2022-06-30 06:19:28 +01:00
|
|
|
<!DOCTYPE html>
|
|
|
|
|
<html>
|
|
|
|
|
<head>
|
2022-10-29 23:54:59 +01:00
|
|
|
<title>Inferencium Network - About</title>
|
|
|
|
|
<link rel="stylesheet" href=infnet.css>
|
2022-06-30 06:19:28 +01:00
|
|
|
</head>
|
2022-10-29 01:30:35 +01:00
|
|
|
<div class="sidebar">
|
2022-10-29 23:54:59 +01:00
|
|
|
<a class="title">Inferencium Network</a><br>
|
|
|
|
|
<br>
|
|
|
|
|
<br>
|
|
|
|
|
<div><a href="about.html">About</a></div>
|
|
|
|
|
<div><a href="contact.html">Contact</a></div>
|
|
|
|
|
<div><a href="blog.html">Blog</a></div>
|
|
|
|
|
<div><a href="source.html">Source</a></div>
|
2022-10-29 01:30:35 +01:00
|
|
|
</div>
|
2022-06-30 06:19:28 +01:00
|
|
|
<body>
|
2022-10-29 23:54:59 +01:00
|
|
|
<h1>About</h1>
|
|
|
|
|
<br>
|
|
|
|
|
<h3>About Me</h3>
|
|
|
|
|
<p>I am Inference, a cybersecurity researcher based in United Kingdom.<br>
|
|
|
|
|
<br>
|
|
|
|
|
<p>I write about my research and experience in cybersecurity and also physical
|
|
|
|
|
security. Most of my postings are security-related, but I occasionally post
|
|
|
|
|
about other aspects of my life.</p>
|
|
|
|
|
<br>
|
|
|
|
|
<p>I am an open source advocate for the preservation and modifiability of
|
|
|
|
|
source code. I believe source code should be considered human knowledge as
|
|
|
|
|
much as past knowledge and teachings were; it is how modern humanity
|
|
|
|
|
survives and runs.<br>
|
|
|
|
|
Source code being modifiable allows it to be adapted
|
|
|
|
|
for use by anyone, whether to add features, harden it for increased security
|
|
|
|
|
and/or privacy, or provide accessibility for disabled users.<br>
|
|
|
|
|
I am also a modular design advocate for the ability to securely and
|
|
|
|
|
robustly make changes to hardware and software without the entire system
|
|
|
|
|
being affected.</p>
|
|
|
|
|
<br>
|
|
|
|
|
<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<h3>Hardware I Use</h3>
|
|
|
|
|
<h4>Smartphone</h4>
|
|
|
|
|
<table>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>Type</td>
|
|
|
|
|
<td>Hardware</td>
|
|
|
|
|
<td>Description</td>
|
|
|
|
|
<td>Source model<br>
|
|
|
|
|
<br>
|
|
|
|
|
(License)</td>
|
|
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>Smartphone</td>
|
|
|
|
|
<td><img src="img/google-pixel_6.png" width="100px" height="100px"/><br>
|
|
|
|
|
<br>
|
|
|
|
|
Google Pixel 6</td>
|
|
|
|
|
<td>Google Pixel devices are the best Android devices available on
|
|
|
|
|
the market for security and privacy.<br>
|
|
|
|
|
<br>
|
|
|
|
|
They allow locking the bootloader with a custom Android Verified Boot (AVB)
|
|
|
|
|
key in order to preserve security and privacy features when installing a custom
|
|
|
|
|
operating system, such as verified boot which verifies that the OS has not been
|
|
|
|
|
corrupted or tampered with, and rollback protection which prevents an adversary
|
|
|
|
|
from rolling back the OS or firmware version to a previous version with known
|
|
|
|
|
security vulnerabilities.<br>
|
|
|
|
|
<br>
|
|
|
|
|
They also include a hardware security module (Titan M2) which is extremely resistant
|
|
|
|
|
to both remote and physical attacks due to being completely isolated from
|
|
|
|
|
the rest of the system, including the operating system. Titan M2 ensures that
|
|
|
|
|
the device cannot be remotely compromised by requiring the side buttons of the
|
|
|
|
|
device to be physically pressed for some sensitive operations. Titan M2 also
|
|
|
|
|
takes the role of Android Strongbox keystore, containing sensitive user keys which
|
|
|
|
|
are unavailable to the OS or apps running on it without authorisation from Titan M2
|
|
|
|
|
itself. Insider attack resistance ensures that Titan M2 firmware can be flashed only
|
|
|
|
|
if the user PIN/password is already known, making it impossible to backdoor the device
|
|
|
|
|
