Inside Boeing's New Self-Destructing Smartphone 162
mpicpp writes "It looks thicker than most of the phones you see at Best Buy, but Boeing's first smartphone isn't meant to be used by the average person. The company that's known for its airplanes is joining the smartphone game with the Boeing Black, targeted at people that work in the security and defense industry. One of its security features is self-destructing if it gets into the wrong hands, although not quite in the Mission Impossible sense. According to the company's letter to the FCC, the phone will have screws with a tamper-proof coating, revealing if a person has tried to disassemble it. 'Any attempt to disassemble the device would trigger functions that would delete the data and software contained within the device and make the device inoperable,' writes Bruce Olcott, an attorney for Boeing."
"Good afternoon, Mr. Phelps . . . " (Score:2)
" . . . this phone message will destroy your phone in 15 seconds . . . "
Re: (Score:2)
Completely Foolproof (Score:2, Insightful)
Re:Completely Foolproof (Score:5, Funny)
"screws with a tamper-proof coating, revealing if a person has tried to disassemble it"
I'm pretty sure I would notice if someone took a dremel to my phone.
Re: (Score:3)
"screws with a tamper-proof coating, revealing if a person has tried to disassemble it"
I'm pretty sure I would notice if someone took a dremel to my phone.
No you wouldn't. You'd just know your phone was gone. And you'd believe that at least your data was safe, because the self-destruct would have been triggered when the thief removed the screws. Except it wasn't.
Re: (Score:2)
Re: (Score:2)
Judging by the target audience my guess is they are afraid of a lot more subtle tampering techniques than using a dremel. I would fully expect that a professional, of the types they are worried about, could disassemble your phone modify it it and reassemble it without your being the wiser. Which is why they want it to be impossible, or at least exceedingly difficult, to hide tampering and want it to self destruct.
Re: (Score:2)
"screws with a tamper-proof coating, revealing if a person has tried to disassemble it"
I'm pretty sure I would notice if someone took a dremel to my phone.
Yes, but would the data-wiping routines get activated? (Probably yes, unless you have a couple of phones to practice on and/or a good X-ray machine.)
Dremel can still trigger the self-destruct (Score:2)
The way I'd have the destruct work would be to encrypt everything and keep the key in a special tamper chip that will dump the key if a tamper trips.
Anyways, there are options to screw up your little proposal, such as a sensor inside that looks for disturbance. A light sensor where there should be no light, for example. Put a series of wires along the inside of the case, and if the resistance changes, such as from somebody cutting a wire trying to dremel their way in, trigger the tamper. Another option w
Re: (Score:2)
Re: (Score:2)
It would probably be difficult to build the "disturbance detecting" chip in a way that couldn't be circumvented but that also wouldn't trip accidentally.
To be more clear, my 'tamper chip' is merely a storage device. If voltage is lost at pin 1, dump, if voltage present on pin 2, dump. If voltage on pins 3&4 don't match within tolerances, dump. After that, it's all about sensors hooked up. Careful design can minimize 'false alarm' trips, depending on where your relative paranoia lays. I've worked with equipment that have tamper alarms that a strong *bump* can trigger, then the device is unusable until you use a special key on it(and said key only wo
Re: (Score:2)
Have you entered your PIN on a PIN pad within the last 10 years? If so, you've just used technology that's already solved this problem.
Re: (Score:2)
There are lots of different anti-tamper vectors you need to cover, but the truth is the tech exists to make it a really hard challenge for anyone, even a big agency. Of course, any backdooring in the software or hardware renders thes
Re: (Score:2)
>bloody hard to remove without drilling
Not really, unless you're trying to do it with traditional tools. A little pressure and a tool that conforms perfectly to the head will usually do the job, especially if enhanced with a little adhesive. And there's no shortage of low-temperature metals from which to make a perfectly conforming tool in seconds. If you're trying to prevent the phone from being tampered with by espionage professionals you've got to assume their tool kit is a lot more specialized tha
Re: (Score:2)
Re: (Score:2)
But it can damn sure run as soon as it notices rapidly dropping temps.
