloaders are signed. Second stage boot loader eg uboot,UEFI/edk2 contains a public key that is used to verify a signed AVB partition. This signed partition contains signed rootfs dm verity metadata and signed hash of the kernel(+initrd). AVB validates kernel hash with expected hash and loads kernel if good. It provides the trusted rootfs verity hash to kernel via cmdline. Then when kernel reads rootfs, the dmverity system will calculate hash and check if matches the expected one. If not, the system reboots and the AVB metadata is flagged to indicate tampering/failure of the rootfs.
edit to add:
If the SoC supports hardware based full disk encryption, the filesystem can be encrypted as well, with the key being stored in Androids secure key store. Android though has moved away from FDE in favor of file based encryption.
Seems like this could be easily mitigated with a read only root filesystem using dm verity
Store the root hash of the dm verity formatted rootfs in the PCR. If a malicious partition is presented to initrd, its root hash will not match the trusted one stored in the TPM.
Or if you need a writeable rootfs, use fs verity and store the signature of init into the PCR. The trusted init signature won’t match signature of malicious init.
LUKS for encryption and verity for integrity/verification.
BPF LSM if you want to return -EPERM.
Or a kprobe that kills the process via bpf_send_signal() if BPF LSM isn’t enabled.
[0] https://github.com/cozystack/copy-fail-blocker#how-it-works