Hello everyone.
It seems Chromebooks cannot setup a power-on password, like normal BIOS/UEFI do. So how can users prevent a hacker with physical access tempering with the system?
Let’s assume he don’t disassemble the computer, but there’s still many ways, right?
For example, he can boot via USB and change the unencrypted part(will it always triggering boot verify?)
Or, he can switch to developer mode and login as root or other hidden users. (Or does the system prevent those action without first login a normal user?)
And are there even more security holes one should pay attention to?
Thank you guys.
Related
With the introduction of Android 4.2, we now have native multi-user support. This is a great feature for those of us who have multiple people using one device, but I'd like to go one further:
What about those of us who want to enable a 'guest' account, so anyone can use our tablets?
What I'd like to see is an app/script I could install to the root account that would:
A) Lock the guest account out of settings (including "App Info" from the recents menu)
B) Disable rebooting into recovery and bootloader for the guest account
C) Disable USB Debugging and force WiFi on for the guest account (to prevent modifying and preserve anti-theft measures)
D) Allow the root user to configure a list of apps [on the guest account] whose data will be erased each time the guest account is logged in/unlocked (like facebook, chrome, twitter, instagram, etc)
E) Allow the root user to select apps (like the Play Store, GMail, or anything else that uses Android's native Google accounts) which can be password/pin locked to avoid Android native accounts (anything that adds to "Accounts" in settings) being added to the profile, or at least the ability to remove them at each login.
I'd be willing to pay for an app/script like this, and I can't be alone...
Jay Aristide said:
With the introduction of Android 4.2, we now have native multi-user support. This is a great feature for those of us who have multiple people using one device, but I'd like to go one further:
What about those of us who want to enable a 'guest' account, so anyone can use our tablets?
What I'd like to see is an app/script I could install to the root account that would:
A) Lock the guest account out of settings (including "App Info" from the recents menu)
B) Disable rebooting into recovery and bootloader for the guest account
C) Disable USB Debugging and force WiFi on for the guest account (to prevent modifying and preserve anti-theft measures)
D) Allow the root user to configure a list of apps [on the guest account] whose data will be erased each time the guest account is logged in/unlocked (like facebook, chrome, twitter, instagram, etc)
E) Allow the root user to select apps (like the Play Store, GMail, or anything else that uses Android's native Google accounts) which can be password/pin locked to avoid Android native accounts (anything that adds to "Accounts" in settings) being added to the profile, or at least the ability to remove them at each login.
I'd be willing to pay for an app/script like this, and I can't be alone...
Click to expand...
Click to collapse
I also thought that but i wish Google did this.
A. might be doable i will look into after core is done.(see below)
B. requires rom modification
C. may be doable but require root, turning wifi on is possible and automatically turning on if turned off is
D. I have auto enabling installed apps working, auto erase may be possible, Manuel is
E. wont be an issue cause you dont need to sign in with gapps, possible to disable but requires root
at this point i have the ability to enable any app installed on the primary user on a secondary user, all without root give me a few days to flesh out an app
aaronpoweruser said:
A. might be doable i will look into after core is done.(see below)
B. requires rom modification
C. may be doable but require root, turning wifi on is possible and automatically turning on if turned off is
D. I have auto enabling installed apps working, auto erase may be possible, Manuel is
E. wont be an issue cause you dont need to sign in with gapps, possible to disable but requires root
at this point i have the ability to enable any app installed on the primary user on a secondary user, all without root give me a few days to flesh out an app
Click to expand...
Click to collapse
You know...
If you cooked all of this into PA, it would be a) the *only* rom in existance with a true guest account, and b) a feature that would actually bring a wider audience and realm of attention to PA...
ok, started on an app turns out it needs root, thought about it but its going to be a stand alone app for all users, might be paid tho.
aaronpoweruser said:
ok, started on an app turns out it needs root, thought about it but its going to be a stand alone app for all users, might be paid tho.
Click to expand...
