Thoughts after a Month with Blackphone
About a month ago, I decided to order a Blackphone. The 製品 web 場所／位置 makes some tall （人命などを）奪う，主張するs about 安全, even calling it a “安全な・保証する smartphone.” This 肉親，親類d of 布告／宣言 is rather bold, perhaps even disingenuous, and often leads to 激しい scrutiny in the 安全 community. For example, consider the the 返答 to Oracle calling their 製品 “Unbreakable.” I’m a bit of a 懐疑論者／無神論者, so over the last month I’ve spent some of my 解放する／自由な time 研究ing Blackphone as a company and 評価するing the 安全 of its 旗艦 smartphone. I wrote this 地位，任命する to 現在の some of my 観察s and the opinions formed as a result of my 研究.
Before 飛び込み in, I want to point out that I’m not the first person to take a look at Blackphone. The 装置 was 発表するd in January and was finally made 利用できる in June. At that time, Ars Technica reviewed a pre-解放（する） 見解／翻訳／版 of the 装置 and their review was cross-地位，任命するd on Bruce Schneier’s blog. In August, Blackphone had a booth in the DEF CON 22 vendor area and the CSO even did an interview discussing the 装置. At that event, fellow droidsec 研究員 jcase bought a Blackphone and subsequently rooted it on the same day. After 黒人／ボイコット Hat/DEF CON, companies like Malwarebytes, Bluebox, and viaForensics have since 地位，任命するd their takes on the 装置. These articles and myriad of associated reader comments raise many valid points; many of which echo my own 感情s.
I 購入（する）d the Blackphone すぐに after returning from DEF CON. It shipped 直接／まっすぐに from Hong Kong and arrived in only two days! Once it arrived, I quickly 追加するd it to the droid army and starting taking a look.
Getting Root
My first order of 商売／仕事, as is the 事例／患者 with any new 装置, was to get root on the 装置. It shipped with PrivatOS 1.0.1, which left it 攻撃を受けやすい to the chain of bugs jcase used to root Blackphone at DEF CON. The steps in 再生するing this method are as follows:
- Enable third-party app 任命する／導入するs
- Host/任命する／導入する an apk that pops the debugging menu (be sure to 始める，決める Content-type)
- Run the app and enable USB debugging
- Use adb jdwp with jdb to debug the “remotewipe” system app
- 注入する some code to spawn telnetd as system
- Find a way to get from system to root
I made 公正に／かなり short order of 再生するing the first five steps of the path to root, leaving me with system 特権s. The last part 伴う／関わるd getting root from the system account. jcase didn’t 公表する／暴露する his method for 達成するing this, so I started auditing to find my own way. It didn’t take long before I 設立する what I was looking for.
The に引き続いて excerpt from /init.qvs.rc illustrates the problem.
service boot_script /data/boot_script.sh
oneshot
使用者 root
無能にするd
[...]
on 所有物／資産／財産:sys.boot_completed=1
[...]
start boot_script
On Android, the system 使用者 owns the /data directory and therefore can easily create the /data/boot_script.sh 爆撃する script. On the next boot, init will 遂行する／発効させる the script as root. This 許すs not only 増大するing 特権s from system to root, but also 許すs 固執するing root 接近 across その後の 攻撃を受けやすい system updates. I was able to use this 問題／発行する to keep root 接近 even after 任命する／導入するing the PrivatOS 1.0.2 and 1.0.3 updates.
報告（する）／憶測ing the 問題／発行する
I 報告（する）／憶測d the 問題／発行する on August 25th and it was quickly 定評のある. A 直す／買収する，八百長をする was 解放（する）d as part of PrivatOS 1.0.4 on September 9th. The Blackphone staff 直す／買収する，八百長をするd the 問題／発行する within 14 days and graciously credited me in their 解放（する） 公式文書，認めるs. Such a short turn around is pretty impressive for a 安全 問題／発行する in the 初期の ramdisk of a smartphone. The 直す／買収する，八百長をする for the 問題／発行する is as follows:
diff -ubr 1.0.3/boot/root/init.ceres.rc 1.0.4/boot/root/init.ceres.rc
--- 1.0.3/boot/root/init.ceres.rc 2014-08-26 19:46:49.029329552 -0500
+++ 1.0.4/boot/root/init.ceres.rc 2014-09-09 14:06:38.526742249 -0500
@@ -591,9 +591,6 @@
使用者 system
group system inet net_admin
-# 顧客s should 除去する this line
-輸入する init.qvs.rc
-
# スピードを出す／記録につける save to とじ込み／提出するs
service nvlog_to_file /system/貯蔵所/nvlog_to_file.sh
class main
Only in 1.0.3/boot/root: init.qvs.rc反映するing on 偉業／利用するd 問題／発行するs
Although Blackphone 直す／買収する，八百長をするd these 問題／発行するs quickly, it’s 不明瞭な why they shipped in the first place. The excerpt above 含むd 除去するing a comment that says, “顧客s should 除去する this line”. This comment was likely left by NVIDIA, the System-on-半導体素子 (SoC) 製造業者 who 供給するs the Board Services 壇・綱領・公約 (BSP) for this 装置.
