Hacker News Reader

Comment by kyaghmour | Hacker News Reader

One of the primary uses-cases for VMs in Android seems to be a desire to replace the Trusted Execution Environments (TEEs) permitted by things like TrustZone. There have been several presentations about this by Google:

- LPC 2020: https://www.youtube.com/watch?v=54q6RzS9BpQ&t=10862s and https://lpc.events/event/7/contributions/780/

- KVM Forum 2020: https://mirrors.edge.kernel.org/pub/linux/kernel/people/will...

From the KVM Forum presentation: "We need a way to de-privilege third party code and provide a portable environment in which to isolate services from each other and also from the rest of Android."

From the LPC presentation:

"What do we need? We need a hypervisor that is:

1. open source

2. easy to ship and update

3. supports guest memory protection

4. trustworthy

KVM as part of GKI is a very good fit with the right extensions."

View on HN

I think development of mobile OS heads into a completely wrong direction. The "curation" effect of proprietary stores is only good for censorship and mobile OS have the most aggressive applications that border on malware. At least you don't have the browser toolbar classical systems were infected with?

For productivity I don't want iron curtains between my applications or between application and system. Hell, it would actually be nice to be able to directly interface the hardware without all the loops.

We have a deeply flawed security model for mobile OS that relies on dogma that won't lead to additional safety. As safety issue is data exfiltration and by that standard a mobile devices are vastly more dangerous than the average work station. Comes with the nature of the device to a significant degree, but I think mobile OS have ridden of a cliff somewhere.

And now they want to push apps into a VM? Why not just buy a device per app at this point...

Anybody making money off of phone apps should not be trusted, they can and still take every piece of data they can to figure out how to monetize it. I want and need phone app security to protect me from the companies that want me as a product to be sold.

I think where they are going with that is that this sounds suspiciously like a “people problem” and not a technical one though it is attempting to solve it via technology. For some reason desktops let software do whatever and they don’t seem to have near as much an issue as mobile OSes.

IMHO, it’s the fact that there’s a (basically, by default) a single market driven by (basically, by default) a single search engine to locate software. The desktop market, is largely NOT driven by a single market or search engine. With the “single market” if a malicious actor can game the search engine for even a day, they can install on (potentially) millions of devices. However, with the ‘ole distribution model, it’s much harder to game.

> For some reason desktops let software do whatever and they don’t seem to have near as much an issue as mobile OSes.

I think this may be a case of rose-colored glasses. How many PCs were and are a complete mess because Windows both is a free-for-all and is (or was) the largest attack target? Sure, we know how to keep our desktop systems sane, but most people don't.

Then you also need to look at the average persons phone. If you activate any network connection, it supplies the contents of your latest stool sample and sends it to 5 unclosed apps at least. The data exfiltration is not comparable and exposure of personal information also extends to contacts this person has in their phone. It is a much more hostile environment and not really clean at all.

There's reasons to be suspicious but it's also important to remember that mobile phones see much deeper penetration. About 84% of the world's population has a smartphone. Annually, ~1.6 billion phones are shipped vs 275 million PCs.

With scale comes new challenges and attack vectors.

> Annually, ~1.6 billion phones are shipped vs 275 million PCs.

This is most likely because people do not have to buy a PC every 3 years. Phones are treated as disposable items, whereas with a desktop, you can open it, clean it, change parts etc. I can even change the CPU in my laptop if I wanted to.

That’s one theory but one that doesn’t hold up by virtue of the fact that 83% of all humanity has a phone. The penetration for laptops/desktops never reached that high.

We can assume both as having reached steady state and that’s mostly replacement rate (not quite but almost).

Cell phones are more popular for obvious reasons: full access to internet at all times, TCO is drastically smaller across the board (upfront cheaper, cheaper internet, etc), and entire structures are built around them (many critical services go app first if not even app only).

I think you’re applying a very western bias in your analysis.

Most people also don't buy a smartphone every three years, they use them until they either die, or get stolen.

Both of which happen much more often than with laptops, at least in part because they are treated as being more disposable, but maybe more directly because they are smaller.

Which is why the desktop market has tons of garbage anti-virus and PC cleaning software, trying to fix the cowboy land it turned into.

This sounds awfully similar to Microsoft anti open source textbook that no one can be trusted besides them, you always need their platform and services between. The only difference is that now people are shilling Apples fake corpo security propaganda talking points and sadly they are often developers themselves.

I've definitely been surprised by the sentiment here lately that iOS devices are more secure. I don't know enough about iOS to evaluate that claim, but my impression of phone security is to basically assume it's been unlocked by someone even if most apps are successful sandboxed

Google sells advertisements, Apple sells... access to its store involving a hefty 30% tax.

Goggle's interests are aligned with the surveillance capitalists, Apple is either competitive (see Facebook) or ambivalent.

Apple can differentiate itself by trying to sell the security angle and hurting the surveillance of people in their app ecosystem doesn't hurt them. Comparatively, I would say Apple has a nontrivial advantage in security, though I wouldn't make a broad statement that iOS is "secure".

This has nothing to do with apps. It's instead about things like the biometrics or DRM handling code. The stuff that regularly runs on its own dedicated CPU or in specialized sandboxes like ARM's TrustZone. This is about moving that to instead be in a VM on the "primary" CPU, implemented in open source Linux kernel code instead of who-knows-what ARM microcode.

Or to compare against an ecosystem that has more love around here, imagine if everything that Apple runs on the T2 was instead run in a VM with an equivalent level of security. That's the goal.

Walled gardens have many problems, but one of the reason they exist is that they offer some security benefits. Virtualization allows for stronger containment of apps and make walled gardens less necessary.

Indeed, that's one of Google's official use cases: https://twitter.com/salt___doll/status/1492865396692586497

Recently, they've also focused on using VMs to isolate parts of the system and apps: https://twitter.com/salt___doll/status/1492872311652765700

Mishaal Rahman has written a detailed post about virtualization on Android: https://blog.esper.io/android-dessert-bites-5-virtualization...

> 4. trustworthy

What does this actually mean? Trustworthy under which circumstances, in what security model?

I'm terrified it means "unbreakable DRM in a way that is harder still for consumers to use or bypass" rather than "the code is not vulnerable to side-channel malware attacks". A lot of this could either be brilliant -- applications can't look at each other at all, unless one of a few trusted utilities such as screen-readers or keyboards, for example -- or utterly horrific from a user point of view. "Attestation" is mentioned in one of the end goals of that KVM Forum pdf, but it's unclear whether or not they mean a Qubes-like OS with the user as the hypervisor, or the user completely and utterly locked out of being the hypervisor, ever. One of these I think could be quite interesting -- especially without hardware attestation. One I think would be awful.

Part of the reason I (thoroughly break) Android's security model and run a rooted image is to have knowledge that I have control over everything in my device. It's important to me and I worry that these efforts will ultimately take that way from me.

Modern phones already have DRM running in TrustZone, even if you flash a custom Android build. pKVM is actually better in that regard as the DRM will be moved to a protected VM under Android's control, so you could choose to disable it on a custom OS.

Reply on news.ycombinator.com