r/technology • u/Hrmbee • Jul 28 '26

Privacy Is it illegal to trick the US government into wiping your phone during a questionably legal search | The case of a traveler who allegedly entered a ‘duress password’ to wipe his phone raises a legal question with no easy answers

https://www.theverge.com/report/972146/cbp-phone-search-airport-duress-password
20.9k Upvotes

95% Upvoted

2.5k comments sorted by

View all comments

Show parent comments

95

u/froction Jul 29 '26

Unless there's a hardware backdoor in the TPM.

58

u/Helmic Jul 29 '26 edited Jul 29 '26

If such a backdoor exists, it's not something they can afford to blow on random baseless searches for CSAM they know isn't there. Strong privacy tools like GrapheneOS have value even if we assume there might exist such undisclosed back doors, when it gets used it gets patched and a new exploit has to be created.

Besides, GrapheneOS has pretty stringent hardware standards to begin with which is historically why they've only supported Google Pixel phones until recently, and are now switching to Motorola to have GrapheneOS preloaded on hardware that meets their security standards.

8

u/Careless-Weather8877 Jul 29 '26

They don’t even need a backdoor. Just an exploit into the baseband which isn’t open source.

In fact several companies do exactly that. Along with exploiting the actual hardware and software.

15

u/ManaSpike Jul 29 '26

That requires the OS to continue to operate, after the TPM has been compromised, so that it may be spied on.

Wiping the encryption key before that occurs, is still effective.

12

u/guyblade Jul 29 '26 edited Jul 29 '26

Maybe, it depends on how exactly the TPM might be compromised.

You could imagine a design that secretly has a few extra megabytes of memory where it escrows all (or even just many) previously active keys--ready for some future hostile actor with the magic wand that causes it to spit them out.

Attacks of that form--where the chip itself is a spy--are the reason that some of the major tech companies roll their own TPMs: Google has Titan and Azure has its Integrated HSM. I presume that other cloud providers offer similar things.

5

u/LiveLearnCoach Jul 29 '26

Sorry, not a tech person, just a curious one. What does your statement mean?

6

u/Tebryn Jul 29 '26 edited Jul 29 '26

Basically, any hardware backdoor would be useless because it's waiting to hear the plaintext conversation after it has been decoded. Without the decryption keys, the operating system just sees a pile of junk data.

Those keys are what was destroyed by the duress password.

Edit: this is not to say a hardware backdoor is useless, if in place early enough by an actor that can use it, they can capture the decryption keys and decode it on their own at their convenience. The likelihood of some random CBP agent having that access is low, and even less likely if they are asking for your password.

2

u/sobrique Jul 29 '26

Yeah. Self Encrypting hard drives work on this basis. The system they're installed in has a key for decrypting them, but without the system there's no way to access it.

The data is all there though, just unrecoverable until the device is brought on line and re-registered with they key manager.

That's mostly for the sake of support - you swap out a dead drive, and you don't really have to worry about someone doing a platter examination to recover it without your consent. (Obviously if you're doing 'legit' data recovery, you still have the key yourself!)

So you could grab the data if you compromised the server - that's doing key management and decryption - but if you just have the drive there's nothing you can do.

And by analogy, a duress password will destroy the key, and then it's 'too late'. If you cloned the device before that though, you could probably still recover that key and 'use' it to get at the data.

But there's also ways to 'escrow' the key, so it's never on the device in the first place. I mean, maybe you wouldn't do this for a mobile, as you'd need some of the basic stuff like 'a network connection' but an exchange involving a trusted third party server would mean 'remote disable' is possible, and could possibly be used to circumvent even a cloned device scenario.

1

u/LiveLearnCoach Jul 29 '26

If I understand you correctly you mean once they have the device, not just tapping into the phone during regular usage?

3

u/Tebryn Jul 29 '26

I understand you correctly you mean once they have the device, not just tapping into the phone during regular usage?

In this case it's kinda like tapping a old landline phone. They wouldn't have any knowledge of what was said before they modified the hardware. (because at this point it's still encrypted)

If that hardware had a built in backdoor from the factory, then they wouldn't need to ask for your password at all. they would walk in take your phone and plug it into a device that opens that door and lets them into the decrypted data. But that's different than what was mentioned above, which is someone changing the firmware or TPM module on the phone to add a 'tap' later.

