3 ms·

> which removes the baseband firmware attack surface. If the baseband processor uses DMA and there exists no IOMMU that you can trust on the system, lots of ev

by wolfgke 10y ago

> which removes the baseband firmware attack surface. If the baseband processor uses DMA and there exists no IOMMU that you can trust on the system, lots of evil things are possible if you can control what is sent to the mobile phone OTA.

walterbell 10y ago
A wi-fi only device has no baseband processor. In lieu of an IOMMU, the baseband is delegated to a separate physical device, i.e. mobile hotspot. A wi-fi only device is not a mobile phone, but can provide most of the functionality of a mobile phone via OTT services and VPN to a separate mobile hotspot.
- wolfgke 10y ago
  OK, I admit: for WiFi it is not called "baseband", but something like "WiFi chip", but the functionality is the same (just for WiFi instead of, say, UMTS or LTE) - it also runs a hidden, probably bugged, firmware.
  - walterbell 10y ago
    Thanks. Do you recommend any references on the relative difficulty of attacking WiFi radios vs. cellular radios? E.g could any local wifi access point (including a compromised mobile hotspot) attack the wifi device with some kind of magic "packet"? Are there consumer ARM mobile devices with an IOMMU?
    - wolfgke 10y ago
      > Do you recommend any references on the relative difficulty of attacking WiFi radios vs. cellular radios? Unluckily I can't give any recommendations, since I myself still have to read up a lot on the whole topic. :-(
      - walterbell 10y ago
        There was a 2014 thread on the Tor blog about Android security, where a commenter claimed that one of the Nexus phones had a baseband that was isolaed by a serial link, https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy#comment-55372 https://blog.torproject.org/blog/mission-impossible-hardenin... "Even isolated basebands often have a USB bridge (which can be exploited by pretending to be another type of device with a vulnerable USB driver) and direct access to the microphone ... iirc it's using a high-speed serial link, not USB. The microphone is connected to the audio codec, which is connected to the application processor. Uplink audio is sent from there to the baseband."
- nickpsecurity 10y ago
  That's not necessarily true. Always remember that the hardware industry likes to consolidate multiple products into one for cost reduction where possible. This happens especially with embedded or mobile SOC's where a chip might have features usable in many applications at various price points. So, they make them pretend to be chips without the extra features via factory switches. As an example, a SOC for feature phones having both GSM and WiFi might be reused in a cheaper "wifi adapter" that still has GSM circuitry but not visibly. Whether if can be used against you depends on whether it's a hard or soft switch they used to disable/hide it plus whether it's reversible or one-time (eg antifuse).
  - walterbell 10y ago
    Wonderful. Now we need a teardown with chip identification before buying a device.
    - nickpsecurity 10y ago
      The proprietary companies already do this looking for hidden stuff. Mostly patent violations, though, so they can scheme some licensing revenue out of the product they're inspecting. Here's the company that does much of it: http://www.chipworks.com/about-chipworks/overview/blog/apple-iphone-7-teardown http://www.chipworks.com/about-chipworks/overview/blog/apple... In that one, you'll see the other end of the process where many mobile chips will get extremely specialized. Notice this one has several RF chips instead of an integrated one to attempt to hit some size/price/energy/performance tradeoff. Plus Apple sells premium stuff whether they can put in more, nicer parts. Notice there's 10 different chips involved in just the RF front-end part. :) Here's a nice PDF with illustrations of the RE processes themselves plus what things look like: https://www.iacr.org/archive/ches2009/57470361/57470361.pdf https://www.iacr.org/archive/ches2009/57470361/57470361.pdf I like Fig 3 especially as a lot of people forget there's circuitry inside their PCB's rather than just on top or bottom. That cell phone has 9 layers of wiring. :)
      - walterbell 10y ago
        Amazing RE paper, thanks.

by wolfgke 10y ago

walterbell 10y ago

A wi-fi only device has no baseband processor. In lieu of an IOMMU, the baseband is delegated to a separate physical device, i.e. mobile hotspot. A wi-fi only device is not a mobile phone, but can provide most of the functionality of a mobile phone via OTT services and VPN to a separate mobile hotspot.

wolfgke 10y ago
OK, I admit: for WiFi it is not called "baseband", but something like "WiFi chip", but the functionality is the same (just for WiFi instead of, say, UMTS or LTE) - it also runs a hidden, probably bugged, firmware.
- walterbell 10y ago
  Thanks. Do you recommend any references on the relative difficulty of attacking WiFi radios vs. cellular radios? E.g could any local wifi access point (including a compromised mobile hotspot) attack the wifi device with some kind of magic "packet"? Are there consumer ARM mobile devices with an IOMMU?
  - wolfgke 10y ago
    > Do you recommend any references on the relative difficulty of attacking WiFi radios vs. cellular radios? Unluckily I can't give any recommendations, since I myself still have to read up a lot on the whole topic. :-(
    - walterbell 10y ago
      There was a 2014 thread on the Tor blog about Android security, where a commenter claimed that one of the Nexus phones had a baseband that was isolaed by a serial link, https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy#comment-55372 https://blog.torproject.org/blog/mission-impossible-hardenin... "Even isolated basebands often have a USB bridge (which can be exploited by pretending to be another type of device with a vulnerable USB driver) and direct access to the microphone ... iirc it's using a high-speed serial link, not USB. The microphone is connected to the audio codec, which is connected to the application processor. Uplink audio is sent from there to the baseband."
nickpsecurity 10y ago
That's not necessarily true. Always remember that the hardware industry likes to consolidate multiple products into one for cost reduction where possible. This happens especially with embedded or mobile SOC's where a chip might have features usable in many applications at various price points. So, they make them pretend to be chips without the extra features via factory switches. As an example, a SOC for feature phones having both GSM and WiFi might be reused in a cheaper "wifi adapter" that still has GSM circuitry but not visibly. Whether if can be used against you depends on whether it's a hard or soft switch they used to disable/hide it plus whether it's reversible or one-time (eg antifuse).
- walterbell 10y ago
  Wonderful. Now we need a teardown with chip identification before buying a device.
  - nickpsecurity 10y ago
    The proprietary companies already do this looking for hidden stuff. Mostly patent violations, though, so they can scheme some licensing revenue out of the product they're inspecting. Here's the company that does much of it: http://www.chipworks.com/about-chipworks/overview/blog/apple-iphone-7-teardown http://www.chipworks.com/about-chipworks/overview/blog/apple... In that one, you'll see the other end of the process where many mobile chips will get extremely specialized. Notice this one has several RF chips instead of an integrated one to attempt to hit some size/price/energy/performance tradeoff. Plus Apple sells premium stuff whether they can put in more, nicer parts. Notice there's 10 different chips involved in just the RF front-end part. :) Here's a nice PDF with illustrations of the RE processes themselves plus what things look like: https://www.iacr.org/archive/ches2009/57470361/57470361.pdf https://www.iacr.org/archive/ches2009/57470361/57470361.pdf I like Fig 3 especially as a lot of people forget there's circuitry inside their PCB's rather than just on top or bottom. That cell phone has 9 layers of wiring. :)
    - walterbell 10y ago
      Amazing RE paper, thanks.