3 ms·
OK, I admit: for WiFi it is not called "baseband", but something like "WiFi chip", but the functionality is the same (just for WiFi instead of, say, UMTS or LTE
by wolfgke 10y ago
OK, I admit: for WiFi it is not called "baseband", but something like "WiFi chip", but the functionality is the same (just for WiFi instead of, say, UMTS or LTE) - it also runs a hidden, probably bugged, firmware.
- walterbell 10y agoThanks. Do you recommend any references on the relative difficulty of attacking WiFi radios vs. cellular radios? E.g could any local wifi access point (including a compromised mobile hotspot) attack the wifi device with some kind of magic "packet"? Are there consumer ARM mobile devices with an IOMMU?
- wolfgke 10y ago> Do you recommend any references on the relative difficulty of attacking WiFi radios vs. cellular radios? Unluckily I can't give any recommendations, since I myself still have to read up a lot on the whole topic. :-(
- walterbell 10y agoThere was a 2014 thread on the Tor blog about Android security, where a commenter claimed that one of the Nexus phones had a baseband that was isolaed by a serial link, https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy#comment-55372 https://blog.torproject.org/blog/mission-impossible-hardenin... "Even isolated basebands often have a USB bridge (which can be exploited by pretending to be another type of device with a vulnerable USB driver) and direct access to the microphone ... iirc it's using a high-speed serial link, not USB. The microphone is connected to the audio codec, which is connected to the application processor. Uplink audio is sent from there to the baseband."