In steps 4 and 5, I 偉業／利用するd a 安全 問題／発行する 報告（する）／憶測d by Sebasti?n and Marco from viaForensics (also droidsec members). jcase 独立して discovered and 偉業／利用するd this same bug at DEF CON 22. The root 原因（となる） of the 問題／発行する was that Blackphone shipped a system app that was debuggable. It’s やめる unfortunate 現実に, because the Android Compatibility 実験（する） 控訴 (CTS) would find this type of 安全 問題／発行する quickly.
Unfortunately, the staff at Blackphone didn’t catch these 問題／発行するs on their own. The presence of such 問題／発行するs is 苦しめるing. A solid 安全 開発 Lifecycle (SDL) should make the 見込み of such 問題／発行するs small. Perhaps Blackphone doesn’t have an SDL, or perhaps they just 行方不明になるd these 問題／発行するs. In any 事例／患者, the fact that such 新人 mistakes shipped detracts from Blackphone’s 安全 （人命などを）奪う，主張するs.
Differences from Android/AOSP
After やじ the 装置, I began 調査／捜査するing 正確に／まさに what changes Blackphone made to Android/AOSP to make their 装置 more 安全な・保証する and/or 私的な. People have been making a bit of stink about this on Twitter and in reader comments on さまざまな articles. Most of Blackphone’s 返答s point to 過程 differences like quicker patching rather than hardening or 増加するd privacy features. Keep in mind that although some of the differences from other Android 装置s are 明らかな, they aren’t やむを得ず differences from AOSP.
PrivatOS is NOT Open Source
Unfortunately, Blackphone has not made any of their source code for PrivatOS 利用できる; にもかかわらず making 約束s to make Blackphone “open source all the way.” They made the source to their Linux kernel 利用できる, which they are 合法的に encumbered to do 予定 to GPL. Much of the code in AOSP is 解放（する）d under a BSD or Apache license, which does not have this 合法的な 必要物／必要条件. I’m not terribly surprised given the fact that Silent Circle, one the companies behind Blackphone, also was very slow to keep their open source 約束.
The 推論する／理由s for not 解放（する）ing code are 不明瞭な. Perhaps the 官僚主義 that 疫病／悩ますs the 動きやすい operating system ecosystem is 後部ing its ugly 長，率いる. The 原因（となる） could be 内部の 兵たん業務 問題／発行するs, NVIDIA 持つ／拘留するing them 支援する, or an 試みる／企てる to 保護する company IP. Whatever the 事例／患者, the important thing to realize is that keeping the code の近くにd 傷つけるs Blackphone.
開始 the source code will 増加する 信用 in the Blackphone 製品 and the company behind it. “Many 注目する，もくろむs” arguments aside, auditing open source ソフトウェア is easier than 逆転する 工学. For example, in June 2013 Azimuth 安全 reviewed the open source ZRTP library used by Silent Circle’s apps. They identified several vulnerabilities which were subsequently 直す／買収する，八百長をするd. Without taking a look at the Blackphone code, we don’t know if they introduced 付加 安全 問題／発行するs, which is unfortunately ありふれた for Android 装置 製造業者s. The ideal way to review these changes from AOSP would be to compare the source code against Android 4.4.2. Without the code, the 量 of 逆転する 工学 time and 成果／努力 要求するd is enough to dissuade most 研究員s (含むing me, so far). Apart from making auditing easier, 開始 the source code 大いに 改善するs transparency. 研究員s and 分析家s can easily review the code to 立証する no backdoors are 現在の.
