4 ms·

> For devices with cellular access, the baseband subsystem also utilizes its own similar process of secure booting with signed software and keys verified by the

> For devices with cellular access, the baseband subsystem also utilizes its own similar process of secure booting with signed software and keys verified by the baseband processor. According to the iOS security white paper, the baseband firmware is part of the secure boot chain, and has its own secure boot chain. This allows me to assume it's very hard to inject or replace the the firmware with a malicious code. Whether or not the firmware itself has a backdoor or whatever I don't know, but at least one major phone manufacture knows this firmware is very important for security.

revelation 11y ago
That's just iOS being iOS, on Android the baseband firmware can usually be flashed using fastboot. However, there will presumably still be a bootloader on the baseband processor that checks the authenticity of what you just flashed to it. It's very interesting to just download a baseband firmware (usually called radio.img) from a random Android forum, unpack it and run strings on the code you get. It'll usually be an ARM processor running a homebrew RTOS, which is concerning enough. When you search for NMEA and realize the baseband processor is running the GPS chip, that's when you are starting to get doubts. And when you finally realize theres a bunch of audio codecs and the baseband is controlling the microphones, that's when the full force of despair hits you. You don't own it, you don't control any part of it. Your Android doesn't either, it begs the baseband for a slice of its information.
- zanny 11y ago
  > Testing DDR Read/Write. > Testing DDR Read/Write: Memory map. > Testing DDR Read/Write: Data lines. > Testing DDR Read/Write: Address lines. > Testing DDR Read/Write: Own-address algorithm. > Testing DDR Read/Write: Walking-ones algorithm. > Testing DDR Deep Power Down. > Testing DDR Deep Power Down: Entering deep power down. > Testing DDR Deep Power Down: In deep power down. > Testing DDR Deep Power Down: Exiting deep power down. > Testing DDR Deep Power Down: Read/write pass. > Testing DDR Self Refresh. > Testing DDR Self Refresh: Write pass. > Testing DDR Self Refresh: Read pass. > Testing DDR Self Refresh: Entering self refresh. > Testing DDR Self Refresh: In self refresh. > Testing DDR Self Refresh: Exiting self refresh. Yes Galaxy s4 modem, please provide unlimited access to all government agencies of all my phones content and communications. > Samsung Root CA cert1%0# Fantastic, you also inject your own root certificate. Thanks.
seba_dos1 11y ago
Looking at the kinds and amounts of just standard software vulnerabilities in those firmwares that have been found in the past, I presume there's plenty of low hanging fruit still to be found there. It doesn't really need to be an intentional backdoor, it can be just good old buffer overflow with remote execution.

revelation 11y ago

That's just iOS being iOS, on Android the baseband firmware can usually be flashed using fastboot. However, there will presumably still be a bootloader on the baseband processor that checks the authenticity of what you just flashed to it. It's very interesting to just download a baseband firmware (usually called radio.img) from a random Android forum, unpack it and run strings on the code you get. It'll usually be an ARM processor running a homebrew RTOS, which is concerning enough. When you search for NMEA and realize the baseband processor is running the GPS chip, that's when you are starting to get doubts. And when you finally realize theres a bunch of audio codecs and the baseband is controlling the microphones, that's when the full force of despair hits you. You don't own it, you don't control any part of it. Your Android doesn't either, it begs the baseband for a slice of its information.

zanny 11y ago
> Testing DDR Read/Write. > Testing DDR Read/Write: Memory map. > Testing DDR Read/Write: Data lines. > Testing DDR Read/Write: Address lines. > Testing DDR Read/Write: Own-address algorithm. > Testing DDR Read/Write: Walking-ones algorithm. > Testing DDR Deep Power Down. > Testing DDR Deep Power Down: Entering deep power down. > Testing DDR Deep Power Down: In deep power down. > Testing DDR Deep Power Down: Exiting deep power down. > Testing DDR Deep Power Down: Read/write pass. > Testing DDR Self Refresh. > Testing DDR Self Refresh: Write pass. > Testing DDR Self Refresh: Read pass. > Testing DDR Self Refresh: Entering self refresh. > Testing DDR Self Refresh: In self refresh. > Testing DDR Self Refresh: Exiting self refresh. Yes Galaxy s4 modem, please provide unlimited access to all government agencies of all my phones content and communications. > Samsung Root CA cert1%0# Fantastic, you also inject your own root certificate. Thanks.

seba_dos1 11y ago

Looking at the kinds and amounts of just standard software vulnerabilities in those firmwares that have been found in the past, I presume there's plenty of low hanging fruit still to be found there. It doesn't really need to be an intentional backdoor, it can be just good old buffer overflow with remote execution.