Android’s full disk encryption is Busted
Android certainly plans to go for full disk encryption (FDE) by default from version 5.0 onwards and yet someone recently cracked open the encryption keys from an Android device’s Qualcomm chipset. Though initially software based, the Android FDE has now gone hardware enabled which means no more slowing down of other processes as also the encryption is based on the reliable, Linux kernel subsystem called “dm-crypt.
So this means the encryption used is not some home brew but a well constructed method and whatever bugs it may have had were fixed long back. And yet though the encryption method may be the strongest, the weakness lies not in the method but how the encryption keys are managed.
The internal keys are generally accessible using user defined keys which due to the clunky nature of mobile keyboards specially Android ones, result in weaker user defined passwords that can be brute cracked.
And guess what there lies the problem with Android’s FDE implementation where it has something called the “TrustZone” with a secure secondary processor. And these keys are recoverable using an API called “trustlets” which are loaded into the secondary processor’s execution region.
The problem is that it is possible to extract and reverse engineer the code loaded in this TrustZone and thus offer the opportunity to malware developer exploit this vulnerability and break into the TrustZone.
Which pretty renders Android’s FDE meaningless. The good news is that Google responded that the vulnerabilities are already fixed, over 37% of enterprise android remained vulnerable.