Not Android 両立できる
Although Blackphone is based on Android 4.4.2 from AOSP, it is not Android 両立できる. That means Blackphone isn’t 許すd to use the Android 指名する and cannot ship with 接近 to Google Play. The former is 大部分は unimportant, but the latter 現実に has 利益／興味ing 安全 ramifications ? both good and bad.
除外するing Google Play, or any other app 蓄える／店 for that 事柄, 除去するs a 抱擁する attack surface. In fact, in Blackphone’s default configuration, you can’t 任命する／導入する apps at all. I think this is fantastic. After all, 任命する／導入するing an app is 効果的に 同等（の） to giving the author of that app a 爆撃する account on your most personal machine. Nobody would give a 完全にする stranger a 爆撃する, now would they?
On the flip 味方する, not having 接近 to Google Play means Blackphone doesn’t 利益 from the 資源s that Play 供給するs. Features like (a)自動的な／(n)自動拳銃 app updates, remote kill, and other ecosystem wide mitigation 可能性のある. その上の, it probably means Play Services and Google Cloud Messaging are not 現在の, which may break apps that depend on those features. Omitting this feature 効果的に separates Blackphone from the 残り／休憩（する） of the Android ecosystem; for better and for worse.
Not going the “両立できる” 大勝する also means that Blackphone probably doesn’t have 接近 to the Open Handset 同盟. While not much has been 明言する／公表するd 公然と about the OHA since its inception, it is believed to be the channel through which Google and other Android OEMs 株 important vulnerability （警察などへの）密告，告訴（状）. Not having 接近 to 個人として 報告（する）／憶測d vulnerability （a）忠告の／（n）警報s and code 直す／買収する，八百長をするs ahead of time puts Blackphone at a slight disadvantage. Because 公表，暴露 practices are so terrible in the Android ecosystem, Blackphone may 行方不明になる out on important 直す／買収する，八百長をするs 完全に.
Considerations of Forking AOSP
As a fork of AOSP, Blackphone’s PrivatOS 背負い込むs 重要な 維持／整備 costs but can also realize some amazing 利益s. Standing at over 25 gigabytes of source code, backporting patches can be a nightmare. This is probably the biggest 推論する／理由s that OEMs and 運送／保菌者s take so long to 解放（する） firmware updates. In some 事例／患者s, difficulties arise resulting in such updates 存在 scrapped and never 解放（する）d at all.
Just think of the insane 量 of code that will change when Android L is finally 解放（する）d. To remain 安全な・保証する, Blackphone will have to do one of two things. 選択 one is to 徹底的に捜す through all 解放（する）d changes and backport 安全 関連した 直す／買収する，八百長をするs. This 適用するs to not only Android-明確な／細部 事業／計画（する）s, but also to 外部の 事業／計画（する）s that are 含むd in AOSP like OpenSSL and WebKit/Blink/Chromium. 失敗 to do so could leave Blackphone 使用者s susceptible to 公然と 公表する／暴露するd 安全 問題／発行するs such as those 定期的に published on the Google Chrome 解放（する）s blog. For example, the stable channel update on August 26 直す／買収する，八百長をするd over eight 安全 問題／発行するs, four of which were 率d High and one 率d 批判的な. Blackphone will need to review such changes and keep their fork updated to keep 使用者s 安全な・保証する. This is no small feat.
Now, the awesome part of 存在 a fork is that they can do this quicker than Google itself. 存在 decoupled from AOSP, they don’t have to wait for Google’s 直す／買収する，八百長をする to come 負かす／撃墜する in the next major 見解／翻訳／版 解放（する）. This is something that Blackphone is already doing, and doing 公正に／かなり 井戸／弁護士席. For example, they were able to 直す／買収する，八百長をする serious vulnerabilities like FakeID and futex/Towelroot on their own, 加速するd time line. This is certainly a good thing, but as について言及するd earlier in this section, the sheer 量 of code to 跡をつける and 持続する remains a herculean challenge.
観察するd Changes
While using the Blackphone, the に引き続いて changes from AOSP were 観察するd:
- The bootloader on the Blackphone is easily unlockable, but すぐに re-locks itself after booting up. This is annoying when developing, but is a 広大な／多数の／重要な feature for those that might forget to re-lock the bootloader.