without already knowing these secrets.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Google Pixel device kernels are compiled with fine-grained, forward-edge control-flow
|
|
|
|
|
integrity and backward-edge control-flow integrity to prevent code reuse attacks against
|
|
|
|
|
the kernel. MAC address randomisation is implemented well, with minimal probe requests
|
|
|
|
|
and randomised initial sequence numbers.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Google releases guaranteed monthly security updates, ensuring Google Pixel devices are
|
|
|
|
|
up-to-date and quickly protected against security vulnerabilities.<br>
|
|
|
|
|
<br>
|
|
|
|
|
Pixel 6-series devices are a large improvement over the already very secure and private
|
|
|
|
|
previous generation Pixel devices. They replace ARM-based Titan M with RISC-V-based Titan M2,
|
|
|
|
|
reducing trust by removing ARM from the equation. Titan M2 is more resiliant to attacks than
|
|
|
|
|
Titan M, and is AVA_VAN.5 certified, the highest level of vulnerability assessment. Google's
|
2022-10-31 00:25:44 +00:00
|
|
|
in-house Tensor SoC includes Tensor Security Core, further improving device security.<br>
|
|
|
|
|
Pixel 6-series devices are supported for a minimum of 5 years from launch, an increase from
|
|
|
|
|
previous generations' support lifecycles of 3 years.</td>
|
2022-10-31 00:22:30 +00:00
|
|
|
</tr>
|
|
|
|
|
</table>
|
|
|
|
|
<br>
|
|
|
|
|
<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
<h3>Software I Use</h3>
|
|
|
|
|
<h4>Desktop</h4>
|
|
|
|
|
<table>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>Type</td>
|
|
|
|
|
<td>Software</td>
|
|
|
|
|
<td>Description</td>
|
2022-10-30 02:38:49 +00:00
|
|
|
<td>Source model<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
(License)</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>Operating system</td>
|
|
|
|
|
<td><img src="img/logo-gentoo_linux.png" width="100px" height="100px"/><br>
|
|
|
|
|
<br>
|
|
|
|
|
Gentoo Linux</td>
|
|
|
|
|
<td>Gentoo Linux is a highly modular, source-based Linux-based operating system
|
|
|
|
|
which allows vast customisation to tailor the operating system to suit your specific
|
|
|
|
|
needs. There are many advantages to such an operating system, with the most notable
|
|
|
|
|
being the ability to optimise the software for security, privacy, performance,
|
2022-10-30 02:38:49 +00:00
|
|
|
or power usage; however, there are effectively unlimited other use cases, or a
|
2022-10-29 23:54:59 +01:00
|
|
|
combination of multiple use cases.<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
I have focused on security hardening and privacy hardening, placing performance below
|
|
|
|
|
those aspects, although my system is still very performant. Some of the hardening I
|
|
|
|
|
apply includes stack protection, signed integer overflow wrapping, and GrapheneOS'
|
|
|
|
|
hardened_malloc memory allocator.<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
2022-10-31 00:22:30 +00:00
|
|
|
You can find my personal Gentoo Linux configuration
|
2022-10-29 23:54:59 +01:00
|
|
|
<a class="table-link" href="https://git.inferencium.net/inference/cfg/">here</a>.</td>
|
|
|
|
|
<td>Open source<br>
|
|
|
|
|
<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
(GPLv2-only)</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
</tr>
|
2022-10-30 02:38:49 +00:00
|
|
|
<tr>
|
|
|
|
|
<td>Web browser</td>
|
|
|
|
|
<td><img src="img/logo-chromium.png" width="100px" height="100px"/><br>
|
|
|
|
|
<br>
|
|
|
|
|
Chromium</td>
|
|
|
|
|
<td>Chromium is a highly secure web browser which is often ahead of other
|
|
|
|
|
web browsers in security aspects. It has a dedicated security team and a
|
|
|
|
|
very impressive
|
|
|
|
|
<a class="table-link" href="https://www.chromium.org/Home/chromium-security/brag-sheet/">security brag sheet</a>.
