7 ms·

The folks at http://neo900.org/ http://neo900.org/ are well aware of this and that phone is designed accordingly (details at http://neo900.org/faq#privacy http:

by gue5t 11y ago

The folks at http://neo900.org/ http://neo900.org/ are well aware of this and that phone is designed accordingly (details at http://neo900.org/faq#privacy http://neo900.org/faq#privacy). Hype-driven products like BlackPhone misrepresent their devices as being perfectly secure when this significant attack vector is completely unmitigated. On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. There is no feasible open-source baseband. OsmocomBB (http://bb.osmocom.org/trac/ http://bb.osmocom.org/trac/) is the closest thing to one, and it is relatively incomplete and works on a very limited range of mostly badly outdated hardware, none of which would not really be reasonable to use in a phone to be manufactured today. It's incredibly difficult to get people to care and help with the lack of software for tasks like GSM communication. Somehow even among people who describe themselves as "hackers", most just want to run Android or iOS and buy/run closed-source apps, and are more interested in Javascript and employment than reverse-engineering and doing things that have never been done before. The potential of reprogrammable computers that, at a low level, run the code you ask them to doesn't seem to get through to most of the HN crowd.

xlayn 11y ago
I have kind of confusion, your rant about people on HN not understanding that "re-programmable computers that, at a low level, run the code you ask them to" and the fact that no one has a complete ownership of all the parts inside that phone or any other option makes difficult to sustain an option as secure, because those options would comprise several different cpus. The closest way I can see to get something to be trusted is to start from a GNU approved laptop like [2] and add to it whichever modem you had on the neo9000 via usb... just as you said, but then you have this situation... For something to be secure... there has to be a secure chain of trust... -who creates the cpu? which kind of microcode has on it? -video controllers? blobs? drivers? -anything with DMA, who created your memory controller? -are you sure about the media you are using to install? -who creates the hdd? did someone "touch it" before you? --what about the controllers on the hdd? ram? take a look on the latest technology and you'll see there is no way you can trust anything [0][1]. --anything with a controller... this is a cpu... this is something not being driven by the main cpu it's an attack vector. "The potential of reprogrammable computers that, at a low level, run the code you ask them to doesn't seem to get through to most of the HN crowd" Do not generalize, different people, interests and approaches are part of how nature works, and remember we are as a friend said the "nature virtual machines". [0] http://bgr.com/2015/02/17/nsa-hard-drive-firmware-virus/ http://bgr.com/2015/02/17/nsa-hard-drive-firmware-virus/ [1] http://recode.net/2015/02/17/nsa-can-hide-spyware-in-hard-disk-firmware/ http://recode.net/2015/02/17/nsa-can-hide-spyware-in-hard-di... [2] https://www.fsf.org/news/libreboot-x200-laptop-now-fsf-certified-to-respect-your-freedom https://www.fsf.org/news/libreboot-x200-laptop-now-fsf-certi... edit: format
- gue5t 11y ago
  I agree completely that fully trusted hardware, although a laudable goal, is not achievable in today's reality. However, there are a lot of cool things you can do with hardware that looks like it runs your code, even if you don't know whether it contains backdoors or not. From the perspective of trying to guarantee security when you don't trust manufacturers, there are system-level invariants dictated by the laws of physics: you can be sure, to within measurement precision, that different chips from different manufacturers are not colluding wirelessly, and you can use signal analyzers on the bus to see what is being transmitted in typical operation. This won't save you from timebombs, but it gives you some idea of what's going on at least, and practically you can expect that unrelated corporations do not have the spare time/money/engineering smarts to invest to collaborate to spy on the users of heterogeneous devices far down the line. So you may not quite be able to trust your CPU, or your modem, or your RAM (well... maybe RAM is regular enough that you could sample and decap and borrow a microscope and see if things look fishy), but you can at least make sure they are behaving generally as CPUs or modems or RAM might at the boundaries between them. If you build a system with enough small chips doing simple tasks, though you'll end up with a slow, inefficient thing (think naïve implementations of a microkernel), you no longer need to trust the individual components much as there's little room for them to screw you over at a high level. And of course it's not true that all of HN is the way I described--it's just a distressingly large, or distressingly vocal proportion. I know it's at least enough people that projects like OsmocomBB are tragically underfunded, underhyped, and under-hacked-on.
  - xlayn 11y ago
