Copperhead CTO: Nexus Phones Already More Secure Than BlackBerry Priv

[Lucian Armasu]

Copperhead's CTO, Daniel Micay, answered some questions about why he doesn't think the BlackBerry Priv is as secure s many believe it is, and about his company's own security-hardened open source OS.

Copperhead CTO: Nexus Phones Already More Secure Than BlackBerry Priv : Read more

 

[elduque]

Can you root it? If so, it's not as secure as the Priv. Fingerprint scanners on phones are a joke. A smart thief will lift your print from the phone and make a mold. Further to that, if it can be rooted/jailbroken all security bets are off.

Android itself is a privacy nightmare, unless you're cool with sharing every detail of your life with Google.

 

[randomroyalty]

A nexus more secure? Seriously? Any phone that Is easy to unlock the bootloader and root is inherently less secure. Any tampering with the hardware key signed BlackBerry kernel renders the phone useless. Higher level exploits are possible of course.

 

[strcat]

Being able to unlock Nexus devices isn't a security issue. It requires physical access and wipes the device, so an attacker would be better off replacing your phone with a malicious one and capturing your encryption password when you turn it on (sending it to them). Then, they can decrypt your phone and retrieve your data. If they wipe it, the data is gone. In what threat model does a locked bootloader help the user? It's to protect carriers from the user (cannot remove things like marking tethered data and their spyware), not users themselves.

 

[randomroyalty]

Being able to unlock Nexus devices isn't a security issue. It requires physical access and wipes the device, so an attacker would be better off replacing your phone with a malicious one and capturing your encryption password when you turn it on (sending it to them). Then, they can decrypt your phone and retrieve your data. If they wipe it, the data is gone. In what threat model does a locked bootloader help the user? It's to protect carriers from the user (cannot remove things like marking tethered data and their spyware), not users themselves.

 

[strcat]

Oh, and on new Nexus devices like the Nexus 9, Nexus 5x and Nexus 6p, unlocking the bootloader requires first enabling unlocking inside of the OS. So the encryption password is required to do it. They already have your data if they're able to unlock. It's a non-issue from a security perspective. Note that the bootloader can be fully locked against after replacing the OS too.

 

[randomroyalty]

If a phone can be tampered with, then all kinds of man in the middle attacks are possible when the phone is issued to a user. If i was in a high security environment issuing mobile devices, there is no way i would ever issue a Nexus.

 

[Nate650]

Interesting. So what happens when Android 6.0 comes to the Priv?

From his answers, it seems Daniel doesn't exactly know what BlackBerry's security enhancements were.

 

[strcat]

The comments on kernel changes are based on analysis from the source code (https://github.com/blackberry/android-linux-kernel/tree/msm8992/AAC724) but analysis of userspace had to be done by probing at it from an app. So it's easy to tell that they didn't fix ASLR or do much hardening, but it's not possible to state with confidence that they didn't do any meaningful userspace hardening. It sure does seem that way though.

 

[strcat]

i.e. they didn't seem to do any improvements that would make apps more secure, but they have have locked down one or more of the system services more (seems unlikely, otherwise it'd be a point in their marketing rather than just 'applied hardening patches to kernel')

 

[captaincharisma]

nexus devices are more secure because google controls them.the priv is less secure because it is using a modified version of android which can compromise security with the additional pre loaded software and there will be a delay with updates like every other brand because of it. anyone saying the pric is more secure than nexus is just grasping at straws trying to defend it or another apple sheep because everyone knows someone will find a way to root and unlock t it anyway just like every other android or apple phone

 

[captaincharisma]

If a phone can be tampered with, then all kinds of man in the middle attacks are possible when the phone is issued to a user. If i was in a high security environment issuing mobile devices, there is no way i would ever issue a Nexus.

wow, you are either really ignorant or a fanboy of some sorts. anyone who knows anything about the mobile industry would know nexus devices would be the best in a work environment because they are always first to get any major or security updates. during the stagefright scare it took less then a week to get the security patch sent to my nexus 4

 

[anubis44]

If a phone can be tampered with, then all kinds of man in the middle attacks are possible when the phone is issued to a user. If i was in a high security environment issuing mobile devices, there is no way i would ever issue a Nexus.

wow, you are either really ignorant or a fanboy of some sorts. anyone who knows anything about the mobile industry would know nexus devices would be the best in a work environment because they are always first to get any major or security updates. during the stagefright scare it took less then a week to get the security patch sent to my nexus 4.

Then you must be a Google fanboy, because every intelligence, military and government agency with even the slightest security requirements uses a Blackberry. The Nexus and all Android and iPhones are pathetic toys compared to a Blackberry for security. I work for an organization where all our iPhones were taken away and replaced with Blackberrys two years ago, because the iPhones weren't secure enough.

I'll take Blackberry's security any second of any minute of any hour of any day over Google's.

 

[johnmeredith]

Looks like BlackBerry have answered:

http://blogs.blackberry.com/2015/11/why-blackberrys-android-is-best-for-security-and-privacy/

I'd take 15 years experience in security personally.

 

[strcat]

Looks like BlackBerry have answered:

http://blogs.blackberry.com/2015/11/why-blackberrys-android-is-best-for-security-and-privacy/

I'd take 15 years experience in security personally.

They haven't actually provided any new technical details. Only more marketing buzzwords and misleading claims.

https://twitter.com/CopperheadSec/status/669506755324477441

 

[4ron]

I suggest you read the head of BlackBerry security own response to this claim. BlackBerry states that the Priv is unequivocally the most secure android device. Period!