Android Ping!
My take: I don't encrypt my device, but then I don't store anything valuable on it either. I don't use the electronic pay, I don't use the same passwords on any email accounts as on my bank site, etc.
Posted on 07/06/2016 9:49:42 PM PDT by Utilizer
The full disk encryption used to safeguard information stored on Google Android devices can be broken, an independent researcher has found.
Gal Beniamini spent several years analysing the TrustZone platform found on Qualcomm chipsets, and utilised previously gained knowledge to run code that is able to extract the encryption keys used to scramble stored data on Android devices.
The researcher discovered that encryption keys derived from the TrustZone feature could be extracted by software and cracked by brute force outside the Android devices, thus bypassing security mechanisms that limit the number of password guesses that can be made.
(Excerpt) Read more at itnews.com.au ...
Ping!
NSA approved.
How do you crack code by using brute force? This sounds like an incorrect Autocorrect correction.
At first guess? By throwing numbers at it.
Been done in the past.
Sometimes/Often the effective key space of crypto keys may be less than the theoretical maximum (2 raised to the number of bits in key).
Sometimes bad crypto sets up the keys such that you can make predictions/short-cuts that narrow the key space enough to make brute forces attacks feasible.
If Android has a max-retries value that if exceeded wipes the storage, pulling the keys outside the system lets an attacker try as many times as he wants to guess to the password.
Google implemented.
Brute force = repeated attempts.
Which, if you have enough computing power behind it, does indeed work. Strains the brains, ‘ay mate?
Android = Google = NSA
for real security,
pre-encrypt with a
(at least) 256 bit symmetric-key block-cypher
Of course it can. The NSA would not have it any other way.
https://en.wikipedia.org/wiki/Brute-force_attack
In cryptography, a brute-force attack consists of an attacker trying many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found. Alternatively, the attacker can attempt to guess the key which is typically created from the password using a key derivation function. This is known as an exhaustive key search.
This encrypts the data while it is on the device, but not if the data is moved via some transport mechanism (WiFi, Cellular, etc). In other words, TrustZone protects data at rest, not data in motion.
Seems to me the key here is physical control and security.
The 3rd Law of the 10 Immutable Laws of Computer Security is:
#3: If I can get physical access to your computer, it's no longer your computer.
I know this doesn't help if the device is lost, stolen or used by some malicious player, but if I could get a copy of even something as secure as a Windows domain controller's NTDS.DIT file, I could brute force and hack at it at leisure.
So the 3rd law still very much applies.
Thanks for the heads up. I’ll post to the list this weekend when I get home. On the road, and I forgot to bring the latest list with me or put it up on docs...smh
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.