Penetration Test Report (NCCGroup): NCC Group Google EncryptedBackup 2018 10 10 v1.0

Android Cloud Backup/Restore
Google
October 10, 2018 – Version 1.0
Preparedfor
TroyKensinger
ShabsiWalfish
Preparedby
MasonHemmel
JasonMeltzer
ThomasPornin
KeeganRyan
JavedSamuel
DavidWong
RobWood
GregWorona
Public Summary
Overview
Inthesummerof2018,GoogleengagedNCCGrouptoconductasecurityassessmentoftheAndroidCloudBackup/
Restorefeature,whichpremieredinAndroidPie. Thisengagementfocusedonathreatmodelthatincludedattacks
byrogueGoogleemployees(orothermaliciousinsiders)withprivilegesuptoandincludingroot-in-production. The
Androidbackup/restorefeatureisonlyonepotentialuse-caseforthekeyprotectionmechanismswhicharepartof
Google’sCloudKeyVaultproject,sotheoverallgoalofourworkwastoanalyzethesecurityofthecomponentsystems
and services of Google Cloud Key Vault as a whole. While NCC Group analyzed Google Cloud Key Vault’s security
postureholistically,theteammostcloselyexaminedthreatswhichcouldresultingainingaccesstocryptographickey
materialusedtoprotecttheuser’sbackupdata.
NCC Group conducted this assessment between July 9 and August 3, 2018, primarily on-site at Google’s Mountain
View,CAcampus.
Scope
• Assessmentofthedesignandimplementationofcryptographicmechanismsandprotocolsin:
– GoogleCloudKeyVaultAndroidClient
– GoogleCloudKeyVaultService
– GoogleCloudKeyVault/TitanHardwareandFirmware
– GoogleCloudKeyVaultserviceandsystemsdeployment
• AssessmentofoveralldesignandimplementationofGoogleCloudKeyVault/TitanHardwareandFirmware
• Auditofsystemprovisioningandsitedeployment
PositiveDesignElements
Throughouttheassessment,NCCGroupwasimpressedbyboththewell-roundeddesignandthehigh-qualitycode
which took security into consideration. Numerous possible avenues of achieving a compromise were investigated
andmostoftheseendedwithadeterminationthatthedesignandimplementationwerealreadytakingtheparticular
attackintoaccountandhadsufficientmitigations. Somenotablehighlightsinclude:
• Side-channelresistanceinthecryptographicacceleratorswasobserved. Thisisarelativelyuncommonpractice
outsidethesmartcardspace,andshowsanattentiontodetailinthefaceofaphysicaladversary. Bothpowerand
timingsidechannelsappeartohavebeenconsidered(forinstance,theimplementationofellipticcurveoperations
avoidsalldata-dependentconditionaljumps,andappliesrandommaskingrepeatedlytothwartpoweranalysis).
• Cryptographicreviewofsomepartsofthecryptographicimplementationswasperformed,notablyformalvalidation
ofsomeoperationsonfinitefields,asusedintheimplementationofellipticcurveoperations. Itwasobservedthat
thesecryptographicimplementationsweredoneinasecuremanner.
• AfuzzerwasimplementedbyGooglestafffortheGoogleCloudKeyVaultcommandinterface. Thisistheprimary
externalattacksurfaceofthefirmware,andeventhoughthecodewasrigorouslyreviewed,itispossibleforfuzzing
tocatchinterestingerrorswhichcouldhaveasecurityimpact.
• Tamper-resistancefeatureswereincludedintheTitanhardwaredesign. Thisincludesprotectionsagainstmicro-
probing,side-channelattacks,andfaultinjectionthroughavarietyoftechniques. Whileevaluatingthesedefenses
wasbeyondthescopeofthisassessment,thepresenceofthesefeaturesinthehardwareisagreatfirststep.
• ExplicitcontrolflowguardswerefoundthroughouttheBootROMcode. Thisisastrongmitigationagainstmany
faultinjectionattacks.
• Strongauditingmechanismswerebuiltintoallaspectsofthesystem. Boththesecurefirmwareupdatelogfeature
and the always-active prober tool used for system health monitoring are examples of this design mindset. The
ability to monitor the system allows any compromise of the system to be detected immediately and therefore
suitableresponseprocedurescanbeenacted. ThisfunctionalitywasrelieduponduringtheGoogleCloudKeyVault
deploymentauditasdiscussedbelow.
2 | GoogleAndroidCloudBackup/Restore Google/NCCGroupConfidential
Limitations
• Supplychainattacksarenotconsidered. Forinstance,NCCGroupdidnotconsiderthethreatarisingfromaTitan
deviceloadedwithcompromisedsoftwarepriortobeingprovisionedintheHSMprovisioningroom. Wenotethat
suchanattackcouldtheoreticallycompromisethefirstGoogleCloudKeyVaultfirmwareload,whichiscrucialtothe
securityguaranteesofthedeviceoperationandallsubsequentfirmwareloads. Nevertheless,thisisaknownand
acceptedweaknessoftheGoogleCloudKeyVaultV1deployment.