Dropping it in something really cold doesn't make it instantly cold, it'll take some time (even if that time isn't very long) and thats long enough to nuke itself if need be.
Its not like they're going to trigger self destruct based on a case screw or two being removed.
Unless its a joke, they would have multiple safe guards in place to destroy the device if need be. Rapidly failing temp that is well below human standards? Kill! Any one
Re: (Score:2)
Indeed, and as any Ferengi can tell you, an arms race is good for profit. So you have to buy a new phone every 3 months for maximum security, big deal - that's like what, 5 seconds worth of income?
Re: (Score:2)
Re: (Score:2)
Not hardly - it may instant-freeze the case, but there's an insulating air-gap between the case and electronics, enough to buy you the fraction of a second needed to securely wipe the encryption key. I wouldn't even bet on liquid helium bringing the temperature down fast enough.
Re: (Score:2)
Re: (Score:2)
True, but even a superfluid doesn't flow at infinite speed. Especially when violently boiling away from a scathingly-hot room temperature device. You won't get superfluid penetrating the case until the case has already cooled down below the boiling point. Sort of the reverse of the old boiling water in a paper bag trick.
Re: (Score:2)
I'm pretty sure people don't want to be walking around with a phone which has sodium metal or thermite in it.
Security is one thing, but having a phone with the potential to detonate in your pocket doesn't sound like my idea of fun.
Re: (Score:2)
Tamper-proof screws? (Score:5, Informative)
Oh, and you generally don't do a tamper 'proof' coating on screws, you do a 'tamper-evident' coating.
Want your own tamper evident coating? Buy a bottle of the cheapest, cheesiest glitter nail polish you can find. Coat the screws with a layer. Take a high resolution picture of each screw. Suspect tampering? compare the current coating with the picture.
As for deleting the data off the device, I'd probably simply encrypt everything on the device, with the key stored in a specific chip designed to dump said key if anything triggers it. No Key = No Data.
Re: (Score:2)
A tamper coating like that will get gradually damaged just through normal wear and tear...
Re: (Score:2)
A tamper coating like that will get gradually damaged just through normal wear and tear...
Requiring the owner to buy a new $10,000 phone every year, it's brilliant.
Re: (Score:2)
Re: (Score:2)
You do it with mirrors! ;-)
Re: (Score:3)
Re: (Score:2)
Side note: Nobody in the security industry that is trustworthy claims "tamper proof". Nothing is and hence the thing to claim is "tamper resistant".
Re: (Score:2)
Indeed. "Tamper resistant" = "you are pretty unlikely to get in". "Tamper Proof" = "is is impossible to get in". Only marketing-liars claim the second.
Re: (Score:2)
If you get your phone back from the lost and found at the local Chinese restaurant, you want to make sure they didn't copy the sim card so-to-speak.
This phone is designed for the sorts of people who build and defend against things like Stuxnet.
Re: (Score:2)
This technique is incredibly common - the iPhone has done it ever since the 3GS 5 years ago.
I would think the Boeing one goes one further and rather than storing the key encrypted with a per-ASIC key in flash, the key is in SRAM that's wiped when battery power is cut or other thing.
And it's often hardware bas
Cold disassembly? (Score:3, Interesting)
Re: (Score:2)
No use speculating without somebody competent doing an analysis of the thing. It certainly is one of the possible techniques, but whether it helps or is needed is unclear.
Re: (Score:2)
Given that the battery's removable, I can think of a quicker way to stop the electronics working.
Re: (Score:2)
Capcom suicide (Score:2)
I see two attack vectors. Run the battery down and then open it.
Capcom and other arcade game manufacturers solved this already. Battery goes too low to maintain the encryption key in SRAM? Dump the encryption key.
Re: (Score:2)
As we're going along here, we seem to be getting tighter security for the cost of a steadily increasing chance of one of these customers accidentally destroying all their data.
Restore from backup (Score:2)
As we're going along here, we seem to be getting tighter security for the cost of a steadily increasing chance of one of these customers accidentally destroying all their data.
