Don’t Ignore This Simple Tip: NSA Says Rebooting Can Protect Your Phone
Don’t Ignore This Simple Tip: NSA Says Rebooting Can Protect Your Phone
The National Security Agency urges iPhone and Android users to reboot devices regularly to reduce risks from cyber threats.
Tin hat time! The NSA has a new backdoor rolling out to everyone's phones but they need to reboot for it to finish installing.
Ha! I refuse to reboot anything
Well now I'm not doing it
Doesn't actually describe how it helps...
Basically, the secure boot process of your smartphone ensures that only validated software has been loaded. The chip itself validates the bootloader, which validates the kernel, which then successfully forces validation on every app that gets loaded. Most exploits work by corrupting memory or injecting code that shouldn’t be on the system. By rebooting, you are forcing a revalidation of everything that runs, which is going to exclude the attacker’s code unless the attacker can come up with an additional bug to bypass the validation on boot. Any software that doesn’t have a valid digital signature from a trusted source simply won’t get executed.
You can see this in the jailbreak scene on iPhones. Jailbreaks are classified into tethered and untethered categories. A tether jailbreak is such an exploit that can inject code but can’t survive the validation process upon reboot, so it goes away, meaning the user has to tether to a computer and repeat the process every time. Untethered requires two bugs: The bug to inject the code, and the bug that dodges verification and is capable of injecting code when the system is starting. There’s also a class of jailbreak called semi-untethered that goes away when you reboot, but it’s possible to exploit again manually by the user using tools left behind on the phone, but the same basic principle applies that injected code goes away upon rebooting unless you have another trick up your sleeve.
GrapheneOS provides an auto-reboot feature which reboots locked devices after a set period of time to put data at rest. A countdown timer is started each time the device is locked, and the device will reboot if a successful unlock doesn't occur before the timer reaches zero.
https://grapheneos.org/features#auto-reboot
Essentially it drops the decryption key derived from your unlock pattern / code. Attacks to access files while the decryption key is loaded, even if the phone is locked, are mitigated. The only things that works after a reboot are phone calls, SMS, and the alarm clock. I have mine set to reboot every 4 hours of inactivity.
I believe this feature is to not only to mitigate your average attacker but also law enforcement threat levels who purchase exploit kits. Can't do much without the decryption key so they are left with slow brute force attacks.
if your phone compromised, chances are the code is running in volatile memory , a reboot would clean such infections.
My uneducated guess is, some threats will burrow themselves in active memory but have no way of persisting beyond a reboot. Or perhaps it just shuts down background software you don't need that could be vulnerable.
Makes sense and gives a compelling reason for regular reboots.
This is also true because of fileless malware. Not all malware attempts to write to the disk because it leaves behind artifacts that could get captured or detected. Depending on what the attacker goals are, they may prefer to have the malware simply disappear if memory gets reset.
Or like you wrote it is possible they just didn’t bother implementing a survival strategy because most people don’t reboot their phones very often.
