6 ms·

some of crapware can be avoided by using custom ROMs, but not all of it. For example: Qualcomm IZat location services and other location-based trustzone applets

some of crapware can be avoided by using custom ROMs, but not all of it. For example: Qualcomm IZat location services and other location-based trustzone applets remain running even on custom ROMs.

random6547545 8y ago
Hopefully this shows people how deep it is.
- mickael-kerjean 8y ago
  If all that is claim in here isn't conspiracy, how can it stay a secret? Isn't it the reason wikileaks was created in the first place?
  - Filligree 8y ago
    How is it a secret? We're talking about it right now.
    - Romanulus 8y ago
      https://www.youtube.com/watch?v=hf5FRPfGiC8 https://www.youtube.com/watch?v=hf5FRPfGiC8
  - godelski 8y ago
    I think the issue is that most people end up just thinking "so what? What can they do with it?" and only think "I'm not doing anything wrong" (hate that phrase and origin). The consequences of this type of thing may be apparent to tech people, but not most of the public.
  - com2kid 8y ago
    It isn't a conspiracy, it is just unnoticed, I'd argue due to news fatigue. Heck, it has a hompage. https://www.trustonic.com/solutions/trustonic-secured-platforms-tsp/ https://www.trustonic.com/solutions/trustonic-secured-platfo...
gruez 8y ago
>Qualcomm IZat location services did a quick check, it's not on my phone (SD 820 SoC). >other location-based trustzone applets remain running even on custom ROMs. I have no doubt some proprietary blobs still remain on custom ROMs, but do those actually send back location data to the OEM?
- tgb 8y ago
  > did a quick check How? Thanks.
  - gruez 8y ago
    searched up the package name, and according to https://forum.xda-developers.com/android/software-hacking/aroma-qualcomm-debloater-t3673261 https://forum.xda-developers.com/android/software-hacking/ar..., it's installed at /system/priv-app/xtra_t_app, which was not on my phone. Also noticed that most posts had mentions of IZat in their location settings, which my phone did not have (in lineageos or stock)
    - dude123456 8y ago
      You're looking in the wrong place. TrustZone OS is started during SBL2 (secureboot level 2), running in hypervisor mode, while you're looking at the Android OS started during SBL3 (secureboot level 3). You cannot see hypervisor processes & apps from your vantage point (the android kernel). The trustzone OS is usually located in TZ partition, and it uses some additional partitions for custom TZ apps and data persistence. The hypervisor has independent access to the internet, the wifi card (for indoor location), and more. Qualcom boot process, showing SBL1, SBL2 and SBL3 stages: https://forum.xda-developers.com/showthread.php?t=1769411&page=25 https://forum.xda-developers.com/showthread.php?t=1769411&pa... It goes without saying that without TrustZone OS, the phone won't boot to Android OS (won't proceed to SBL3).
    - newnewpdro 8y ago
      You don't seem to appreciate the fact that the OS you interact with on a modern smartphone is essentially a guest. There's a world of proprietary complexity you have zero visibility into, and much of it is running with direct access to hardware the application OS you interact with can only partially make use of.
Illniyar 8y ago
How is it sending the data though? if it's using mobile plans, wouldn't it be noticeable on the data usage plan? (or is it that manufacturers have agreements with carriers to not charge for it?)
- mehrdadn 8y ago
  This is my question too... nobody has explained this part.
- striking 8y ago
  > IZat location technologies use a network of cloud-based assistance servers that provide industry-leading location performance for any mobile device, on any network, in any environment. https://www.qualcomm.com/products/izat https://www.qualcomm.com/products/izat
- gowld 8y ago
  Location data is what, maybe 1kB per sample, including lots of overhead? 100 samples/day is 3MB/month. It's not going to affect your mobile data budget.
  - pbasista 8y ago
    Some people do not have a mobile data plan. Using mobile data in such case would typically be rather expensive. Unexplained mobile data charges, however small, would raise questions.
    - yyx 8y ago
      Can confirm. Chinaphone used mobile internet every day sending bytes. Tried using firewall, then butchered settings altogether.
userbinator 8y ago
You seem to be quite familiar with Qualcomm, but do you know if there's anything similar in Mediatek SoCs? They do have assisted GPS ("A-GPS"/"EPO") but from the info I can find (including leaked very thorough datasheets and programming manuals), it does nothing more than downloading already-public ephemeris data from an FTP server periodically. I've also inspected the firmware, and there doesn't appear to be any traces of the TrustZone/Trustonic stuff that you mention is present for Qualcomm; AFAICS the only thing running on the main CPU cores is Android itself, the modem runs its own baseband firmware, and the GPS/WiFi/BT/FM combo chip (which is a physically separate part, accessed over a serial interface with no direct DMA capabilities) runs a third firmware. Any "secure boot" features in MTK SoCs are (fortunately?) not very secure, so it's all quite easy to inspect. There's some bits of interesting info here: https://github.com/cyrozap/mediatek-lte-baseband-re https://github.com/cyrozap/mediatek-lte-baseband-re https://postmarketos.org/blog/2018/04/14/lowlevel/ https://postmarketos.org/blog/2018/04/14/lowlevel/

some of crapware can be avoided by using custom ROMs, but not all of it. For example: Qualcomm IZat location services and other location-based trustzone applets remain running even on custom ROMs.

