Unit 1: How phones are built to defend · Lesson 3 of 5 · 18 min
Verified boot across the fleet
Read a phone's boot state from the shell, then find the one device that no longer boots verified code.
mission
- You are
- You are the IT analyst at Kestrel Field Services.
- Situation
- The MDM exported the verified boot state of every Android phone to Leo's device for this review.
- Goal
- Confirm Leo's phone boots verified code, then check the rest of the fleet.
- Hand in
- Any device whose boot chain is broken.
Verified boot as a chain of sealed doors
Read this phone's state
getprop ro.boot.verifiedbootstate green getprop ro.boot.flash.locked 1
you should see green and 1: a locked bootloader running the maker's signed software.
Boot states
| Command | What it does |
|---|---|
green | Locked bootloader, maker's keys, everything verified |
yellow | Locked, but signed with a user-supplied key |
orange | Bootloader unlocked, nothing is verified |
red | Verification failed |
Check the whole fleet
cat fleet/bootstate.txt | grep -v green KFS-A-028 ro.boot.verifiedbootstate=[orange] ro.boot.flash.locked=[0] grep -c green fleet/bootstate.txt 14
you should see Fourteen green, one orange.
defender tip Unlocking a bootloader wipes the phone, so an orange device was unlocked on purpose by someone with it in hand. Ask the owner before you assume malice.
Decide what an orange phone may reach
KFS-A-028 is a BYOD phone with a work profile. With an unlocked bootloader nothing below the apps can be trusted, including the work profile's protections.
you should see Block company data on it until it is relocked or replaced.
What a defender takes away
- 1Verified boot proves that the OS has not been swapped since the factory.
- 2orange means unlocked, and unlocked means unverifiable.
- 3Check boot state across the fleet, not one phone at a time.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.