linux-kernel - Re: [PATCH] platform/chrome: wilco_ec: Add telemetry data char device interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1d9add8f-6205-dfa2-d15c-c2fab29b091a@metux.net>
Date:   Mon, 15 Apr 2019 10:04:00 +0200
From:   "Enrico Weigelt, metux IT consult" <lkml@...ux.net>
To:     Nick Crews <ncrews@...omium.org>, enric.balletbo@...labora.com,
        bleung@...omium.org
Cc:     linux-kernel@...r.kernel.org, dlaurie@...omium.org,
        derat@...gle.com, groeck@...gle.com, dtor@...gle.com,
        sjg@...omium.org, bartfab@...omium.org, lamzin@...gle.com,
        jchwong@...gle.com
Subject: Re: [PATCH] platform/chrome: wilco_ec: Add telemetry data char device
 interface

On 13.04.19 00:45, Nick Crews wrote:
> The Wilco Embedded Controller is able to send telemetry data
> which is useful for enterprise applications. 

What kind of "enterprise applications" exactly ?

> A daemon running on
> the OS sends a command to the EC via write() to char device,
> and can read the response with a read() request.
> Both the request and the response are in an opaque
> binary format so that information which is proprietary to the
> enterprise service provider is secure.

In other words: a direct backdoor for the "provider", who can do
anything he wants remotely on the user's machine, w/o the user having
a chance of seeing what's actually going on ?

Seriously ?!

In some of your previous mails (*1) you indicate that it sends some
diagnostics information (eg. "dock is not working"). WTH does that
have to be "proprietary", IOW: encrypted = kept secret from the owner ?

If I *own* such a device, this is some information, I *need* to know,
I *deserve* to know, and it is *my* data, as it's a state of *my*
device. And that's some kind of information that *nobody* else has
any business with that. Period.

Seems you folks (Google) still didn't learn the fundamental difference
between ownership and just a license to use. And the recent multi
billion fines against Google still haven't been enough, so I'm looking
forward Mrs. Vestager's next strikes.

I'd like to remind you of the famous words of JR. Oppenheimer:
""Now I am become Death, the destroyer of worlds."
(quoted from the Bhagavad Gita, when he recognized the desatreous
consequences of his work)

--mtx

-- 
Enrico Weigelt, metux IT consult
Free software and Linux embedded engineering
info@...ux.net -- +49-151-27565287