- The 回復 方式 on the 装置 appears changed, but it’s not （疑いを）晴らす how 正確に／まさに at this point. First off, it’s difficult to get into. To do so, you have to use “adb reboot 回復” or quickly 攻撃する，衝突する Vol-Up and Vol-Dn after 力／強力にするing the 装置 on. Once you get in to 回復 方式, the buttons don’t appear to do anything at all. This means no sideloading updates and so on.
- 許可s 扱うing code within the Android 枠組み must have been 修正するd to support the 許可s Privacy feature. This is 推定では the biggest change that Blackphone has made to AOSP.
It’s important to 公式文書，認める that these changes have not been 立証するd by comparing code to AOSP or さもなければ; mostly because the source code is not 利用できる. This is by no means a 完全にする 名簿（に載せる）／表（にあげる） of changes, or even possible changes. I am leaving a more in-depth review for a later date or an 演習 to the reader.
Bug Bounty Program
On September 23rd, Blackphone 発表するd their bug bounty program. Surprisingly, this is the first Bug Bounty program for any Android-based smartphone. Although Google’s Patch Rewards Program (PRP) covers AOSP, it is 焦点（を合わせる）d on hardening and does not reward for individual vulnerability 報告（する）／憶測s/直す／買収する，八百長をするs. Chrome 申し込む／申し出s a bug bounty, which covers Chrome for Android, but that’s a far cry from 支払う／賃金ing for bugs in the entire Android OS.
以前, Blackphone 公然と 明言する／公表するd that they were against Bug Bounties. In fact, CEO Toby Weir-Jones told Ars Technica that “bug bounties are contrary to the company’s philosophy.” Although it’s strange that they have changed their mind, I welcome and applaud their new approach. Working with the 安全 研究 community 捕まらないで and 補償するing 研究員s for their time is the 権利 move.
結論s
After only a little over a month with a Blackphone, I’ve gotten a feel for the 装置, the company behind it, and the ソフトウェア that it runs. Along the way, I noticed several differences to most other Android-based 装置s. I tried to discern whether or not the 装置 lives up to its （人命などを）奪う，主張するs of 存在 焦点（を合わせる）d on 安全 and privacy. While I made some 前進 in this, I think there is much left to be done.
When it comes to 安全, I feel that Blackphone’s （人命などを）奪う，主張するs are overstated. Blackphone made several 新人 mistakes when shipping their 装置, one of which was 完全に avoidable by 簡単に running the Android CTS. その上の, the Blackphone 含む／封じ込めるs no 付加 OS or kernel hardening features when compared against other Android 装置s. Comparing the 装置 against Samsung’s 星雲 S5, Blackphone lags やめる a bit behind.
Of course, it’s not all bad news. Their かかわり合い to 急速な／放蕩な patching, which I’ve 証言，証人／目撃するd first 手渡す, deserves 広大な／多数の／重要な acclaim and is a refreshing 改良 over the 残り／休憩（する） of the Android ecosystem. With the 新規加入 of their bug bounty program, they are 均衡を保った to truly make a difference by てこ入れ／借入資本ing the community 捕まらないで. Blackphone still has 安全 challenges to 征服する／打ち勝つ, but they seem to be 長，率いるd in the 権利 direction.
I would be remiss if I didn’t point out Blackphone’s flakiness when it comes to keeping their word. The company’s 無（不）能 to keep its 約束s raises 疑問 and will likely 原因（となる） many would-be 顧客s to lose 利益／興味. The type of people that value Blackphone’s 重要な features need to be able to 信用 the 装置 and the company behind it. I implore Blackphone to 修正する this problem, 支持する their word, and 配達する the source code to PrivatOS. I’m 納得させるd that much good will come of it.
Privacy is where Blackphone really 向こうずねs. From 許可s modifications to custom communications apps, Blackphone’s privacy features truly make snooping on a 使用者’s 私的な （警察などへの）密告，告訴（状） more difficult. Unfortunately, 達成するing privacy 要求するs 達成するing solid 安全. All bets are off if someone 妥協s the 装置, 関わりなく 安全な・保証する cryptography or さもなければ.
All said and done, I can honestly say that I like the 装置. I admire and applaud what the company is trying to do and wish them the best.