    "you can be sure, to within measurement precision" I'm not sure how readily available are this kind of tools for the average joe, correct me if I'm wrong I do also thing is a destructive process, taking as a basis the Core 2 Duo P8400 that the X200 on the libreboot laptop which as per intel page is built on 45nm fabrication[0] and as Wikipedia mention (I know wikipedia could not be a trusted source of information for this) "This attack is not very common because it requires a large investment in effort and special equipment that is generally only available to large chip manufacturers. " [1] which still sounds logical. about " but you can at least make sure they are behaving generally as CPUs or modems or RAM might at the boundaries between them" you know this is close to impossible, check for example how the RAM tests are performed where a set of patterns are tested and you have some degree of certainty [2] and for which they last concludes "It should be obvious that this strategy requires an exact knowledge of how the memory cells are laid out on the chip. In addition there is a never ending number of possible chip layouts for different chip types and manufacturers making this strategy impractical. However, there are testing algorithms that can approximate this ideal. " notice approximate to ideal. "If you build a system with enough small chips doing simple tasks" and this is the path to take, a new set of trust-able cpus... but it's not one of the current options. [0] http://ark.intel.com/products/35569/Intel-Core2-Duo-Processor-P8400-3M-Cache-2_26-GHz-1066-MHz-FSB http://ark.intel.com/products/35569/Intel-Core2-Duo-Processo... [1] https://en.wikipedia.org/wiki/Reverse_engineering#Reverse_engineering_of_integrated_circuits.2Fsmart_cards https://en.wikipedia.org/wiki/Reverse_engineering#Reverse_en... [2] http://www.memtest86.com/technical.htm http://www.memtest86.com/technical.htm
pslam 11y ago
> On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. You'll find the modem on most smartphones is connected via USB - or rather its chip-to-chip version, HSIC. For SoCs where it's on-die - on the same bus/fabric - they will (if it's not an idiotic design) use an IOMMU of some sort, to prevent DMA from having access outside of its sandbox. Even if it's a modem on the other end of USB - which will almost certainly be using DMA, but at least host-programmed DMA - that's no guarantee. Google "Evil USB". USB is a overly complex stack which has and will continue to result in countless vulnerabilities, regardless of what you do with it.
- seba_dos1 11y ago
  "Evil USB" (or "bad USB") is possible thanks to the U part of USB - universal. If you connect a pendrive to your computer, it can easily say that it's a keyboard, because your computer cannot easily verify that you haven't just connected a keyboard. It would need to ask you in some trustworthy way to be sure, which sometimes can be problematic. OTOH, on the device like Neo900 it is well-known what kind of device is connected to the internal bus and software stack (at least on Linux) can easily be advised to not accept anything that doesn't look and behave like the included modem should. In a properly configured user OS, the modem would need to use some software vulnerability to exploit the USB stack, so the same principles apply there as with, say, OpenSSL, browser or the kernel. Secret zero-days aside, when some bug is found, it is patched and you upgrade the vulnerable component, just like on PC.
  - NateLawson 11y ago
    This is correct. The problem in this example is not the pendrive, but the automatic selection of device drivers based on the PC OS 100% trusting physical access. An easy way to see this is recompile the USB keyboard driver to ignore keyboard descriptors with a particular address or vendor ID. If you do this, the pendrive can't do anything because USB is host-controlled, as implemented by the OS. Without the OS initiating a conversation with the pendrive and saying "ok, I'll configure you as a keyboard and interpret responses from you as keystrokes", it can't happen. As you point out, the main CPU on a phone does not implement HID autoconfig on the internal baseband bus.
chc4 11y ago
Not only is OsmocomBB incomplete, but it's illegal to use. I've heard it mentioned multiple times that the baseband and the full stack that communicates with the modem has to be verified by the FCC, in order to comply with regulation on RF bandwidth and power. Even if you got it working in your new cell phone, using it would be illegal. I'm not how true that actually is when you can flash router firmware to use illegal wifi channels, though. http://bb.osmocom.org/trac/wiki/LegalAspects#Usingmodifiedphonesoncarriernetworks http://bb.osmocom.org/trac/wiki/LegalAspects#Usingmodifiedph...
- revelation 11y ago
  Well any RF equipment that you either modified or built yourself is per default illegal to use. You can buy a bluetooth-stack-on-a-chip and talk to it with your Arduino but once you sell that as a product you'll still require FCC certification. But the FCC isn't overly concerned if you're doing WiFi or Bluetooth, their area are the broad analog strokes, correct bandwidth and correct power. As such, if you use something that has the correct filters in hardware, you'll be just fine though technically breaking the law.
  - mahouse 11y ago
    Well, that's actually a problem: if you are forced to use something like OsmocomBB, law enforcement will be more than glad to see they have a new reason to have you in jail.
    - shawn-furyan 11y ago
      I'm not convinced that you're average beat cop is looking for OsmocomBB on your phone in order to trump up a reason to nab you. The tried and true method of following you for a couple blocks and interpreting traffic laws strictly is sufficient and requires much less knowledge and work.
