Related
Hi! I managed to compile a bionic version of cryptsetup with libcrypto instead of gcrypt, and I put it inside Steam Kernel, so anyone can play with it. This is actually not new to android, as from Froyo, the APKs that can get installed on the external SD, are actually also uding dm-crypt, although they are doing through vold, and not via device-mapper. It is actually strange, that Android has filesystem encryption on inside the kernels by default, but they are using it to keep us out from the system, and not actually to make other people get inside the system more harder.
In Steam Kernel, you can now chose to apply filesystem encryption to any of the 3 main partitions (cache, data, dbdata). The password can be entered using the screen by one, or multiple Swypes (up to 255 elements). Each swype creates a word, and words will be separated by "_". This mechanism was invented, as with this one can potentially achieve a good-enough entropy (although I'm not a cryptoanalyst), than by for example a simple PIN code entry box.
If you worry about speed, quadrant scores are around 1400 if using ext4+crypt, so they're still better, than stock rfs. I can't say much about battery life yet.
This feature is beta however, so don't rely valuable data to it yet, as it hasn't been throughly tested yet. (ancrpytion should be fine, I'm actually worried about data corruption).
The way to secure android is not yet finished however. I'm trying to find a way to secure adb, even if it's running root mode. (as running adb in root mode is good for debugging, but bad for security).
Questions on this topic is welcome.
Very impressive stuff, and still opensource.
It's a real innovation, congrats!
sztupy said:
The way to secure android is not yet finished however. I'm trying to find a way to secure adb, even if it's running root mode. (as running adb in root mode is good for debugging, but bad for security).
Click to expand...
Click to collapse
First weak security point for the Galaxy S phones is definitely the ability to flash anything with Odin.
As you cannot trust, well... anything your Filesystem Encryption approach is definitely the good one!
Other current weak point is the adbd exploit (rageagainstthecage) - so easy to use. I guess you can replace adbd in your ramdisk by the Gingerbread one, which is not vulnerable, if not done already
Yes this is really impressive man...
You should be hired by samsung to set there software ass rite :-D
Sent from my GT-I9000 using XDA App
supercurio said:
First weak security point for the Galaxy S phones is definitely the ability to flash anything with Odin.
As you cannot trust, well... anything your Filesystem Encryption approach is definitely the good one!
Other current weak point is the adbd exploit (rageagainstthecage) - so easy to use. I guess you can replace adbd in your ramdisk by the Gingerbread one, which is not vulnerable, if not done already
Click to expand...
Click to collapse
You would still lose the benefit of being secure + having the comfort of adb root. I'm more into the fact you have to login to the phone in order to use adb, just like you have to login to a real linux.
sztupy said:
You would still lose the benefit of being secure + having the comfort of adb root. I'm more into the fact you have to login to the phone in order to use adb, just like you have to login to a real linux.
Click to expand...
Click to collapse
I meant, for general security, we can replace the vulnerable adbd by a non vulnerable updated one - just that -
I feel your title could have security under [ ]. More noticiable.
AS I SEE IT NOW. supercurio's THANK's meter stands at 666. ROFL...
EVIL
Seems really great !
I'm not sure about a thing : Does this work when you power on the device (ie, you'll have to enter a pass to make it boot to Android), or before to be able entering into recovery ? Or none of these two things, and I totally misunderstood what you're saying ?
I was about to make a request to Koush if he could add some (basic?) security system to his recovery, as if you phone is stolen, they even won't be able to reflash a new rom.
This security layer + WaveSecure or any similar soft, and you would be sure that even if you phone is stolen / lost, nobody will be able to use it
Anyway thanks for your big stuff, will look deeper for sure when I'll get some free time, but your steam package seems amazing
Cheers
This works when you want to mount the partition. (eg at every boot). The partition can not be mounted wirhout a password ever
Amazing project. Good work.
Now wait just a moment...why would you encrypt those directories, when you alone (the user) are responsible for giving applications certain permissions. I mean...you agree to giving access to your Radio, messages and...whatever when you install applications, but then you want to encrypt certain directories. Why? You've already installed a trojan or a root kit and given it permission to do whatever it wants to do. That's the main security issue.
