6 ms·

Who needs to break crypto when you have a baseband processor relay back location, audio and video? The problem with the potholes such as silent SMS are not tha

Who needs to break crypto when you have a baseband processor relay back location, audio and video? The problem with the potholes such as silent SMS are not that they exist, it's that baseband manufacturers have demonstrated unwillingness to address them. Alongside other readily addressable things such as IMSI catchers. It's cool we made the application processor secure, but it's pretty pointless when the 5G chip is in fact a hostile implant.

tptacek 8y ago
The baseband on an iPhone doesn't see the video or audio frames fed into Signal (or, for that matter, Skype and Hangouts). And the point of end-to-end encryption is not trusting the baseband to set up a secure channel.
- superkuh 8y ago
  Are you telling me the baseband on an iPhone doesn't have access to the system RAM?
  - tptacek 8y ago
    Yes. The baseband on an iPhone is effectively just a USB peripheral. Did you think Apple spent tens of millions of dollars designing a custom secure enclave processor running a separate operating system unrelated to iOS and just said "fuck it, give the whole system to the baseband vendor"?
    - mirimir 8y ago
      That's very good to know. Thanks! What's the status for Android devices? Is it true, as DCKing says, that the baseband radio doesn't have access in "common chipsets used in Android phones"?
      - chupasaurus 8y ago
        90+% are having cellular modem inside SoC, all the cheap ones do for sure.
  - pvg 8y ago
    From https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide.... "To protect the device from vulnerabilities in network processor firmware, network interfaces including Wi-Fi and baseband have limited access to application processor memory. When USB or SDIO is used to interface with the network processor, the network processor can’t initiate Direct Memory Access (DMA) transactions to the application processor. When PCIe is used, each network processor is on its own isolated PCIe bus. An IOMMU on each PCIe bus limits the network processor’s DMA access to pages of memory containing its network packets or control structures."
    - throwawaymath 8y ago
      For the curious: quoted section appears on page 41 of the linked PDF.
    - deleted 8y ago
      [deleted]
  - deleted 8y ago
    [deleted]
  - deleted 8y ago
    [deleted]
  - DCKing 8y ago
    It's still a common meme that on modern phones the baseband has full access to whatever it wants. The available evidence (which admittedly is very scant) and common sense suggests that this is not true, not in iPhones or common chipsets used in Android phones. It may have been true on older phones with simpler system architectures but you're really going to need some new evidence to show the meme still holds true.
    - pvg 8y ago
      available evidence (which admittedly is very scant) How do you figure? When Apple or Google say 'baseband is constrained from accessing OS memory in the following ways', these aren't unverifiable claims. People would be doing demos at conferences showing malicious basebands thieving your private catpictures.
      - TeMPOraL 8y ago
        Absence of evidence is only weak evidence of absence.
        tptacek 8y ago
        There are literally open source projects that talk to the baseband over HSIC on iPhones. This isn't a huge mystery.
    - mixmastamyk 8y ago
      > you're really going to need some new evidence to show the meme still holds true. Uhh no, that’s not how security assurances work.
      - DCKing 8y ago
        Only if you ignore the other part of my comment that circumstantial evidence of this more sensible system architecture does exist [1]. [1]: https://news.ycombinator.com/item?id=10907317 https://news.ycombinator.com/item?id=10907317
    - 8y ago
LeoPanthera 8y ago
> Who needs to break crypto when you have a baseband processor relay back location, audio and video? [Citation really needed]
- tivert 8y ago
  > Who needs to break crypto when you have a baseband processor relay back location, audio and video? Not exactly a citation for the exact claim, but several people in this thread make the assertion that Qualcomm processors have some kind of location tracking service running on them, running under a parallel OS: https://news.ycombinator.com/item?id=17081684 https://news.ycombinator.com/item?id=17081684 I think that's pretty close. The baseband processor is just one of the many hidden nooks that can run privacy-invading/security-breaking code outside of user view or control. Also, I think it stands to reason that the baseband processor has everything it needs to at least relay a rough location: the list of in-range towers ~= user location, and it has full control of a channel to relay that information.
mindslight 8y ago
Audio and camera don't inherently need to be hooked through the baseband. And without a serious redesign of the cell protocols, any use of the cell network spills your location. With the baseband and application processors being logically separate, strengthening the isolation between them is straightforward. For starters, you can use a phone with a discrete baseband chipset, like the Samsung Exynos lines. Or use a Wifi-only application computing device with a separate not-always-on Mifi for a data connection. If you want to be more paranoid, use an application processor with an Atheros chip and MMU, or a third device as a protocol converter to translates Wifi to RS-232. But the real point is that with IP-based protocols and Free software, you can unilaterally do any of the above without requiring your friends to also do so in lock step.
- subway 8y ago
  For folks who fall in the "more paranoid" category, and want a nice package: https://www.gl-inet.com/products/gl-mifi/ https://www.gl-inet.com/products/gl-mifi/ This little fella hangs an lte modem off a qca wisoc via usb (on a mini pcie slot). The stock modem is a little spotty, but is trivially replaced. They ship with a fork of OpenWRT, or you can use an official OpenWRT build on it. When I find a few free hours, I'm hoping to put together a set of Buildroot configs as well.