revelation 11y ago
There just aren't the resources, hardware and information wise, you need. RF engineers don't seem to share the drive for free and open source technology that has been the common theme with software. As a result, we just recently got cheap, widely accessible SDRs, and even they only came about through more or less an accident. And their performance renders them pretty much useless for even just GSM. Now serious SDRs like USRPs have been available for a long time, and their specs make it possible to run GSM and other advanced RF protocols. So if you pay the 2k+ required to get one of these functional SDRs and have the knowledge that is predominantly still only found in dead trees or lectures in fields quite unrelated to CS, you still won't be able to get anything resembling a GSM phone. There are the obvious legal hurdles, you are not allowed to transmit willy-nilly, not even to just talk to a public GSM network. If you make sure no RF gets out the real world, you can pickup horribly outdated, discarded GSM test equipment from eBay for more big bucks and use that. In related news, they usually have a GSM(+) test network at the CCC congress, but they won't in 2016 because the regulatory agency just auctioned off the last bit of available test spectrum in the right band you could acquire through a lengthy, convoluted petition. And the list just goes on and on and on.. remember you'll need to first communicate with a SIM (really, Java!) card that is your key into any network. They pretty much mandated the equivalent of a DRM dongle!
- yuubi 11y ago
  The SIM in 3G isn't really much like a DRM thingy, apart from containing a key; it's more like a securid keyfob. The only interesting thing it does (apart from storing constants like its serial number and variables like your phone book and text messages) is to generate authentication responses (to prove to the network that you have it) and derive session keys (so your phone can encrypt and authenticate what it sends over the air). All the interfaces to this are open: the wire protocol to the SIM and the over-the-air protocols for authentication and security (what a phone needs to do) are specified completely by freely available 3GPP/ETSI specs. The details of how the SIM computes the derived keys and authentication response are a black box. 3GPP suggests a couple of sample algorithm sets, but there's no way to know whether the card did that unless you have the secret key (shared between the card and a box deep inside the carrier's network). However, the phone just passes the authentication-request parameters in an authenticate command to the card, passes the result of that in an authentication-response message back to the network, and obtains integrity and ciphering keys (for GSM) from a couple of files on the card (UMTS/LTE use some keys derived from these, but again, it's documented). An alternative, used in some older US specs like late AMPS, CDMA, and (EIA-136) TDMA is to store the secrets in the phone, generally at manufacturing time. This means that there's no real boundary between the carrier's authentication widget and "your" phone. Much better to have the identity contained in a SIM that belongs to the carrier, that your phone talks to at arm's length. Java seems to be for applications other than plain (U)SIM like prepaid account management. The card can ask the phone to add a menu to its interface, show messages, collect inputs, and other things. Maybe all plain USIM apps are written in java these days instead of having a masked ROM like they probably used to.
beatpanda 11y ago
>somehow even among people who describe themselves as "hackers", most just want to run Android or iOS and buy/run closed-source apps, and are more interested in Javascript and employment [read: eating, having shelter] than reverse-engineering and doing things that have never been done before. How many opportunities are there to work on secure communications software full time and still put food on the table?
- venomsnake 11y ago
  A LOT. But on the other side of the fence. LEO are paying like mad for secure communication solutions. And breaking into others.
  - LunaSea 11y ago
    * ethics not included
    - venomsnake 11y ago
      Good money are extremely good at tuning your ethics compass.
rsync 11y ago
"On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA." I have been "Mr. Cry About Baseband Ownage From The Rooftops" for years around here, and even I have to admit that a lot of baseband implementation in modern smartphones uses this same USB connected model. It's not universal, but a lot of USB-connected baseband is out in the world... Still closed source and owned by the provider. I would love to see an open source baseband with a hard switch to disable it.
- deleted 11y ago
  [deleted]
Gregordinary 11y ago
There is also https://www.freecalypso.org/ https://www.freecalypso.org/ which aims to produce libre firmware for the TI Calypso baseband chipset. Their mailing list is fairly active.
- seba_dos1 11y ago
  Please remember that FreeCalypso is not free software in commonly used sense - it uses unlicensed code from leaks. People behind FreeCalypso don't care about law, so they don't mind.
jrcii 11y ago
The only problem with the Neo 900 is it's in the ballpark of $1000 and production is very limited because it relies on rare parts.