If your phone gets stolen they can't access your data.
Sent from my GT-I9000 using XDA App
... But another issue! Great work, Great project!
Edit: to slow, I was referring the post 2 above
sztupy said:
This works when you want to mount the partition. (eg at every boot). The partition can not be mounted wirhout a password ever
Click to expand...
Click to collapse
And I guess the partition has to be mounted if you want to flash another rom (By recovery, Odin, Kies, whatever) ?
If it's the case, then it's really really great !!!
No, if you're flashing a new ROM, you don't have to mount the partition. But the point is that nobody can read your data from the partition - that's the security risk sztupy is trying to prevent.
kidoucorp said:
And I guess the partition has to be mounted if you want to flash another rom (By recovery, Odin, Kies, whatever) ?
If it's the case, then it's really really great !!!
Click to expand...
Click to collapse
When you flash a new rom the data will be inaccessible (unless it's a steam rom and you know the password, or you can dump the partition AND know the password. Without the password the data can not be accessed, as it's AES encoded there).
This means that if you use all the security feautres inside Android (lockscreens, pin code, etc.), and use this too, and you don't allow adb to be run as root, there is actually no way of accessing your data (unless you can circumvent the security provided by Android, like the lockscreen), not even by flashing a new ROM.
Good work these kind of improvements make android better and better. I think the phones should be encrypted from the factory.
Great idea
If I might suggest though - can you make it so that it turns off decryption a couple of minutes after the screen is locked so that you have to enter the code again? Otherwise if the unit is on and stolen and never rebooted...
Being in Healthcare related IT I can say you'd have a product that is in severe need if any doctors really want to start using an Android tablet.
@sztupy
This is simply the best thing to happen to my SGS I've ever heard.
I can not test it right now (running 2.2.1 Darky's mod) but I have some questions about the security.
- What type of encryption is used? 128/256? weaker?
- Is it possible for you to figure how to use this encryption with different kernels/mods? We're talking about quite big a deal breaker for lots of people here. Perhaps even a separate app? I almost bought a blackberry as a second phone *kugh kugh* because android lacks encryption I so hardly need.
Sierra November said:
@sztupy
This is simply the best thing to happen to my SGS I've ever heard.
I can not test it right now (running 2.2.1 Darky's mod) but I have some questions about the security.
- What type of encryption is used? 128/256? weaker?
- Is it possible for you to figure how to use this encryption with different kernels/mods? We're talking about quite big a deal breaker for lots of people here. Perhaps even a separate app? I almost bought a blackberry as a second phone *kugh kugh* because android lacks encryption I so hardly need.
Click to expand...
Click to collapse
As already stated Android already uses dm-crypt for encrypting the application data on the external sd card, so in theory any kernel can actually use dm-crypt. Originally Android kernels only support aes-plain (which is AES-128 I think), and that is what you can use on probably every 2.2+ android (and even on some 2.1 too). (You can get a stronger encryption if you compile a better kernel as aes-plain has some weaknesses).
The hard part is actually not the encryption therefore (You just have to run cryptsetup before init, which is very-very similar of the process of creating "lagfixes"), but the fact that you'll need a way to enter the password every run. The latter is problematic, as you'll need to access the framebuffer to show the user the pin code panel, then leave the framebuffer in a state, so Android can boot from it without problems. On SGS, and probably all SGS based devices (including the Nexus S), this is already accomplished (in steam kernel). On other devices it might work too, but the framebuffer support might need to be rewritten. On other devices the fact that they use yaffs2 might also pose problems (as yaffs is working on a block), but that can be circumvented using a few tricks (like creating loop devices, putting the /data partition on the sd card, etc.)
I haven't found anything on the forums about this (I have searched) so forgive me if it's a basic question. Is it possible to either:
1) Dump all data on a mango phone (in my case, a Samsung Focus, no interop-unlock) to a file on my computer, or alternatively
2) Access the data stored in the umpteen files created during a WP7 backup.
If anyone knows how to do either of these things (without interop unlocking -- I have data I need to pull off, but my firmware is too old to get interop unlocked, and I get error messages when I try to manually update the firmware), it would be greatly appreciated.