|
|
|
|
|
Chromium's security features include a strong
|
|
|
|
|
<a class="table-link" href="https://code.google.com/p/chromium/wiki/LinuxSandboxing">multi-layer sandbox</a>,
|
|
|
|
|
strong <a class="table-link" href="https://www.chromium.org/Home/chromium-security/site-isolation">site isolation</a>,
|
|
|
|
|
<a class="table-link" href="https://www.chromium.org/Home/chromium-security/binding-integrity">Binding Integrity</a>
|
|
|
|
|
memory hardening, and
|
|
|
|
|
<a class="table-link" href="https://www.chromium.org/developers/testing/control-flow-integrity/">control-flow integrity (CFI)</a>.<br>
|
|
|
|
|
<br>
|
|
|
|
|
You can learn more about Chromium by visiting its
|
|
|
|
|
<a class="table-link" href="https://www.chromium.org/Home/">official website</a>
|
|
|
|
|
which provides extensive documentation.</td>
|
|
|
|
|
<td>Open source<br>
|
|
|
|
|
<br>
|
|
|
|
|
(BSD 3-Clause)</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
</tr>
|
|
|
|
|
</table>
|
|
|
|
|
<h4>Smartphone</h4>
|
|
|
|
|
<table>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>Type</td>
|
|
|
|
|
<td>Software</td>
|
|
|
|
|
<td>Description</td>
|
2022-10-30 02:38:49 +00:00
|
|
|
<td>Source model<br>
|
|
|
|
|
<br>
|
|
|
|
|
(License)</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
</tr>
|
|
|
|
|
<tr>
|
|
|
|
|
<td>Operating system</td>
|
|
|
|
|
<td><img src="img/logo-grapheneos.png" width="100px" height="100px"/><br>
|
|
|
|
|
<br>
|
|
|
|
|
GrapheneOS</td>
|
|
|
|
|
<td>GrapheneOS is a security-hardened, privacy-hardened, secure-by-default
|
|
|
|
|
Android-based operating system which implements extensive, systemic security
|
|
|
|
|
and privacy hardening to the Android Open Source Project used as its base
|
|
|
|
|
codebase. Its hardening includes closing gaps for apps to access sensitive
|
|
|
|
|
system information, a secure app spawning feature which avoids sharing address
|
|
|
|
|
space layout and other secrets AOSP's default Zygote app spawning model would
|
|
|
|
|
share, GrapheneOS' own hardened memory allocator (hardened_malloc) to protect
|
|
|
|
|
against common memory corruption vulnerabilties, hardened Bionic standard C library,
|
|
|
|
|
and local and remote hardware-backed attestation (Auditor) to ensure the OS has
|
|
|
|
|
not been corrupted or tampered with. GrapheneOS only supports devices which receive
|
2022-10-30 02:38:49 +00:00
|
|
|
full support from their manufacturers, including firmware updates, long support
|
|
|
|
|
lifecycles, secure hardware, and overall high security practices.<br>
|
|
|
|
|
<br>
|
2022-10-29 23:54:59 +01:00
|
|
|
For an extensive list of features GrapheneOS provides, visit its
|
2022-10-30 02:38:49 +00:00
|
|
|
<a class="table-link" href="https://grapheneos.org/">official website</a>
|
|
|
|
|
which provides extensive documentation.</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
<td>Open source<br>
|
|
|
|
|
<br>
|
|
|
|
|
(MIT)</td>
|
|
|
|
|
</tr>
|
2022-10-30 02:38:49 +00:00
|
|
|
<tr>
|
|
|
|
|
<td>Web browser</td>
|
|
|
|
|
<td><img src="img/logo-vanadium.png" width="100px" height="100px"/><br>
|
|
|
|
|
<br>
|
|
|
|
|
Vanadium</td>
|
|
|
|
|
<td>Vanadium is a security-hardened, privacy-hardened Chromium-based web browser
|
|
|
|
|
which utilises GrapheneOS' operating system hardening to implement stronger
|
2022-10-31 00:22:30 +00:00
|
|
|
defenses to the already very secure Chromium web browser. Its hardening alongside
|
|
|
|
|
Chromium's base security features includes disabling JavaScript just-in-time (JIT)
|
|
|
|
|
compilation by default, stubbing out the battery status API to prevent abuse of it,
|
|
|
|
|
and always-on Incognito mode as an option.<br>
|
2022-10-30 02:38:49 +00:00
|
|
|
<br>
|
|
|
|
|
Vanadium's source code repository, including its Chromium patchset, can be found
|
|
|
|
|
<a class="table-link" href="https://github.com/GrapheneOS/Vanadium/">here</a>.</td>
|
|
|
|
|
<td>Open source<br>
|
|
|
|
|
<br>
|
|
|
|
|
(GPLv2-only)</td>
|
2022-10-29 23:54:59 +01:00
|
|
|
</table>
|
|
|
|
|
<br>
|
|
|
|
|
<br>
|
2022-06-30 06:19:28 +01:00
|
|
|
</body>
|
|
|
|
|
</html>
|