by gue5t 11y ago

xlayn 11y ago

I have kind of confusion, your rant about people on HN not understanding that "re-programmable computers that, at a low level, run the code you ask them to" and the fact that no one has a complete ownership of all the parts inside that phone or any other option makes difficult to sustain an option as secure, because those options would comprise several different cpus. The closest way I can see to get something to be trusted is to start from a GNU approved laptop like [2] and add to it whichever modem you had on the neo9000 via usb... just as you said, but then you have this situation... For something to be secure... there has to be a secure chain of trust... -who creates the cpu? which kind of microcode has on it? -video controllers? blobs? drivers? -anything with DMA, who created your memory controller? -are you sure about the media you are using to install? -who creates the hdd? did someone "touch it" before you? --what about the controllers on the hdd? ram? take a look on the latest technology and you'll see there is no way you can trust anything [0][1]. --anything with a controller... this is a cpu... this is something not being driven by the main cpu it's an attack vector. "The potential of reprogrammable computers that, at a low level, run the code you ask them to doesn't seem to get through to most of the HN crowd" Do not generalize, different people, interests and approaches are part of how nature works, and remember we are as a friend said the "nature virtual machines". [0] http://bgr.com/2015/02/17/nsa-hard-drive-firmware-virus/ http://bgr.com/2015/02/17/nsa-hard-drive-firmware-virus/ [1] http://recode.net/2015/02/17/nsa-can-hide-spyware-in-hard-disk-firmware/ http://recode.net/2015/02/17/nsa-can-hide-spyware-in-hard-di... [2] https://www.fsf.org/news/libreboot-x200-laptop-now-fsf-certified-to-respect-your-freedom https://www.fsf.org/news/libreboot-x200-laptop-now-fsf-certi... edit: format

gue5t 11y ago
I agree completely that fully trusted hardware, although a laudable goal, is not achievable in today's reality. However, there are a lot of cool things you can do with hardware that looks like it runs your code, even if you don't know whether it contains backdoors or not. From the perspective of trying to guarantee security when you don't trust manufacturers, there are system-level invariants dictated by the laws of physics: you can be sure, to within measurement precision, that different chips from different manufacturers are not colluding wirelessly, and you can use signal analyzers on the bus to see what is being transmitted in typical operation. This won't save you from timebombs, but it gives you some idea of what's going on at least, and practically you can expect that unrelated corporations do not have the spare time/money/engineering smarts to invest to collaborate to spy on the users of heterogeneous devices far down the line. So you may not quite be able to trust your CPU, or your modem, or your RAM (well... maybe RAM is regular enough that you could sample and decap and borrow a microscope and see if things look fishy), but you can at least make sure they are behaving generally as CPUs or modems or RAM might at the boundaries between them. If you build a system with enough small chips doing simple tasks, though you'll end up with a slow, inefficient thing (think naïve implementations of a microkernel), you no longer need to trust the individual components much as there's little room for them to screw you over at a high level. And of course it's not true that all of HN is the way I described--it's just a distressingly large, or distressingly vocal proportion. I know it's at least enough people that projects like OsmocomBB are tragically underfunded, underhyped, and under-hacked-on.
- xlayn 11y ago
  "you can be sure, to within measurement precision" I'm not sure how readily available are this kind of tools for the average joe, correct me if I'm wrong I do also thing is a destructive process, taking as a basis the Core 2 Duo P8400 that the X200 on the libreboot laptop which as per intel page is built on 45nm fabrication[0] and as Wikipedia mention (I know wikipedia could not be a trusted source of information for this) "This attack is not very common because it requires a large investment in effort and special equipment that is generally only available to large chip manufacturers. " [1] which still sounds logical. about " but you can at least make sure they are behaving generally as CPUs or modems or RAM might at the boundaries between them" you know this is close to impossible, check for example how the RAM tests are performed where a set of patterns are tested and you have some degree of certainty [2] and for which they last concludes "It should be obvious that this strategy requires an exact knowledge of how the memory cells are laid out on the chip. In addition there is a never ending number of possible chip layouts for different chip types and manufacturers making this strategy impractical. However, there are testing algorithms that can approximate this ideal. " notice approximate to ideal. "If you build a system with enough small chips doing simple tasks" and this is the path to take, a new set of trust-able cpus... but it's not one of the current options. [0] http://ark.intel.com/products/35569/Intel-Core2-Duo-Processor-P8400-3M-Cache-2_26-GHz-1066-MHz-FSB http://ark.intel.com/products/35569/Intel-Core2-Duo-Processo... [1] https://en.wikipedia.org/wiki/Reverse_engineering#Reverse_engineering_of_integrated_circuits.2Fsmart_cards https://en.wikipedia.org/wiki/Reverse_engineering#Reverse_en... [2] http://www.memtest86.com/technical.htm http://www.memtest86.com/technical.htm