Thanks,
Beakin
Note: edited to clarify
I doubt it's even possible *with* interop-unlock.
1) A native app could map a large region of memory, but the WinCE kernel uses process isolation (same as every other modern OS) so there's no way for one app to access the full physical memory.
2) They're encrypted with a key that appears to be stored in the device itself. Nobody has yet figured out how to reverse this encryption.
GoodDayToDie said:
I doubt it's even possible *with* interop-unlock.
1) A native app could map a large region of memory, but the WinCE kernel uses process isolation (same as every other modern OS) so there's no way for one app to access the full physical memory.
2) They're encrypted with a key that appears to be stored in the device itself. Nobody has yet figured out how to reverse this encryption.
Click to expand...
Click to collapse
On #1, I should have been more specific -- I meant dump the phone's storage; what's in non-volatile memory, not RAM.
Still no without interop-unlock, then - standard apps don't have the privileges to access the filesystem (aside from a few very specific locations, like their isolated storage folder). That probalby means no access to the storage device itself either, although I admit to not knowing how that works on CE (NT or Linux, but that's it). If the app was initially sideloaded you can use the Isolated Storage Explorer to pull files from that app specifically, but if it's a marketplace app or something built-in like the SMS store, no such luck.
Of course, you can get more permissions if you can call into a driver - which is what ID_CAP_INTEROPSERVICES allows you to do, and ID_CAP_INTEROPSERVICES is why you need interop-unlock. I'd suggest you focus on figuring out why you can't interop-unlock and fixing that. Unfortunately I can't really help you there; I don't have a Samsung phone and the steps to IU an HTC phone are very different.
GoodDayToDie said:
Still no without interop-unlock, then - standard apps don't have the privileges to access the filesystem (aside from a few very specific locations, like their isolated storage folder). That probalby means no access to the storage device itself either, although I admit to not knowing how that works on CE (NT or Linux, but that's it). If the app was initially sideloaded you can use the Isolated Storage Explorer to pull files from that app specifically, but if it's a marketplace app or something built-in like the SMS store, no such luck.
Of course, you can get more permissions if you can call into a driver - which is what ID_CAP_INTEROPSERVICES allows you to do, and ID_CAP_INTEROPSERVICES is why you need interop-unlock. I'd suggest you focus on figuring out why you can't interop-unlock and fixing that. Unfortunately I can't really help you there; I don't have a Samsung phone and the steps to IU an HTC phone are very different.
Click to expand...
Click to collapse
Thanks for the clarification. I've spent the last month trying to figure out how to get the interop unlock working on my phone to no avail, which is why I was changing tact by asking this. Oh well, back to the old drawing board.
BTW if you or anyone know how to take a windows phone firmware CAB file and alter it (removing items) I'd appreciate it. My problem with updating the firmware is that I get a "file name conflict" error pointing to specific items in the CAB. At the risk of bricking my phone, at this point I'd try removing those items and installing it anyway.
Editing a CAB is easy; Win7 Explorer can open them natively and many third-party tools also exist. Editing a CAB so that it can still be isntalled may take a little bit more effort, but the important point is that as soon as you edit it, you'll invalidate the signature on the CAB. That means it will no longer install through the default update-OS at all. On HTC phones, you can use RSPL (or HSPL) to install custom updates, but on a phone with a retail bootloader (such as a Samsung), you can only install official updates.
I have a real cry for help!
Somehow all my pictures disappeared from my Galaxy Nexus. My only possible explanation (since it could not have decided to delete them itself!) is that I must have been a complete idiot and last night when I thought I was deleting a video I had just taken I must deleted the camera directory itself. This is supported by the fact that there was no ‘camera’ directory when I looked this morning. I then took a new photo and the directory reappeared. I have plenty of experience with PC’s but I’m a newbie with smartphones. I figured if I don’t write any more files to the phone then most of the actual data should still be there so I hoped to do some kind of undelete.
I’ve done some research and it looks like the ‘feature’ of only connecting as an MTP device (rather than USB mass storage) is potentially a killer blow. Without an assigned drive letter it seems that none of the usual recovery programmes will recognise the phone.