I was under the impression that it had become straightforward to plan for destruction of an Internet-connected device by making automatic backups that are encrypted while at rest and while in motion. Encryption key dumped? Replace the device, associate the new encryption key, and restore.
Re: (Score:2)
Assuming that the backups have the same or better security and a sufficiently short backup period, sure.
Re: (Score:2)
Simply use an electromagnetic device of some sort that can read the variations in the EM emissions of the phone while its on, and copy the data stream. The NSA already does this with submarine cables.
Submarine cables are a bit different thing. It would be nearly impossible to grab any single usable data stream from all the EM that a phone generates.
This is going to be hot! (Score:5, Funny)
ATM keypads (Score:4, Interesting)
Re: (Score:2)
Don't depend on that when you have really expensive secrets, and that is what this phone is aimed at. With an ATM, I would expect the maximum loss if somebody attacks this successfully is around 10 Million USD/EUR. (I think the card-cloners that recently went around got 3.5 Million only.) Also remember that an ATM keypad affords a steel front-plate, excellent RF shielding, no access from behind and the ATM itself comes with a number of tamper detectors and usually has a direct line to the police or some sec
Re: (Score:2)
Yes, we're replacing the capabilities he compromised.
Well that's the problem right there (if true).
Re: (Score:2)
If I were an average ATM attacker, I'd be more interested in the cash it contains than any data. You can pick up credit account info anywhere, Target, for instance.
Re: (Score:2)
But the ATM doesn't contain much cash, and has serious safeguards in place against theft. The bank accounts of the people using it on the other hand...
Hell, one time I paid down my brother's credit card debt from my bank account - it was actually rather scary. They transferred thousands of dollars out of my account given nothing more than his word, the account number on the bottom of every one of my checks, and a validation call to a prepaid cell phone number he provided.
Re: (Score:2)
Maybe they're not all as loaded, but a friend worked at a bank (basically drive up, park and walk access, albeit on Miami Beach) and on a Friday night they'd stock their ATM with $50K, and half of it would be legally withdrawn by Saturday morning.
If your brother had defrauded you, you could go after him in court and make a bunch of lawyers rich while you attempt to recover a piece of your money.
Hatred of lawyers is probably what keeps most people honest, whether they know it or not.
Re: (Score:2)
I would not buy this phone as it is over-priced, and I can do the same thing with a common android smartphone and a little software and hardware tweaking.
You don't understand that spending tax dollars is way different then spending your own dollars.
Re: (Score:2)
Hell, to the corporate folks this would appeal to it wouldn't make much difference one way or the other, what's a few minutes of income compared to keeping your secrets safe from espionage.
Do not depend on this against a competent attacker (Score:2)
They are basically claiming they have a HSM here. Now, HSMs are as expensive as they are for a reason (50'000 USD/EUR is quite standard). One is that attackers have to pay a lot to get their hands on one for analysis. Another is to have several layers of protection, several independent power sources, solid steel tamper barriers, etc. Still, they are designed to be secure when in a 19" rack in a secured data-center and when it becomes obvious fast that one has been removed.
I expect that a good hardware hacke
Re: (Score:2)
Layers upon layers - there's the "common" model that goes out to all field personnel and is assumed to be compromised within a few months.
Then, there's high security model that is designed to look like the common model, but goes only to high value targets and might be redesigned and redeployed every time one gets lost.
Then, there's the higher security model that is designed to look like the high security model, but....
Is it any wonder that a toilet seat can cost $9,000?
someone has to ask (Score:3, Funny)
will it blend?
Self destructing phone, which battery joke to use? (Score:2)
Not sure where to go with this one. Is the joke supposed to be "So, Boeing has teamed up with Sony to use their batteries in a new smart phone..." or "Leveraging the battery technology used in the 787 Dreamliner..."
What's the difference to an iPhone? (Score:2)
Re: (Score:2)
I tried the iOS encrypt home drive option once, bricked my new MacBookPro inside a week, had to reinstall iOS from scratch with special help from a tech named Jesus.
Re: (Score:2)
You do realize your Macbook is not an iPhone and does not run anything approaching the same operating system?
Re: (Score:2)
You do realize your Macbook is not an iPhone and does not run anything approaching the same operating system?