• Hardware attacks directly against the Titan chip were also out of scope for this assessment. While NCC Group
examinedthegeneralsecuritypropertiesofthechipduringauditsoftheBootROM,BootLoader,andGoogleCloud
KeyVaultfirmware, theteam did notassess the fulldetails ofthe chip fuseconfigurationsor theeffectiveness of
the anti-tamper countermeasures. Although teams both internal and external to Google have performed tests
evaluatingtheriskposedbynon-invasiveside-channelandfaultinjectionattacks,thoseresultswerenotevaluated
inthisassessment.
• TheGoogleCloudKeyVaultdevicedeploymentwasauditedonlypartially. Specifically,NCCGroupvisitedasingle
datacenterandvalidatedtwoofthecardsamongthecohortsthere. Whilethereisnoreasontosuspectthatthe
othercohortsweredeployedanydifferently,theGroupmakesnoteofthisduetothefactthatafirmwarelimitation
at the time of the assessment meant that we could only attest to the correct provisioning of a given cohort after
verifyingeachcardinthecohort. Newerversionsofthefirmwareallowforvalidationofentirecohortprovisioning
fromasinglememberaslongasonetrustseachdevice’sattestationkeys.
• AllassessmentwasdoneincooperationwithGoogle. NCCGroupassumesgoodwillonthepartofGooglestaff,
inparticularthattheywerenottryingtoactivelysubvertourinvestigations,especiallyregardingtheon-sitevisitto
thedatacenter. ThroughouttheengagementGooglestaffwasco-operativeandforthcomingwithallinformation
thatwasrequested.
KeyFindings
TwocriticalissueswerefoundintheGoogleCloudKeyVaultfirmware. Oneallowedarbitrarymemoryreadsfromthe
chip’sinternalmemorywhichcouldhavecompromisedthesecretkeymaterialandthusallowedforuserdatarecovery.
Thesecondonepermittedanattackertobypassthebrute-forcemitigationsandattemptunlimitedLSKFguesses.Both
ofthefirmwareissueswerequicklyfixedbyGoogleengineersduringtheassessmentandthefixeswerereviewedto
NCCGroup’ssatisfaction.
Beyondtheseissues,severallowseverityissueswerereportedthatdonotposeanimmediatethreattothesystem
ortotheusers(allfindingshavebeenreviewedandarebeingprioritizedaccordingly). Aswell,severalinformational
suggestionsweremadeforfuturereleasesthatwouldimprovethedefense-in-depth,correctnessandsecurityposture
ofthesystem.
GoogleCloudKeyVaultDeploymentAudit
OnAugust1,2018,NCCGroupvisitedaGoogledatacenterinordertoinspectanexampledeploymentoftheGoogle
CloudKeyVaultGneisshardware. DuringthevisitNCCGroupselectedtwoGoogleCloudKeyVaultserverswithGneiss
cards from two separate machine clusters. The first Gneiss card was expected to be running the second-to-latest
firmware(version9983)andintheprocessofdrainingclientsparticipatingintheAndroidPbeta(ilby1), whilethe
second was expected to be running the latest Google Cloud Key Vault firmware (version 9980) and not yet actively
servingclients(ilez1).
Ourtestsconfirmedthatthefirmwareloadedonthecardsmatchedtheversionsthatwereexpectedtoberunning,
whichwerebinariesNCCGroupwasabletoreproducefromthesourcecodeinspectedduringtheaudit. GoogleCloud
KeyVaultfirmwareisbuiltwithintheChromiumOSbuildenvironmenttoenablereproduciblebuilds.
PhysicalSecurity
TheGoogledatacenterisdedicatedfacilitythathousesGoogleinfrastructureexclusively. Thephysicalsecuritymecha-
nismsinplaceatthedatacenterweremulti-layered,extensivelymonitored,andotherwiseconsistentwithwhatGoogle
3 | GoogleAndroidCloudBackup/Restore Google/NCCGroupConfidential
publiclydescribesintheirCloudservicedocumentation.1 Afterreviewingallthetrainingmaterialsandpolicyrequired
forworkinginthedata-center,NCCGroupdidnotobserveanyinstanceswhileon-sitewherecontrolswereintentionally
bypassedorwherethebehaviorofoperationspersonneldidn’trigorouslycomplywithdocumentedprocesses.
SecureDestruction
Googlehason-sitefacilitiesandaccompanyingprocessestosecurelydestroymediaattheirdatacentersandwewere
abletoconfirmthatthesefacilitiesexistedaswedescribeinthe“SecureScrapProcess”sub-