In theory an alternative might be to take a complete image of the phone contents and somehow recover the data from here?
I am pretty desperate as I have five months of pictures/videos of my kids etc, and most of that data must still be on the phone – but how to get to it?
Finally – yes I am a complete plonker, I shouldn’t have made such a stupid mistake and I should have backed up the phone or the pictures. I have learned my lesson. But given that, is there anything I can do?
BTW - the phone came from 3 network (via a reseller) and I have not touched it with respect to unlocking/rooting etc. It is in the state I received it.
HELP please!
Thanks very much...........
I believe the MTP vs. USB Mass storage would be a driver thing. There are many different versions of drivers so its possible there are ones that will mount the phone with a drive letter. I can think of some other things to try (Boot into fastboot mode by turning phone off then powering on by holding power, volume up and volume down at the same time and holding till it vibrates). You could also try Disk Management under windows to see if you can assign a letter
In the future I highly recommend setting up a google account and using Google Photo/Instant Upload to keep a backup of your photos. You dont even have to sync anything else
Thanks for your suggestions, much appreciated.
I’ve now tried going into fastboot mode and connecting to PC but no joy – Windows recognises there is a device connected (usually ID’d as an OMAP4440) but can’t find a driver.
Disk Management also doesn’t show the Nexus as a drive and therefore won’t allow a Drive letter to be assigned.
Try these (obviously no guarantees and I havent used any personally)
https://play.google.com/store/apps/details?id=fahrbot.apps.undelete
http://android-photo-recovery.com/tutorials/deleted-file-recovery-for-google-nexus-phones.html
EDIT: Found another:
http://www.wondershare.com/disk-utility/recover-deleted-photos-from-nexus-s-and-galaxy-nexus.html
Thanks again, I appreciate all suggestions. Yes I have come across these and unfortunately they don’t solve my issue. The last two are amongst those I’d seen reported as not working as they need a drive letter. I had installed both anyway but found that to be true (
The first requires root access which I don’t have. If I understand correctly, to root I’ll need to unlock the bootloader first, and unlocking will erase all the data anyway??
Unfortunately, you are out of luck. You cannot mount the storage on a GNex in USB Mass Storage mode, and I am pretty sure that none of the "undelete" programs that run in Android support ext4 (which is what our GNex internal storage is formatted).
If you are running 4.0.1 or 4.0.2, you can still get root access without losing your data (but not on 4.0.4), but I can't see how it will help you given what I mentioned above.
I am on 4.04 so sounds like I can't get root access without overwriting, can I roll back to 4.01/2 without overwriting the data? (sounds unlikely but I have to ask - I upgraded from 4.02 without losing data....).
If not, is there a way to get a data image without rooting? That way at least I have the data preserved if at some future point it becomes possible to do an undelete on Ext4 data??
Gavdroid said:
[snip]
can I roll back to 4.02/3 without overwriting the data?
Click to expand...
Click to collapse
Unfortunately no.
Gavdroid said:
If not, is there a way to get a data image without rooting? That way at least I have the data preserved if at some future point it becomes possible to do an undelete on Ext4 data??
Click to expand...
Click to collapse
I believe there are utilities to "do an undelete" on ext4. The problem is how to get access to the data image. I don't really know of any way to pull off the data partition of a GNex to your computer, but it may be possible.
Have a look at this thread. I think shaaXo managed to find a way for your computer to see the memory on the GNex and likely dump it (although it is not very user-friendly).
That sucks. If it's deleted, it's gone for good. Sorry, buddy.
Sent from my Galaxy Nexus using XDA
Thanks very much I will go through that post and see where I get to!
Edit! - uh-oh, taking a quick look it seems you need to use CWM, which I take to be ClockworkMod, which I thought required the phone to be rooted to install it? And if I understand correctly, rooting requires an unlocked bootloader, which wipes your data??
I will take a deeper look in case I've misunderstood (very likely), but am I thinking clearly here?
Question: I have the Dev Edition Note 4 and am looking for the lock screen fields in SQLite, since they seem to have moved. Does anyone know where they are located now?
