5 ms·
Yeah, this is at most just kind of geeky interesting. But otherwise it has no particular meaning whatsoever, particularly in an iPhone. Apple is one the few/onl
by xoa 8y ago
Yeah, this is at most just kind of geeky interesting. But otherwise it has no particular meaning whatsoever, particularly in an iPhone. Apple is one the few/only (I think Pixel too maybe? tptacek or other security folks would be up to date) phones to totally isolate the baseband, essentially treating it like a USB peripheral. Whether it uses USB or SDIO or PCIe it has no DMA to the application processor (Apple uses an IOMMU, all discusses in their iOS Security Guide) so while a hack of it I guess could still be irritating purely in terms of messing with cellular access, simple location privacy, or the wider network perhaps, it's not going to inherently leverage into access to the system. Baseband has its own secure bootchain of course as well.
Additionally given that this is a very low power low level embedded system device for a specific function it seems most likely that it's also, like Intel's old Atom chips, a refined derivative of older simpler x86 chips with in-order execution, no speculative execution, no µop transforms or other stuff like that. Would be kind of interesting to learn some of the details, but at any rate that means whole classes of security issues people are already bringing up in this thread (like Spectre/Meltdown) are entirely irrelevant. If some arch simply lacks speculative hardware period then that's that. Simplicity in general can have major performance impacts sure, but it's also lower energy and more secure.
- mehrdadn 8y agoIs using an IOMMU with a USB peripheral really enough? If my PC satisfies those and I plug in a random USB device am I safe?
- jrockway 8y agoThe drivers on your PC are the issue. The USB controller isn't going to let a USB device directly access memory, at least from my understanding of the spec.
- _emacsomancer_ 8y agoI believe USB presents a much smaller attack surface since it has no direct memory access, apparently in contrast to SATA.
- monocasa 8y agoSATA doesn't allow for DMA from the target device. SATA controllers can DMA, but that's not different from how NICs and USB controllers typically typically DMA. The target addresses are ultimately controlled by the device on the host side. Like USB it feels more like a traditional network protocol than a traditional bus protocol. PCI-E does DMA, and AFAIU was inspired by Infiniband (another RDMA protocol).
- _emacsomancer_ 8y agoMy understanding is that it was easier for SATA controllers to do DMA than it was for USB controllers, but I have a fairly limited understanding.
- monocasa 8y agoYou don't need a IOMMU with USB. USB isn't an RDMA protocol like firewire and PCI-E, so an IOMMU doesn't really even make sense in that context. But no, you're not safe because crappy USB drivers can probably be exploited if they're expecting the USB device to be playing nice.
- tptacek 8y agoYou're not necessarily safe, but obviously no matter how isolated you make the cell baseband, you can't get past "crappy glue code can still bone you". The reality is that the HSIC interface between the AP and the baseband is --- conceptually, at least --- about the best you can possibly do.
- monocasa 8y agoSure, I was mainly addressing "If my PC satisfies those and I plug in a random USB device am I safe?" rather than the constrained case of a known baseband and single driver.
- bri3d 8y agoThe basic USB protocol does not allow for direct peripheral mastering of DMA (unlike IEEE 1394 or PCIe for example). So, barring a protocol exploit in the USB host controller, which is certainly a theoretical possibility given the enormous size of the specification, fencing off the USB host controller using the IOMMU is just an additional layer of protection, rather than a necessary boundary like it is for a PCIe or 1394 device which has access to memory natively. A USB-C/USB3 physical port makes things a bit more complicated, as it also could be attached to a controller supporting Thunderbolt, which is PCIe. The unsafe part of plugging in a USB device is probably at the OS level rather than the protocol level - in my opinion you're much more likely to be owned by something like connecting a device with a buggy or compromised driver, mounting a filesystem containing an FS exploit, or reading a file containing an application exploit than by a USB-level protocol exploit.
- 8y ago
- Buge 8y agoYou're not safe plugging a random USB into your computer. It can pretend to be a keyboard and install malware.
- foobarian 8y agoIntel making the baseband instead of Qualcomm?? That seems like a huge deal to me.
- jsjohnst 8y agoThat’s old news mostly. Intel has been making iPhone basebands for several generations, the new news is its exclusively Intel. Given Qualcomm and Apple’s very public fights, not surprising, but I’m curious how Intel overcame Qualcomm‘s patents on CDMA. Did they expire? Did Intel somehow get a license? I’m definitely curious and will post back with what I find assuming someone else doesn’t first. Edit: Guess Intel got the CDMA assets via its purchase of VIA Telecom assets in 2015. Wonder why it’s taken this long to come to market?