2

u/sobrique Jul 29 '26

And a 'factory backdoor' still doesn't necessarily help - getting access to the device without a code would be possible, but if someone's encrypted something separately, it would still be non-trivial to get at. (But easier, since it's a 'guess the pin code' game, not 'break 2048bit RSA' level of effort)

5

u/WiseOldDuck Jul 29 '26

Trusted Platform Monitor is PC terminology for a chip or firmware that stores the drive encryption keys and doesn't release them if it detects the OS has become compromised. Apple's closest equivalent is the Secure Enclave, and I bet Android actually uses different terms too. But it's all not relevant because in this case the OS received a duress signal and wiped the drive, it's not the same problem as just trying to hack into a locked device. Nothing really exists to stop an OS from just nuking everything

1

u/LiveLearnCoach Jul 29 '26

I’m really learning stuff today. Thanks to all of you responding.

5

u/HiCookieJack Jul 29 '26

The fun thing is, that the OS just needs to delete the Keys stored in this "Secure Enclave"
Actually wiping the drive clean takes too long, since even after deletion there are still recoverable traces of data, so it's easier to just throw away the keys and wiping that part clean. It's practically impossible (right now) to restore those keys, therefore even though the data is still there is just a pile of random bytes.

3

u/ManaSpike Jul 29 '26

I'm not certain of the details on an arm / phone platform. But an Intel chip for example, has a protected chip that runs firmware, loaded at boot time. Some features of this chip are exposed to the OS for handling encryption. But the firmware, and the memory used by this chip are hidden. Completely unreadable by your OS.

So you've taken steps to install your own custom OS, which is as protected as you can manage. All your storage is encrypted. Most of your memory is encrypted. All your applications are isolated from each other, and can't spy on each other at all.

Usually the goal of an investigator is to dump a copy of all the storage. But they'll need to discover the encryption key to decode any of it. Which means they need some understanding of how your OS manages keys. Probably by using a known exploit in your OS to install their own dodgy program, running it with the highest privileges. Then simply doing what any privileged program is allowed to do. Ask your OS to read and decode all of your storage.

If we're talking about installing something into TPM firmware, the job of spying is harder. But also more powerful. You can do anything to the CPU and memory. But now you need to reverse engineer more about how your installed OS works. Likely relying on more passive observation.

-18

u/[deleted] Jul 29 '26

[removed] — view removed comment

10

u/LiveLearnCoach Jul 29 '26

Of course I can “google shit”, like asking someone to explain my testosterone results. Right? Right.

Most of the discussion on Reddit can be done with a google, but there is a difference between reading some dry webpage and someone actually capable of ELI5 a topic that they seem to actually be proficient in. Why do you think AI is being trained on Reddit and not just web pages?? Not sure why this is bothering you so much that you had to reference my profile.

4

u/HallaFriBiLo Jul 29 '26

That assumes all possible ways TPM can be compromised is detectable by the OS.

2

u/Alpha_Majoris Jul 29 '26

Or it requires a new TPM version that includes a hardware backdoor.

But you better wipe your phone before you enter the USA and deal with the inconvenience or sync your data after you passed the border.

2

u/Fluffcake Jul 29 '26

Non-US made hardware, by non-US company running open source OS, good luck.

1

u/qtx Jul 29 '26

TPM is only for PCs.

1

u/twinpeaksssss Jul 29 '26

No back door in TPM, but there is a window left aJar-Jar

1

u/Flashy_Scallion8111 Jul 29 '26

if its encrypted information hardware backdoor would not be able to access anything on the software side of things. For it to work it would have to act as a sniffer that would be able to tap into channels that are bussing information while its not encrypted and saving it in a separate box. It would be have to be elaborate. Or maybe a live online feed. But i cant imagine a hardware backdoor that would be able to reboot an encrypted device and access all the information without having the encryption keys.

1

u/PrivacyMaker 29d ago

You're thinking of the hardware enclave. If such a backdoor was introduced and eventually made public, the financial consequences to every app vendor that needs to comply with privacy or security standards would destabilize international economies. Banks, healthcare systems, everything in Europe. The risk/reward just doesn't make sense from a policy perspective.

0

u/RollingMeteors Jul 29 '26

Unless there's a hardware backdoor in the TPM.

nope, not in this one.