Reason: When encrypted, as we all know and hate, you have to use a password with a special character.... That you also have to use as the lock screen... Which sucks. It would be pretty handy to have the scanner for unlocking the screen and the password for decryption on boot.
Background: On the Note 3 you could use SQLITE to change LOCKSCREEN_PASSWORD_TYPE to different codes which enabled the different types of password. For instance 131072 was for PIN. After encryption was in place I was able to change the lock screen type to PIN. However, since no PIN was used during setup it would just act as if any entries didn't match. I want to see if changing to fingerprint scanner would work since the fingerprints, or password in this case, are stored in the phone prior to the change. Hopefully making it so lock screen can be unlocked much easier while encrypted.
Thanks everyone.
Just an update to this for anyone who likes to, or needs to, have FDE enabled on their devices.
If you setup your fingerprint unlock and use a file explorer to go to data/system/ you will see three files called lockscreen.db two in which say -shm and -wal after. Copy those to the SD card.
Then make your way to Terminal Emulator and run the command pkill -KILL daemonsu . This will kill superuser. Making the FDE actually run.
After encryption is complete you can take the lock settings files saved earlier and copy (replace) them back to the data/system/ partition.
That's it. When booting you will have your strong password and be able to use the scanner for screen unlocks.
Now this only works for for device encryption. SD cards seem (?) to decrypt after the boot process and this causes them to not mount correctly. One of the times I was toying around with it the files on the SD were actually corrupted and unrecoverable. So make backups and all that if you decide to figure that out. I typically use encryption manager for things that I want to encrypt on the SD card anyway. Since I use the card in several devices.
Hope this helps anyone who wants or needs FDE on their Note 4 Devs.
Fingerprint scanner is not displaying note 4 - android 5.1.1
blubyu87gt said:
Just an update to this for anyone who likes to, or needs to, have FDE enabled on their devices.
If you setup your fingerprint unlock and use a file explorer to go to data/system/ you will see three files called lockscreen.db two in which say -shm and -wal after. Copy those to the SD card.
Then make your way to Terminal Emulator and run the command pkill -KILL daemonsu . This will kill superuser. Making the FDE actually run.
After encryption is complete you can take the lock settings files saved earlier and copy (replace) them back to the data/system/ partition.
That's it. When booting you will have your strong password and be able to use the scanner for screen unlocks.
Now this only works for for device encryption. SD cards seem (?) to decrypt after the boot process and this causes them to not mount correctly. One of the times I was toying around with it the files on the SD were actually corrupted and unrecoverable. So make backups and all that if you decide to figure that out. I typically use encryption manager for things that I want to encrypt on the SD card anyway. Since I use the card in several devices.
Hope this helps anyone who wants or needs FDE on their Note 4 Devs.
Click to expand...
Click to collapse
Hi, i have a big trouble with my note 4, i had a fingerprint lock screen with a pin pass in case of emergency; the phone just got locked with no reason and it doesn´t show me the fingerprint option and doesn`t get any pin. Im out of my phone, i don`t know what to do, i took some photos yesterday that i need for my job urgently, could you help me?
Hi, I have a stupid question: Is there any way to read and modify system files on my HTC One M8 through USB to a computer that can access them and doesn't care about file permissions? I have an annoying WiFi notifications issue that I can't disable anywhere implemented by Verizon and they lock the bootloader on 5.0.1 and I've found no safe workaround. I just want to edit the file that has this setting.
Maybe I don't know enough about the technology, but is there no program I can use on Windows or Linux that can read the memory through USB and let me change the data without it caring about permissions? If the files are not encrypted but accessible, something should be able to read them and let me edit them, as I can get Linux to read and edit any information on a Windows drive that isn't encrypted even if the user has a lockscreen password as it bypasses boot-up.
(I realize I may be sounding like an idiot as someone might have already done this if possible but maybe I haven't searched hard enough)
This would never work, since the system partition is write protected. Even if you can somehow change the system files by USB (which I think is unlikely), the changes would just revert when you rebooted. You need a kernel mod to disable the system write protection; and for that you need root.