What if I were a cloud?

What if I were a cloud? I guess many security engeneers have been asking themselves this question in recent days. In this post I want to share my vision of the most critical steps in cloud storage for mobile devices.

I do not claim an absolute correctness and there are no strict requirements, I wish this article could be a starting point for some technical discussions, while the topic is hot.

Baseline:

1. Сryptography is unbreakable,
2. Devices are equipped with TPM (trusted platform module),
3. Attacker has no inconspicuous physical access to victim's device.

I know, that not all devices are equipped with a TPM chip (by the way, iPhone is equipped), but I heard, that SIM card can be used, as a TPM in some cases. If you know how it technically works, please let me know. 

Enrollment

A new device enrollment is a critical step because Cloud should be sure that this device is authenticated and not a source of malicious activity. A device enrollment should be performed with two factor authentication. The second factor could be an OTP (one time password) sent as an SMS to the phone number associated with the account, or an OTP preset on any other device, which was already enrolled. For each new device the account owner should be notified by email.

How it works step by step:

1. User generates an OTP on a device enrolled previously;
2. Generated OTP goes to cloud;
3. User enters the OTP on a new device;
4. Device generates a TPM signe Certificate request (TPMCRT);
5. If OTPs from steps 2 and 4 are equal, the enrollment is successful.

In the case of a new device:

1. New device performs an enrollment request with a login and a password;
2. Cloud sends SMS with an OTP to an associated phone number;
3. New device sends TPMCRT + OTP;
4. If OTPs from steps 2 and 3 are equal, the enrollment is successful.

What is TPMCRT :

1. Client device generates a private key and a certificate request for each enrollment;
2. TPM signs Certificate request (TPMCRT), so we get an unique device certificate.

Benefits:

• In a case of credentials leak, an attacker can't enroll a new device, and get user's data;
• If an attacker has an access to an enrolled device and can generate an OTP for a malicious device, the victim will get a notification.

Secure communication

First of all - certificate pinning, it should protect us from SSL MiTM. This kind of attacks could be a result not just of compromised Certificate Authority, using MDM mechanism, corrupt system administrators could distribute malicious Certificate Authority to devices, and then perform SSL MiTM.

Then Cloud should authenticate a device, in other words, Cloud should check that the device was enrolled:

1. Device authenticates Cloud (with pinning);
2. Device sends its certificate which was generated during enrollment.(?Https client-side authentication?);
3. Cloud checks whether the certificate was enrolled;
4. Cloud uses the TPM public key from the certificate and encrypts a CHALLENGE;
5. Device receives the encrypted CHALLENGE and uses the TPM to decrypt it;
6. Device generates a RESPONSE and encrypts it with the TPM;
7. Device sends the encrypted RESPONSE to Cloud;
8. Cloud decrypts it with the TPM public key, if it's ok, the authentication succeeded.

Benefits:

• TPM doesn't allow an attacker to gain access to Cloud, even if he or she was able to steal the private enrollment key (with a malware or forensic boot).
• We have the flexibility. For example, if we want to donate or sell the device, we can simply remove the enrollment key by device factory reset, or via Cloud web interface, if the device was stolen.

If you notice any mistakes or if you whould like to add anything, I will be happy to find your comment in Hackapp Facebook group or in any other place (plese leave link in comments).

Official comment on iCloud leak

I'm really sorry that talk given by @hackappcom  and @abelenko on local @DefconRussia a group meeting (@chaos_construct event)  few days ago have had such nasty consequences. And blackhat community performed such weak, cheap and  ungrateful feedback.

In  justification I can only mention,  that we only described the way  HOW to hack AppleID. Stealing private "hot" data is outside of our scope of interests. We discuss such methods of hacks in our's narrow range, just to identify all the ways how privacy can by abused.

For everyone, who was involved in this incident, I want to remind, that today we are living in a Brave New Global World, when privacy protection wasn't ever so weak, and you have to consider, that all you data from "smart" devices could be accessable from Internet, the Place of Anarchy, and, as a result, could be a source of undesirable and unfriendly activity.

So, a weak "dictonary" passowrd (like P@$$w0rd) is not the best way to protect yourself in the modern world. But it's not your fault. It's a common problem of modern-being, that people use a technology without understanding all risks and consequences. Not all users are nerds (look  -  Jim Parsons account was not hacked!).

And now, after all that you've experienced, we can only suggest to start information security self-education. You may  follow us on twitter:

• @hackappcom
• @abelenko
• @defconrussia (ru)

and read popular news feeds

• Ycombinator hacker news
• Reddit NetSec

and  if you want to go deeper, you better join local Defcone group.


P.S.

Stay wild :)