Quarkslab Blog

"Job" objects allow some resource limits to be applied to groups of processes (including any children they spawn) but don't do much or anything for restricting the system resources accessible to process in a job.[1] Instead that is a feature called "silos"[2][3][4], as well as the accompanying use of Windows Brokering File System filter driver[5] (or is it UCIFS, or BFS+UCIFS...?[4]), as well as SeAccessCheck interception[6], and whatever else applied to a "silo" or processes.

Hardly anything about "silos" and seemingly nothing about BFS (for providing a virtual filesystem to a process) is documented publicly by Microsoft. Unless a Windows application developer has a particular interest in reverse engineering the Windows Kernel, they're probably not going to be using much of Windows Kernel sandboxing/isolation techniques beyond the simple interface that UWP exposes for GUI applications because it's just too hard otherwise.

For example, in the excellent description of this officially undocumented mess at [2] and [3], the author notes:

"What is interesting here is that there does not seem to be any general mechanisms for restricting access to syscalls globally, which means that the attack surface can be quite large. Indeed, even if it is possible for the Kernel to know if the execution comes from inside a Silo, each syscall must set up its checks (or not). In addition, some syscalls do not directly block access to Silos, but rather implement a different logic between a host…

You've fallen for a simple marketing campaign. What Google does with data has nothing to do with what data Android collects out of the box, which I have demonstrated (and you have not refuted) is less than what iOS collects. You can just as easily send your location, email, and search data to Google on iOS as you can on Android. The difference is that on Android, it is possible (even easy) to choose not to send data to Google or Apple.

> If you actually cared about this stuff, you'd be applauding Apple.

If you actually cared about privacy, you would be damning Apple for handing over the iCloud keys for Chinese users' data to the PRC allowing the PRC to implement dragnet surveillance on iCloud documents, iCloud email, iMessages, etc. to find and disappear dissidents. This is worse than anything Google or even Facebook has done by a stupendous margin.

> iMessage is E2E encrypted.

Since Apple controls the keyserver, Apple has the ability to wiretap any iMessage conversation (https://blog.quarkslab.com/imessage-privacy.html). Since China controls the keyserver inside the great firewall, China has the ability to wiretap any conversation that occurs with at least one user in China. Compare to Android, where you can set Signal as your default SMS handler. One pretends to support privacy, while the other actually does.

> Apple Maps doesn't know who you are.

But it does know where you are and every address link you click on. From there, you are very easy to deanonymize. Compare…

Am I being kept safe by Google? What evidence is there of that?

There appear to be 635 vulnerabilities publicly disclosed by 3rd parties in Android this year with 43 being critical and 139 being high or critical [1]. 224 in Chrome [2], though none being labeled high severity, though that is mostly due to the fact that things such as disclosed remote zero-click heap corruptions leave the final bit of actually getting full code execution as a trivial exercise to the reader.

There was a cool attack demonstrated a few weeks ago completely defeating the Google Titan M security chip [3], their custom-designed secure vault used to store your most sensitive secrets. It could be hacked through software alone to exfiltrate all of its secrets. Given its purpose their security process should have resulted it being designed by their best security experts and been their most secure consumer product. Beaten by three people with a year and a half.

I mean seriously, their flagship, in-house Android phones are advertised as only conforming to the absolute lowest levels of security [4][5]. Seriously, go read that [6] on page 9 they describe the arduous certification process where the auditor googles “Android” and sees that there are no unpatched vulnerabilities. This is their primary advertised third party audit of whole system Android security.

So, a company which produces products with loads of vulnerabilities, has their most secure products defeated by moderately resourced attackers,…

I'm playing Devil's Advocate here because I sympathize with your point, but isn't there a way you can squint and look at this weird that it's true of pretty much everything else? IBM makes tons of money off of Linux, for example. iXsystems profits off of FreeBSD. Facebook profits off of their wildly popular C++ libraries.

I think we really need to divorce "profit" from "open source". OSS is great because we can contribute our own ideas to it, because we can learn from it, because we can form communities around it. It's also useful because it's a vector for entrepreneurship. Edit: why should these be mutually exclusive properties?

It's fair to point out that it can be a vector for exploiting unpaid labor. But that's an accessibility issue that exists already. For example, it's easy to tell folks interested in the field to "do open source work" if they want to get a job in the field. If you're a low-income single parent, this doesn't make CS more accessible, it's a sick joke. Even without profit, open source isn't this bastion of opportunity that we sometimes like to think it is.

You make an excellent point that it's hard to learn large new systems. But it's not impossible. Indeed, it's possible to make super meaningful contributions to the system in "limited time", starting with net zero knowledge: https://blog.quarkslab.com/playing-around-with-the-fuchsia-operating-system.html. To that end, I have to disagree that we're the kind of project that outsiders can't…

> For years we’ve offered encryption services like iMessage and FaceTime because we believe the contents of your text messages and your video chats is none of our business.

Sounds great, but take note that it's none of their business today and we know they can be compelled to spy on their users by NSLs.

They control the key infrastructure with their closed-source software that runs on their closed-source hardware.

If they wanted to go into the business of sucking up all of your private messages and parsing them to sell advertising or if the government wants to read some messages, they wouldn't need to do anything besides issue you a different key.

iMessage won't even let you look at the fingerprints of your friends, and it won't warn you if they've changed. [1]

[1] http://blog.quarkslab.com/imessage-privacy.html

I'm gonna write about this in pt. 2. Basically you can use symbolic execution to recover the CFG[1] (using something like miasm), you can eliminate dead code, restore dynamic lib calls with an emulation, and whatever else. But the point is that it would take an incredible amount of work and co-operation between tools, and then you wouldn't have even begun understanding anything about the binary, which is a whole another story. Now there's a kind of a little shortcut to all of this, which when combined with a couple of tools, you'd be able to make sense of things in this binary, which I'm gonna reveal in my next post.

[1]: https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html