tptacek 8y ago

The baseband on an iPhone doesn't see the video or audio frames fed into Signal (or, for that matter, Skype and Hangouts). And the point of end-to-end encryption is not trusting the baseband to set up a secure channel.

superkuh 8y ago
Are you telling me the baseband on an iPhone doesn't have access to the system RAM?
- tptacek 8y ago
  Yes. The baseband on an iPhone is effectively just a USB peripheral. Did you think Apple spent tens of millions of dollars designing a custom secure enclave processor running a separate operating system unrelated to iOS and just said "fuck it, give the whole system to the baseband vendor"?
  - mirimir 8y ago
    That's very good to know. Thanks! What's the status for Android devices? Is it true, as DCKing says, that the baseband radio doesn't have access in "common chipsets used in Android phones"?
    - chupasaurus 8y ago
      90+% are having cellular modem inside SoC, all the cheap ones do for sure.
- pvg 8y ago
  From https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf https://www.apple.com/business/site/docs/iOS_Security_Guide.... "To protect the device from vulnerabilities in network processor firmware, network interfaces including Wi-Fi and baseband have limited access to application processor memory. When USB or SDIO is used to interface with the network processor, the network processor can’t initiate Direct Memory Access (DMA) transactions to the application processor. When PCIe is used, each network processor is on its own isolated PCIe bus. An IOMMU on each PCIe bus limits the network processor’s DMA access to pages of memory containing its network packets or control structures."
  - throwawaymath 8y ago
    For the curious: quoted section appears on page 41 of the linked PDF.
  - deleted 8y ago
    [deleted]
- deleted 8y ago
  [deleted]
- deleted 8y ago
  [deleted]
- DCKing 8y ago
  It's still a common meme that on modern phones the baseband has full access to whatever it wants. The available evidence (which admittedly is very scant) and common sense suggests that this is not true, not in iPhones or common chipsets used in Android phones. It may have been true on older phones with simpler system architectures but you're really going to need some new evidence to show the meme still holds true.
  - pvg 8y ago
    available evidence (which admittedly is very scant) How do you figure? When Apple or Google say 'baseband is constrained from accessing OS memory in the following ways', these aren't unverifiable claims. People would be doing demos at conferences showing malicious basebands thieving your private catpictures.
    - TeMPOraL 8y ago
      Absence of evidence is only weak evidence of absence.
      - tptacek 8y ago
        There are literally open source projects that talk to the baseband over HSIC on iPhones. This isn't a huge mystery.
  - mixmastamyk 8y ago
    > you're really going to need some new evidence to show the meme still holds true. Uhh no, that’s not how security assurances work.
    - DCKing 8y ago
      Only if you ignore the other part of my comment that circumstantial evidence of this more sensible system architecture does exist [1]. [1]: https://news.ycombinator.com/item?id=10907317 https://news.ycombinator.com/item?id=10907317
  - 8y ago

LeoPanthera 8y ago

> Who needs to break crypto when you have a baseband processor relay back location, audio and video? [Citation really needed]

tivert 8y ago
> Who needs to break crypto when you have a baseband processor relay back location, audio and video? Not exactly a citation for the exact claim, but several people in this thread make the assertion that Qualcomm processors have some kind of location tracking service running on them, running under a parallel OS: https://news.ycombinator.com/item?id=17081684 https://news.ycombinator.com/item?id=17081684 I think that's pretty close. The baseband processor is just one of the many hidden nooks that can run privacy-invading/security-breaking code outside of user view or control. Also, I think it stands to reason that the baseband processor has everything it needs to at least relay a rough location: the list of in-range towers ~= user location, and it has full control of a channel to relay that information.

mindslight 8y ago

Audio and camera don't inherently need to be hooked through the baseband. And without a serious redesign of the cell protocols, any use of the cell network spills your location. With the baseband and application processors being logically separate, strengthening the isolation between them is straightforward. For starters, you can use a phone with a discrete baseband chipset, like the Samsung Exynos lines. Or use a Wifi-only application computing device with a separate not-always-on Mifi for a data connection. If you want to be more paranoid, use an application processor with an Atheros chip and MMU, or a third device as a protocol converter to translates Wifi to RS-232. But the real point is that with IP-based protocols and Free software, you can unilaterally do any of the above without requiring your friends to also do so in lock step.

subway 8y ago
For folks who fall in the "more paranoid" category, and want a nice package: https://www.gl-inet.com/products/gl-mifi/ https://www.gl-inet.com/products/gl-mifi/ This little fella hangs an lte modem off a qca wisoc via usb (on a mini pcie slot). The stock modem is a little spotty, but is trivially replaced. They ship with a fork of OpenWRT, or you can use an official OpenWRT build on it. When I find a few free hours, I'm hoping to put together a set of Buildroot configs as well.