The operating system is actually more than 85% identical :-) Still, I don't know how turning on a non-existing encryption option on iOS (it's not an option, you can't turn it off) would mess up his MacBook, and how messing up his MacBook would require him to re-install the OS on his iPhone.
Re: (Score:2)
The thing I absolutely _LOVE_ about the Apple ecosystem is the absolute certainty of the people who just got one that they know _everything_ there ever was to know about them, back to the original Apple I to hear some talk about it.
Case in point, I own an iPad 1, actually won it in a contest, but, whatever, we've had it since about 3 months after the iPad first came out. A few months ago, the USB-30pin cable that came with it died - bad strain relief, pretty typical of Apple products of the era, including
Re: (Score:2)
Put an iPhone in a faraday cage and the data won't be deleted. No way for the signal from Steven in the sky to tell it to delete the data. Disassemble the device, hot air the flash chips off the phone to you own custom boards ... boom, full access to all the data. (Actually, not entirely true for smarter users with encrypted data, but close enough for this discussion, since all 3 of those iPhone users who encrypt their data don't have anything that matters anyway.)
That's the point - you don't have full access to the data. You have no access to the data. You have access to an encrypted file system, where every single file is encrypted with a different random 256 bit key.
Relatedly?... (Score:2)
So, where's the added summary about the "related story" of how Google admits that Android's focus isn't on security and that malware writers should target their OS rather than Apple's or Microsoft's?
Or was that story only related when Slashdot was attempting to water down the discussion of Google's comments with a topic that actually had nothing what-so-ever to do with Google's comments?
Don't worry. I already know the answer to those questions.
It was nice when this site did a better job of disguising it's b
Not For Spies (Score:3)
Re: (Score:2)
There's the low cost version that just looks like the secure one and is mandated for use by all contracted workers.
I had a Blackberry like that once.
Covering bad crypto (Score:2)
This might be the most solid argument against these spy agencies, whatever "attacks"
FIPS-140 (Score:3)
At FIPS-140 Level 4, the crypto keys are stored on a unit that actively monitors for attack by environmental, electromagnetic, and physical methods.The physical is usually handled by a mesh of gridwires over the die.
The problem, of course, is Boeing is in bed with the government for Billions (Trillions) of dollars worth of military hardware, so don't think they'd sell you an Android phone before having a friendly chat with their friends at [A-Z]{3}.
Using battery technology from the Boeing 787? (Score:2)
In that case it should be easy and in this case it will be a feature.
http://www.usatoday.com/story/... [usatoday.com]
Ok, enough with the battery jokes (Score:2)
Let me state that this is probably a very good idea, even through this is the first that I've heard about the device. Often the biggest problem when dealing with smartphones is protecting sensitive data, be it emails or documents being stored on the device. Commercial solutions are often lacking in security, which is why Blackberry still exists as a company. Their offerings are much
Re: (Score:2)
Pure FUD. Go to the Apple website, do a bit of searching around, until you find the document describing the iPhone security features. At this point in time, there is no police force that can read email from a confiscated iPhone unless the user unlocks it.
Re: (Score:2)
[Disclaimer: I do not work for Apple] Pure FUD. Go to the Apple website, do a bit of searching around, until you find the document describing the iPhone security features. At this point in time, there is no police force that can read email from a confiscated iPhone unless the user unlocks it.
Care to try again? From Forbes:
But even when those login safeguards are set up in other cases, law enforcement have still often been able to use tools to bypass or brute-force a phone’s security measures. Google in some cases helps law enforcement to get past Android phones’ lockscreens, and if law enforcement can’t crack a seized iPhone, officers will in some cases mail the phone to Apple, who extract the data and return it stored on a DVD along with the locked phone.
Re: (Score:2)
You can be sure that the first customers will be the very people/agencies that will be trying to circumvent the security. Whoever breaks the security first gains a huge advantage.
Good luck, since the target purchasers are going to be government agencies and companies with stringent security requirements. This isn't something you're going to find on eBay.
Why is everybody in the smartphone business? (Score:2)
Extrapolating I find that within the next 10 years there will be no company left that is not at its core in the smartphone business.