pslam 11y ago

> On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. You'll find the modem on most smartphones is connected via USB - or rather its chip-to-chip version, HSIC. For SoCs where it's on-die - on the same bus/fabric - they will (if it's not an idiotic design) use an IOMMU of some sort, to prevent DMA from having access outside of its sandbox. Even if it's a modem on the other end of USB - which will almost certainly be using DMA, but at least host-programmed DMA - that's no guarantee. Google "Evil USB". USB is a overly complex stack which has and will continue to result in countless vulnerabilities, regardless of what you do with it.

seba_dos1 11y ago
"Evil USB" (or "bad USB") is possible thanks to the U part of USB - universal. If you connect a pendrive to your computer, it can easily say that it's a keyboard, because your computer cannot easily verify that you haven't just connected a keyboard. It would need to ask you in some trustworthy way to be sure, which sometimes can be problematic. OTOH, on the device like Neo900 it is well-known what kind of device is connected to the internal bus and software stack (at least on Linux) can easily be advised to not accept anything that doesn't look and behave like the included modem should. In a properly configured user OS, the modem would need to use some software vulnerability to exploit the USB stack, so the same principles apply there as with, say, OpenSSL, browser or the kernel. Secret zero-days aside, when some bug is found, it is patched and you upgrade the vulnerable component, just like on PC.
- NateLawson 11y ago
  This is correct. The problem in this example is not the pendrive, but the automatic selection of device drivers based on the PC OS 100% trusting physical access. An easy way to see this is recompile the USB keyboard driver to ignore keyboard descriptors with a particular address or vendor ID. If you do this, the pendrive can't do anything because USB is host-controlled, as implemented by the OS. Without the OS initiating a conversation with the pendrive and saying "ok, I'll configure you as a keyboard and interpret responses from you as keystrokes", it can't happen. As you point out, the main CPU on a phone does not implement HID autoconfig on the internal baseband bus.

chc4 11y ago

Not only is OsmocomBB incomplete, but it's illegal to use. I've heard it mentioned multiple times that the baseband and the full stack that communicates with the modem has to be verified by the FCC, in order to comply with regulation on RF bandwidth and power. Even if you got it working in your new cell phone, using it would be illegal. I'm not how true that actually is when you can flash router firmware to use illegal wifi channels, though. http://bb.osmocom.org/trac/wiki/LegalAspects#Usingmodifiedphonesoncarriernetworks http://bb.osmocom.org/trac/wiki/LegalAspects#Usingmodifiedph...

revelation 11y ago
Well any RF equipment that you either modified or built yourself is per default illegal to use. You can buy a bluetooth-stack-on-a-chip and talk to it with your Arduino but once you sell that as a product you'll still require FCC certification. But the FCC isn't overly concerned if you're doing WiFi or Bluetooth, their area are the broad analog strokes, correct bandwidth and correct power. As such, if you use something that has the correct filters in hardware, you'll be just fine though technically breaking the law.
- mahouse 11y ago
  Well, that's actually a problem: if you are forced to use something like OsmocomBB, law enforcement will be more than glad to see they have a new reason to have you in jail.
  - shawn-furyan 11y ago
    I'm not convinced that you're average beat cop is looking for OsmocomBB on your phone in order to trump up a reason to nab you. The tried and true method of following you for a couple blocks and interpreting traffic laws strictly is sufficient and requires much less knowledge and work.

