4 ms·

The team behind Replicant reported that they found a baseband backdoor in Samsung Galaxies[0][1]. I think it's perfectly fine to extrapolate from that that you

by chc4 11y ago

The team behind Replicant reported that they found a baseband backdoor in Samsung Galaxies[0][1]. I think it's perfectly fine to extrapolate from that that you probably shouldn't trust the baseband, even if Google and Apple are looking into it. Until they have a concrete solution shipped, all the in-the-closet work on the problem is meaningless. 0: https://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor https://www.fsf.org/blogs/community/replicant-developers-fin... 1: http://redmine.replicant.us/projects/replicant/wiki/SamsungGalaxyBackdoor http://redmine.replicant.us/projects/replicant/wiki/SamsungG...

tptacek 11y ago
I don't think you should trust the baseband. My objection is with the idea that you can look at a design, not see an IOMMU, and extrapolate from that the notion that the baseband has full access to the memory of the other chips in the design. That's a reasonable assumption in a PC design. There may have been a point, for some phones, where it was a valid assumption for phones. It's not with a modern phone design.
- jwise0 11y ago
  In my research on phones from the Unrevoked project (admittedly, 4+ years ago), this was the case: the baseband and the CPU shared the same memory. The baseband memory was carved out from the CPU such that the CPU could not access it, but the microcontrollers serving the baseband had CPU access, as I recall from the Qualcomm boot documentation: the chain of trust from CPU boot was established by the baseband processor, not the other way around. I would imagine that things have changed a little bit, but the baseband back then, and I imagine still now, is considered to be the ultimately trusted element of the system. I'd be surprised to hear that they've changed so much that the baseband doesn't still have full control over its host system.
  - BillinghamJ 11y ago
    Bear in mind that the baseband's host system doesn't necessarily need to be the same as the phone's core systems. You could just isolate the baseband and only communicate with it via a defined interface.
  - tptacek 11y ago
    The baseband doesn't have full control over phone systems.
    - throwaway7767 11y ago
      You should qualify which specific phone designs you are referring to (or if it's "all new phones", when the cutoff date was). After all, you are responding to someone who has researched this and found (like others) that indeed, the baseband in older phones did have full control. Your statement is general to the point of misinformation.
zanny 11y ago
This is why I wish Replicant was more successful. They mention a CM issue to fix it, and nobody did. As an owner of several Samsung devices, the fact there is a wholly proprietary processor in my phone with complete control of it makes me not treat it like a computer.

by chc4 11y ago

tptacek 11y ago

I don't think you should trust the baseband. My objection is with the idea that you can look at a design, not see an IOMMU, and extrapolate from that the notion that the baseband has full access to the memory of the other chips in the design. That's a reasonable assumption in a PC design. There may have been a point, for some phones, where it was a valid assumption for phones. It's not with a modern phone design.

jwise0 11y ago
In my research on phones from the Unrevoked project (admittedly, 4+ years ago), this was the case: the baseband and the CPU shared the same memory. The baseband memory was carved out from the CPU such that the CPU could not access it, but the microcontrollers serving the baseband had CPU access, as I recall from the Qualcomm boot documentation: the chain of trust from CPU boot was established by the baseband processor, not the other way around. I would imagine that things have changed a little bit, but the baseband back then, and I imagine still now, is considered to be the ultimately trusted element of the system. I'd be surprised to hear that they've changed so much that the baseband doesn't still have full control over its host system.
- BillinghamJ 11y ago
  Bear in mind that the baseband's host system doesn't necessarily need to be the same as the phone's core systems. You could just isolate the baseband and only communicate with it via a defined interface.
- tptacek 11y ago
  The baseband doesn't have full control over phone systems.
  - throwaway7767 11y ago
    You should qualify which specific phone designs you are referring to (or if it's "all new phones", when the cutoff date was). After all, you are responding to someone who has researched this and found (like others) that indeed, the baseband in older phones did have full control. Your statement is general to the point of misinformation.

zanny 11y ago

This is why I wish Replicant was more successful. They mention a CM issue to fix it, and nobody did. As an owner of several Samsung devices, the fact there is a wholly proprietary processor in my phone with complete control of it makes me not treat it like a computer.