random6547545 8y ago

Hopefully this shows people how deep it is.

mickael-kerjean 8y ago
If all that is claim in here isn't conspiracy, how can it stay a secret? Isn't it the reason wikileaks was created in the first place?
- Filligree 8y ago
  How is it a secret? We're talking about it right now.
  - Romanulus 8y ago
    https://www.youtube.com/watch?v=hf5FRPfGiC8 https://www.youtube.com/watch?v=hf5FRPfGiC8
- godelski 8y ago
  I think the issue is that most people end up just thinking "so what? What can they do with it?" and only think "I'm not doing anything wrong" (hate that phrase and origin). The consequences of this type of thing may be apparent to tech people, but not most of the public.
- com2kid 8y ago
  It isn't a conspiracy, it is just unnoticed, I'd argue due to news fatigue. Heck, it has a hompage. https://www.trustonic.com/solutions/trustonic-secured-platforms-tsp/ https://www.trustonic.com/solutions/trustonic-secured-platfo...

gruez 8y ago

>Qualcomm IZat location services did a quick check, it's not on my phone (SD 820 SoC). >other location-based trustzone applets remain running even on custom ROMs. I have no doubt some proprietary blobs still remain on custom ROMs, but do those actually send back location data to the OEM?

tgb 8y ago
> did a quick check How? Thanks.
- gruez 8y ago
  searched up the package name, and according to https://forum.xda-developers.com/android/software-hacking/aroma-qualcomm-debloater-t3673261 https://forum.xda-developers.com/android/software-hacking/ar..., it's installed at /system/priv-app/xtra_t_app, which was not on my phone. Also noticed that most posts had mentions of IZat in their location settings, which my phone did not have (in lineageos or stock)
  - dude123456 8y ago
    You're looking in the wrong place. TrustZone OS is started during SBL2 (secureboot level 2), running in hypervisor mode, while you're looking at the Android OS started during SBL3 (secureboot level 3). You cannot see hypervisor processes & apps from your vantage point (the android kernel). The trustzone OS is usually located in TZ partition, and it uses some additional partitions for custom TZ apps and data persistence. The hypervisor has independent access to the internet, the wifi card (for indoor location), and more. Qualcom boot process, showing SBL1, SBL2 and SBL3 stages: https://forum.xda-developers.com/showthread.php?t=1769411&page=25 https://forum.xda-developers.com/showthread.php?t=1769411&pa... It goes without saying that without TrustZone OS, the phone won't boot to Android OS (won't proceed to SBL3).
  - newnewpdro 8y ago
    You don't seem to appreciate the fact that the OS you interact with on a modern smartphone is essentially a guest. There's a world of proprietary complexity you have zero visibility into, and much of it is running with direct access to hardware the application OS you interact with can only partially make use of.

Illniyar 8y ago

How is it sending the data though? if it's using mobile plans, wouldn't it be noticeable on the data usage plan? (or is it that manufacturers have agreements with carriers to not charge for it?)

mehrdadn 8y ago
This is my question too... nobody has explained this part.
striking 8y ago
> IZat location technologies use a network of cloud-based assistance servers that provide industry-leading location performance for any mobile device, on any network, in any environment. https://www.qualcomm.com/products/izat https://www.qualcomm.com/products/izat
gowld 8y ago
Location data is what, maybe 1kB per sample, including lots of overhead? 100 samples/day is 3MB/month. It's not going to affect your mobile data budget.
- pbasista 8y ago
  Some people do not have a mobile data plan. Using mobile data in such case would typically be rather expensive. Unexplained mobile data charges, however small, would raise questions.
  - yyx 8y ago
    Can confirm. Chinaphone used mobile internet every day sending bytes. Tried using firewall, then butchered settings altogether.

userbinator 8y ago

You seem to be quite familiar with Qualcomm, but do you know if there's anything similar in Mediatek SoCs? They do have assisted GPS ("A-GPS"/"EPO") but from the info I can find (including leaked very thorough datasheets and programming manuals), it does nothing more than downloading already-public ephemeris data from an FTP server periodically. I've also inspected the firmware, and there doesn't appear to be any traces of the TrustZone/Trustonic stuff that you mention is present for Qualcomm; AFAICS the only thing running on the main CPU cores is Android itself, the modem runs its own baseband firmware, and the GPS/WiFi/BT/FM combo chip (which is a physically separate part, accessed over a serial interface with no direct DMA capabilities) runs a third firmware. Any "secure boot" features in MTK SoCs are (fortunately?) not very secure, so it's all quite easy to inspect. There's some bits of interesting info here: https://github.com/cyrozap/mediatek-lte-baseband-re https://github.com/cyrozap/mediatek-lte-baseband-re https://postmarketos.org/blog/2018/04/14/lowlevel/ https://postmarketos.org/blog/2018/04/14/lowlevel/