Conversation

I'm sure that

will give bootrom exploits more thinking and understand that checkm8-style exploits will happen eventually. SOLUTION: avoid embarrassment by providing an option to unlock the boot (w/ pincode). Don't fight it and lose - #FreeTheSandbox and WIN!

569

Replying to

I love phones which allow unlocking the bootloader (most of Android) or installing custom signing keys. But some people need to be able to trust their phone. Even w/custom keys a bootrom exploit is undesirable. It's hard to make a secure boot chain with compromised components.

This Tweet is from a suspended account. Learn more

Replying to

and

Pixel3 (and maybe 2) but only for the Linux Kernel/Android System. You can install your public key and re-lock the bootloader.

Replying to

and

The Nexus 5X and 6P were the initial Nexus devices with full verified boot for the OS and they provided full support for using it with alternative operating systems from the beginning. Pixel and Pixel XL used a similar implementation, and it got better in the following devices.

Replying to

Pixel 2 and 2 XL were the initial devices with AVB (Android Verified Boot 2.0), rollback protection for the OS and hardware-based attestation which all works for alternative OSes. Auditor (attestation.app/about) is an app using the attestation support and works with other OSes.

attestation.app

Auditor overview

Overview of the Auditor Android app and associated service.

Replying to

Pixel 3 and 3 XL didn't change much in terms of features but the new security chip is heavily integrated into bootloader state protection and verified boot, including enforcing the custom key and rollback index. It also provides a better hardware-backed keystore and attestation.

11:01 PM · Sep 27, 2019Twitter Web App

Replying to

See android.googlesource.com/platform/exter for documentation of the current generation OS verified boot implementation. Qualcomm's bootloader sources are at source.codeaurora.org/quic/la/abl/ti as an example of a firmware implementation. Can see they bundle libavb and implement the familiar bootloader UI.