The more common scam is simply calling someone up and asking them to transfer money to their “son” or “mother” who urgently needs it for some reason.
Remote attestation doesn’t solve the common case.
Having walked non-technical family through how to restore computers, the attacks via walking the user through replacing their OS with a backdoored one seem very implausible: they simply won’t understand the instructions, and each attack will take hours of 1 on 1 technical hand-holding. This would include steps where they’re rebooting the device and calling you back. The cost of the attack is simply too high compared to convincing them to use the well attested credentials on your behalf.
Attestation is weak defense against high cost attacks, but it does a good job of locking users into big tech.
There’s one place where attestation helps: if you’re a high value target, and don’t trust the security of your own installed os (eg, you’re in a journalist in jurisdiction that mandates encryption backdoors), you could ensure you are running an OS that hasn’t gotten backdoored when, eg, you hand the phone over for inspection by the police. But in this scenario where you’re a very high value target for a state actor, vendors are part of the threat model, so the remote attestation provided by current systems isn’t enough; you need to be able to enroll your own keys to ensure that the OS you’re running is the one you chose to install. None of the current remote attestation solutions allow users to ensure that they’re running the right custom, third-party build, and that the vendor can’t force an update.
Having walked non-technical family through how to restore computers, the attacks via walking the user through replacing their OS with a backdoored one seem very implausible: they simply won’t understand the instructions, and each attack will take hours of 1 on 1 technical hand-holding. This would include steps where they’re rebooting the device and calling you back. The cost of the attack is simply too high compared to convincing them to use the well attested credentials on your behalf.
There are teams in call centres in less developed countries that follow scripts honed through thousands of interactions. Simply put: the bad guys are experts in 1:1 technical hand-holding.
As an aside, at my old job, we ran the numbers on how much fraud attestation turned up. We did the same for rooted devices. Turns out the checks weren’t worth it. You know what was worth it? Flagging if a customer’s touchStart -> touchEnd events were superhumanly quick.
The more common scam is simply calling someone up and asking them to transfer money to their “son” or “mother” who urgently needs it for some reason.
Remote attestation doesn’t solve the common case.
Having walked non-technical family through how to restore computers, the attacks via walking the user through replacing their OS with a backdoored one seem very implausible: they simply won’t understand the instructions, and each attack will take hours of 1 on 1 technical hand-holding. This would include steps where they’re rebooting the device and calling you back. The cost of the attack is simply too high compared to convincing them to use the well attested credentials on your behalf.
Attestation is weak defense against high cost attacks, but it does a good job of locking users into big tech.
There’s one place where attestation helps: if you’re a high value target, and don’t trust the security of your own installed os (eg, you’re in a journalist in jurisdiction that mandates encryption backdoors), you could ensure you are running an OS that hasn’t gotten backdoored when, eg, you hand the phone over for inspection by the police. But in this scenario where you’re a very high value target for a state actor, vendors are part of the threat model, so the remote attestation provided by current systems isn’t enough; you need to be able to enroll your own keys to ensure that the OS you’re running is the one you chose to install. None of the current remote attestation solutions allow users to ensure that they’re running the right custom, third-party build, and that the vendor can’t force an update.
score 2 · canonical
There are teams in call centres in less developed countries that follow scripts honed through thousands of interactions. Simply put: the bad guys are experts in 1:1 technical hand-holding.
As an aside, at my old job, we ran the numbers on how much fraud attestation turned up. We did the same for rooted devices. Turns out the checks weren’t worth it. You know what was worth it? Flagging if a customer’s touchStart -> touchEnd events were superhumanly quick.
score 1 · canonical