Thread replies: 11
Thread images: 1
Thread images: 1
Anonymous
Are we able to verify the enviroment? 2016-06-29 17:47:22 Post No. 55322147
[Report] Image search: [Google]
Are we able to verify the enviroment? 2016-06-29 17:47:22 Post No. 55322147
[Report] Image search: [Google]
File: cc60a2a0a6cfe61600a3a5eddc219ccc.jpg (15KB, 236x324px) Image search:
[Google]
15KB, 236x324px
From the point of view of an user executed program, how do you know that the system you are being executed in is legit? This question came to my mind when i read that fingerprint reader of android phones or the android pay system requires selinux in enforced or root not activated, or not having a custom recovery, in order to be sure that it is used in a secure enviroment... But how does the program know if that one selinux that says is in enforced is in fact a true legit selinux in enforced and not a fake selinux created to fool the program into thinking it is a safe enviroment?
I mean, and overall thinking, is there a way to check if all the (linux or not) system you are into is really the system it says it is?
From a superuser point of view you can always build from sources and check files but from an user executed program, what can you do?
Because you know, you can always overwrite the SELinux system into a modified one that does the exactly same job except for specific things (for example, in order to see private info you wouldnt be able to see)
>>
no one? ;(
>>
The developer could publish signed binaries.
>>
Not really. OS can pretty much tell whatever it wants to programs running on it.
>>
>>55322147
Android Pay just checks if root is enabled, and if so, doesn't let you proceed. There's no security magic in it. You can patch out the check or have the OS lie about it.
It's just there to make it harder for people to fuck themselves (and Google who has to deal with their mess) when they have no idea what the possible implications are of simulatanously using custom roms, root access, Android pay and shitty fake puzzle&dragons cheaters.
>>
>>55322147
>an user
>an
>>
>>55324155
yea, i know, the question is if you can check if the system is legit
>>55324212
sorry mister dictionary, but you are in an international website
>>
>>55324244
>vocabulary == grammar
>in a website
I'm not him.
I am also not a native English speaker/writer, put in some effort.
>>
DUDE WEED LMAO
>>
>>55324686
put in some effort thinking, if i werent putting any effort i would not even be talking in english at all... just by thinking a little bit you would realise people could made mistakes...
Im very sorry for offending your grammar sense
>>
>>55322147
you can check (or used to be able to...) if the program is running on a VM from some small asm code. also, you can check for typical devices (PCI/CPU/...) used in VMs, like QEMU/VBOX disk or whatever. also, check for number of usable cores vs advertised in the CPU.
Thread posts: 11
Thread images: 1
Thread images: 1