Re: (Score:3)
Probably. But if you try installing a custom firmware, it will literally explode.
I can see a lot of carriers warming to this idea.
Re:But the really important question is... (Score:5, Funny)
Will it run Slashdot Beta?
The self-destruction mechanism uses Slashdot Beta code to perform the operation.
Re: (Score:2)
Until someone figures out a way around it.
Re: (Score:3)
The simplest way to self-destruct data on the device is to simply encrypt it using a large key stored in CMOS embedded in the SoC's hardware crypto-engine and clear it (either with an actual reset signal or simply killing power) if tampering is detected to instantaneously render all stored data useless. The next time the boot-loader runs if the device is ever powered up again before being restored to factory specs, it can generate a new encryption key and start erasing storage to make the data completely un
Re: (Score:2)
Just burn out the memory chips with a high voltage pulse.
Re:tamper-proof coating? (Score:4, Interesting)
That would not necessarily work: it would definitely fry the IO front-end but most of the NVRAM matrix would likely remain intact and recoverable by stripping the top encapsulation and top metal layers then scanning the NVRAM cells with a magnetic force microscope.
Also, if the devices self-destructs through high voltage, someone who has already dissected one of these phones before would know where the high-voltage components are, how they operate, how they are triggered and would likely be able to come up with a way to prevent the high voltage pulse from reaching the NVRAM chips such as using a pneumatic framing nailer to destroy/short the high voltage circuitry faster than it can be triggered by tamper sensors.
So, even with physical destruction built-in, you would still need strong device-level encryption as a fail-safe.
The most beautiful thing about having a decryption key embedded in a secure microcontroller managing tamper-proofing sensors (which is itself embedded in the SoC running the rest of the device's functions) is that disabling tamper-proofing is impossible to do without disabling the secure micro-controller and disabling it either physically or by cutting power kills the decryption key just like tripping tamper-proofing sensors would.
Re: (Score:2)
Re: (Score:2)
No, it is meant to stop sophisticated attackers. It will be interesting to see what happens the first time the police decide they need to access one of these and request that Boeing help them. If designed correctly there should be nothing Boeing could do to help them, but considering all the fat defence contracts and government money that goes their way I doubt they would have neglected to put an NSA approved back-door in.
Re: (Score:2)
you disassemble them in a Argon or other non oxygen environment ot get around their "self destruct".
Guarantee they have a way to get all the data off of them for Law enforcement. It's not secure, it's marketing.
Re: (Score:2)
Explosives, generally speaking, are their own oxidants. If (and it's a big if) this device is meant to blow itself up and not slowly burn away to nothing, an inert atmosphere isn't going to help.
I really doubt it is actually meant to blow itself up though.
Re: (Score:3)
I really doubt it is actually meant to blow itself up though.
If they used the right kind of battery it could ;-)
Re: (Score:2)
All you'd need to do is build it on a flammable PCB with a nichrome-wire-style electrical ignition element embedded within it, and discharge the (I would assume normally inaccessible without tripping the destruct) battery through it. The destruct could even have it's own built-in and seperate battery
*Poof*, original "Mission Impossible"-style.
"Good morning, Mr. Phelps..."
Sometimes the old tech is the best tech. ;-)
Strat
Re: (Score:2)
All you'd need to do is build it on a flammable PCB with a nichrome-wire-style electrical ignition element embedded within it, and discharge the (I would assume normally inaccessible without tripping the destruct) battery through it. The destruct could even have it's own built-in and seperate battery
Oh, that's *all* you'd need to do, eh?
And here I thought the solution would be complicated.
Re: (Score:2)
Well, that'd slow thing down a little, but a battery-based self destruct could be circumvented by simply waiting a few days/weeks while the phone struggles to find a decent signal. Less time than the Apple law enforcement request backlog IIRC.