revelation 11y ago

There just aren't the resources, hardware and information wise, you need. RF engineers don't seem to share the drive for free and open source technology that has been the common theme with software. As a result, we just recently got cheap, widely accessible SDRs, and even they only came about through more or less an accident. And their performance renders them pretty much useless for even just GSM. Now serious SDRs like USRPs have been available for a long time, and their specs make it possible to run GSM and other advanced RF protocols. So if you pay the 2k+ required to get one of these functional SDRs and have the knowledge that is predominantly still only found in dead trees or lectures in fields quite unrelated to CS, you still won't be able to get anything resembling a GSM phone. There are the obvious legal hurdles, you are not allowed to transmit willy-nilly, not even to just talk to a public GSM network. If you make sure no RF gets out the real world, you can pickup horribly outdated, discarded GSM test equipment from eBay for more big bucks and use that. In related news, they usually have a GSM(+) test network at the CCC congress, but they won't in 2016 because the regulatory agency just auctioned off the last bit of available test spectrum in the right band you could acquire through a lengthy, convoluted petition. And the list just goes on and on and on.. remember you'll need to first communicate with a SIM (really, Java!) card that is your key into any network. They pretty much mandated the equivalent of a DRM dongle!

yuubi 11y ago
The SIM in 3G isn't really much like a DRM thingy, apart from containing a key; it's more like a securid keyfob. The only interesting thing it does (apart from storing constants like its serial number and variables like your phone book and text messages) is to generate authentication responses (to prove to the network that you have it) and derive session keys (so your phone can encrypt and authenticate what it sends over the air). All the interfaces to this are open: the wire protocol to the SIM and the over-the-air protocols for authentication and security (what a phone needs to do) are specified completely by freely available 3GPP/ETSI specs. The details of how the SIM computes the derived keys and authentication response are a black box. 3GPP suggests a couple of sample algorithm sets, but there's no way to know whether the card did that unless you have the secret key (shared between the card and a box deep inside the carrier's network). However, the phone just passes the authentication-request parameters in an authenticate command to the card, passes the result of that in an authentication-response message back to the network, and obtains integrity and ciphering keys (for GSM) from a couple of files on the card (UMTS/LTE use some keys derived from these, but again, it's documented). An alternative, used in some older US specs like late AMPS, CDMA, and (EIA-136) TDMA is to store the secrets in the phone, generally at manufacturing time. This means that there's no real boundary between the carrier's authentication widget and "your" phone. Much better to have the identity contained in a SIM that belongs to the carrier, that your phone talks to at arm's length. Java seems to be for applications other than plain (U)SIM like prepaid account management. The card can ask the phone to add a menu to its interface, show messages, collect inputs, and other things. Maybe all plain USIM apps are written in java these days instead of having a masked ROM like they probably used to.

beatpanda 11y ago

>somehow even among people who describe themselves as "hackers", most just want to run Android or iOS and buy/run closed-source apps, and are more interested in Javascript and employment [read: eating, having shelter] than reverse-engineering and doing things that have never been done before. How many opportunities are there to work on secure communications software full time and still put food on the table?

venomsnake 11y ago
A LOT. But on the other side of the fence. LEO are paying like mad for secure communication solutions. And breaking into others.
- LunaSea 11y ago
  * ethics not included
  - venomsnake 11y ago
    Good money are extremely good at tuning your ethics compass.

rsync 11y ago

"On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA." I have been "Mr. Cry About Baseband Ownage From The Rooftops" for years around here, and even I have to admit that a lot of baseband implementation in modern smartphones uses this same USB connected model. It's not universal, but a lot of USB-connected baseband is out in the world... Still closed source and owned by the provider. I would love to see an open source baseband with a hard switch to disable it.

deleted 11y ago
[deleted]

Gregordinary 11y ago

There is also https://www.freecalypso.org/ https://www.freecalypso.org/ which aims to produce libre firmware for the TI Calypso baseband chipset. Their mailing list is fairly active.

seba_dos1 11y ago
Please remember that FreeCalypso is not free software in commonly used sense - it uses unlicensed code from leaks. People behind FreeCalypso don't care about law, so they don't mind.

jrcii 11y ago

The only problem with the Neo 900 is it's in the ballpark of $1000 and production is very limited because it relies on rare parts.