Click to collapse
Given the level of control over apps and data it would need to create a true guest environment, I figured it would be root only. If you need an alpha/beta teater, I'll happily volunteer
Jay Aristide said:
Given the level of control over apps and data it would need to create a true guest environment, I figured it would be root only. If you need an alpha/beta teater, I'll happily volunteer
Click to expand...
Click to collapse
this is an amazing idea, im up for alpha/beta testing as well.
Alpha/beta tester
I am looking for something like this as well, and will happily alpha/beta test it.
Ok... I am Software Engineer and I have been developing mostly for Windows environments, but recently started getting into Android. I want to get more into the Operating System from a lower level. I am looking to build a custom ROM that must meet certain requirements to be used.
What I would like to do for a specific device:
1) Strip stock ROM of bloatware
2) Use SSH Tunnel for all data traffic (3G/4G, WiFi, etc.)
- This will have to be an embedded setup so that the device will always be using the SSH Tunnel to encrypt data accessing from company resources.
- If at all possible, block sites that are normally blocked when on the physical network.
3) Company Email, Contacts, and Calendar information to be synced from Lotus Notes to native android applications using only the SSH Tunnel connection.
4) Enforce password requirement for phone lock screen.
5) Change the OTA Device Update server to create my own.
- Insight as to how I would host my own on my internal network would be appreciated, if it is at all possible.
6) Detect company secure WiFi Access Points and only permit automatic switching to these sources for data, others (unsecured) will need to manually connected.
Now, I know how to make a custom ROM, where I am stripping bloatware and pre-rooting and such so I don't need help with requirement 1.
However, I have no clue where to start with the security aspect of this. Is it possible to embed all the settings into the OS configuration for routing data over a secure and encrypted source? This is an absolutely imperative thing, where Corporate Security mandates that the syncing of emails and such must be done over an encrypted connection. If SSH tunneling is not the best solution, perhaps VPN? Our company currently deploys Cisco AnyConnect for VPN from company laptops. Again, this has to be built into the configuration of the device. The user cannot have the ability to turn off/on this feature (unless the root or do various other violations to corporate policy). Speed is not a concern, these are work devices and only need to be reliable in accessing work resources.
As for requirement 4, is there any way to force a password lock on the device? Maybe deploy the ROM in some sort of initial setup mode (similar to Microsoft's OOBE for windows), where they are prompted to create there phone password and enter various other credentials to setup the email syncing with the native email client?
For requirement 5 & 6, well these are just pipe dreams. If they could be done, and not require a UI to manage them, then it would be great. However, I figure this would be not so easy to do.
The reason why this all has to be built in and configured, is because the user cannot be given the option to disable these features with a simple UI. Also, the phones can not receive carrier specific OTA updates, that would wipe this system configurations. The update server has to be possible, as all the carriers currently host there own. There has to be a way to build my own and deploy my ROM as an official release to the device without having to have a custom recovery or root.
Any insight into any of this would be great. For the most part I am looking for the built in network access features that I discussed above and insight on how to accomplish this if at all possible. Everything else could just be whatever input you are willing to provide. I realize this is a big project, but the result will be a phenomenal step in securing and expanding company resources. I realize there may be enterprise solutions out there that will already accomplish most of this, but I am looking to stay away from those options.
mkruluts said:
Also, the phones can not receive carrier specific OTA updates, that would wipe this system configurations. The update server has to be possible, as all the carriers currently host there own.
Click to expand...
Click to collapse
Hello mkruluts,
where did you get that the carriers host their own servers?
I would seriously be interested.
Optimally, do you have a link?
I read on this forum that even the branded updates come from a manufacturer's server:
http://forum.xda-developers.com/showpost.php?p=43915102&postcount=574
"HTC gets the go ahead to push it OTA from their servers"
http://forum.xda-developers.com/showpost.php?p=8525999&postcount=141
"The vendor's servers are tied to the carrier network."
--Droiderino
Rooted your device, but it may have side effects !Does your phone really shutsdown !Next time you turn off your Android phone, you might want take the battery out just to be certain.
Security vendor AVG has spotted a malicious program that fakes the sequence a user sees when they shut off their phone, giving it freedom to move around on the device and steal data.