Re: (Score:2)
Just use a high voltage burst to be released through the electronics. (High voltage in this case can be less than 50V, since most chips in phones runs at just a volt or so)
Re: (Score:2)
I know of a company with a chip design that includes a mesh and a vacuum compartment. The mesh can detect electrical, thermal, or physical intrusions. The vacuum compartment, if breached, is another way of telling someone is trying to access the physical memory substrate. There's also some other detection mechanisms as well. All of them zeroize the memory well enough to prevent anyone getting anything useful off of it.
This sort of tech
Re: (Score:2)
No, it is meant to stop sophisticated attackers. It will be interesting to see what happens the first time the police decide they need to access one of these and request that Boeing help them. If designed correctly there should be nothing Boeing could do to help them, but considering all the fat defence contracts and government money that goes their way I doubt they would have neglected to put an NSA approved back-door in.
In the case of the iPhone, there is no back door, but there is a front door. The only way to get into an iPhone is to either crack a 256 bit key (per file), or to enter the passcode. Only software code-signed by Apple can unlock an iPhone. In normal use, that's the software that runs when the user types in his passcode. Apple and Apple only can replace this software. And then they can try to unlock the phone at the amazing rate of ten attempts per second (the passcode hash function is calibrated to use one
Re: (Score:2)
The latest exploit *we know of* made apple's update vulnerable to a man-in-the-middle attack. If that's the case, then any OS module could be overwritten to introduce a backdoor, apps could be introduced which had backdoors, etc.
Beyond that, the 256 bit key is only as good as the RNG that cranked it out. That might or might not be a bulletproof one depending on where they got their key generation algorithm and implementation and what sources
Re: (Score:2)
No, it is meant to stop sophisticated attackers.
Given what TFA had to say about who could actually get their hands on one of these phones, I think you're right. I've been involved in anti-tamper design and implementation for DoD projects, and the level of paranoia and secrecy associated with the whole subject is extremely high. I'm going to guess that anything that has been publicly "revealed" by Boeing regarding the anti-tamper implementation is probably untrue, or at least misleading. Anti-tamper is like Fight Club; you're not supposed to talk about
Re: (Score:2)
Governments aren't the only ones who want security. I bet you the anti-corporate espionage market is far, far larger, especially for something like this that only costs pocket change. Lot's of people would like to keep their phones safe from discrete data harvesting while they're enjoying the jacuzzi.
You think Apple's got folks on an upgrade treadmill? Imagine the pressure to upgrade "the most secure phone in the world" every time a new bypass technique is developed. Forget OS upgrades, you need a whole
Re: (Score:2)
And if it actually does what Boeing claims, you aren't going to find any articles telling you how it works; that, in and of itself is part of its security.
In the real world, people take advantage of security through obscurity. That doesn't mean they rely on it, but theres nothing wrong with throwing something in front of the attacker to slow them down even if its only temporary as long as thats not your only attempt at security.
Nothing is secure given enough time.
Re: (Score:2)
It's a brilliant marketing scheme. Justin Bieber and Kim Jong Un will each buy one for security reasons and the other 70,000 Boeing ends up selling will all go to security researchers in China, Russia and Europe.
Re: (Score:2)
Or $629 if you bothered to read...
Re: (Score:2)
Or $629 if you bothered to read...
The $629 version is not the Boeing Black at all, but the "similarly named Blackphone." "That high-security phone was revealed earlier this week at the Mobile World Congress in Barcelona, Spain. It was developed by a team of cryptographers and is currently available for preorder at $629."
Re: (Score:2)
It's less depressing if you think about history in cycles. Old ossified institutions get replaced by young upstarts, who promptly begin ossifying themselves but make some progress before completely stagnating and being replaced in turn. A similar phenomena happens with government and the battle between democracy and aristocracy - the entire history of civilization can be characterized as a long slow slide toward aristocracy, punctuated by occasional leaps towards democracy. Despite the slope being almost
Re: (Score:2)
So, keeping the slope of the decline as close to flat as we can by fighting attempts to hobble democracy still matters.
I do find it interesting that if you read the classics, you'll see Greeks and Romans arguing many of the issues of governance we
Re: (Score:2)
Re: (Score:3)
Yeah, because obviously they'd design a secure, self-destructing phone to be trivially abusable over USB. I bet it even has autorun enabled by default.