When someone presses the power button on a device, a fake dialog box is shown. The malware then mimics the shutdown animation and appears to be off, AVG’s mobile malware research team said in a blogThe malware requires an Android device to be “rooted,” or modified to allow deep access to its software. That may eliminate a lot of Android owners who don’t modify their phones.
But some vendors of Android phones ship their devices with that level of access, potentially making it easier for the malware to get onto a device.SO be careful about the rooting !
I am very excited to have access to bio-metric security on my new phone. However, for those of us in the U.S., there is one security exception that you should consider.
While its generally understood that no one, by law, may compel you to reveal a password; fingerprints themselves are NOT legally protected by the 5th amendment. There is precedence set that interprets the legal right for law enforcement to collect blood and DNA samples as evidence clearly extending to fingerprints.
If you want to fact check that, just google 'forced to fingerprint unlock' and you can pick from sources you trust the most:good:
Therefore, I want to know what XDA has to say about this. We have the phones now.What can we do?
My idea involved allowing the user to use fingerprints to authorize actions within the OS for speed(Ie Android pay,play-store purchases,access to contacts, etc), however disallowing fingerprint authentication for device unlocking and rely on PIN only. I think that is the best way to balance ease of use and security that a fingerprint reader adds while also avoiding the general lack of control over the authentication method used( fingerprints).
Even Google admits in the documentation, and I quote, "A physical copy of your fingerprint could be used to unlock your phone. You leave fingerprints on many things you touch, including your phone."(https://support.google.com/nexus/answer/6285273).
Therefore a third party having control over your fingerprints is admittedly a valid concern. Therefore Nexus imprint is NOT a secure authentication method UNLESS paired with a pin code. I think Two-Factor authentication is required here. We want to make sure that no one has both factors. 1 isn't enough here. They tell us that a PIN is better. Why not a fusion of both? Why cant I do TRUE 2-Factor and do PIN+print unlocks?
My questions to the community are these:
1. Do you really care about this?
2. Is there some sort of built-in way to implement this functionality with Nexus imprint already? I haven't found it yet.
3. Would you be interested in a application or system modification that did this?
It sort of already has a build in workaround. The phone requires pin after boot, so if you are about to be arrested.. shut down the phone.
Also if you use any third party app to lock the device, it needs pin to unlock (e.g. Nova double tap to lock screen).
1. No.
I see imprint as a convenience, not another factor. It improves security for me by allowing me to keep my phone locked with a strong password, without the inconvenience of having to enter it every time I pick up my phone.
A pin/password to unlock and in each app's "App info" settings dialog a switch where you could toggle Imprint/Voice/Face does sound ideal. This way the user is not left hoping the app developer implements these features. My banking app does Face/voice/pin, and I assume they'll eventually add Imprint, but I'd prefer the operating system gave me, the user, this power in much the same way they've given us granular control over some permissions & notification access. This actually seems like the logical next step to Screen Pinning.
As written in the title I would need a trick that prevents an Android device from requesting RSA authorization during the first use of ADB (which I use for remote connection via SCRCPY), and automatically give authorization to every devices.
I work in a company where we develop applications for companies, and for a project we used 30 Android mini-PCs that were installed in locations that are not easily accessible for maintenance, so I would need to access them remotely without requiring RSA authorization (precisely because reaching the mini PC to connect the mouse and accept the pop-up window would be really inconvenient).
If it can help the devices we use are already rooted.
Thanks in advance for the support.
Best regards,
Vasco.
if clicking a pop-up is inconvenient then so is this trick too...
https://forum.xda-developers.com/android/help/solved-adb-unauthorized-rsa-prompt-t3693961
CXZa said:
if clicking a pop-up is inconvenient then so is this trick too...
https://forum.xda-developers.com/android/help/solved-adb-unauthorized-rsa-prompt-t3693961
Click to expand...
Click to collapse
Thanks CXZa, yes also this solution would be a bit tricky.
The best solution would be a method applicable during development, something that can maybe bypass this control and allow an automatic authentication to any incoming connection and for any device.
Really I don't know if it's something possible in Android, maybe also with a third part application.