3 ms·

They would likely compromise the device via its baseband, and patch the operating system to give the illusion of a complete shutdown when the user attempts to p

They would likely compromise the device via its baseband, and patch the operating system to give the illusion of a complete shutdown when the user attempts to power it off.

Analemma_ 7y ago
"The baseband has DMA access and so can get root at any time" is a myth that won't seem to go away no matter how many times security professionals refute it. On iPhones and all but maybe the cheapest Android phones, the baseband is exposed to the CPU as a USB device, with all the usual memory protections. You cannot patch the device over the baseband (unless there's an existing vulnerability in the USB stack or something).
- wahern 7y ago
  USB device drivers are for sure bullet-proof, just like the baseband controllers are bullet-proof.... Jumping from one exploit target to another in a chain is pretty much how all modern exploits work. To say that because they would need to find an exploit in the USB driver (or some other hardware or software interface), not only states the obvious, but more importantly misses the point: it's far more plausible than most engineers intuitively believe. The depth of modern exploit chains is incredible, and while the conceptual difficulty has gone up the pace hasn't seemed to abate, which is clear evidence that our intuition about "too difficult" and about the elasticity of the exploit supply and demand curves is woefully inadequate to accurately gauge risk. Part of the problem is that the complexity of the systems grows at the same time as improvements in security and correctness. Sometimes it grows faster, sometimes slower, but it's dynamic.
- ptx 7y ago
  Do you have links to any of the refutations? I recall hearing that the iPhone separates the baseband, but I thought it was otherwise usually on the same chip.
- fulafel 7y ago
  Cursory web searches seem to point away from the USB device theory. Usually the modem is integrated on the main SoC. You can't find mentions of USB associated with the recent Qualcomm onchip modems, for example.

They would likely compromise the device via its baseband, and patch the operating system to give the illusion of a complete shutdown when the user attempts to power it off.

Analemma_ 7y ago

"The baseband has DMA access and so can get root at any time" is a myth that won't seem to go away no matter how many times security professionals refute it. On iPhones and all but maybe the cheapest Android phones, the baseband is exposed to the CPU as a USB device, with all the usual memory protections. You cannot patch the device over the baseband (unless there's an existing vulnerability in the USB stack or something).

wahern 7y ago
USB device drivers are for sure bullet-proof, just like the baseband controllers are bullet-proof.... Jumping from one exploit target to another in a chain is pretty much how all modern exploits work. To say that because they would need to find an exploit in the USB driver (or some other hardware or software interface), not only states the obvious, but more importantly misses the point: it's far more plausible than most engineers intuitively believe. The depth of modern exploit chains is incredible, and while the conceptual difficulty has gone up the pace hasn't seemed to abate, which is clear evidence that our intuition about "too difficult" and about the elasticity of the exploit supply and demand curves is woefully inadequate to accurately gauge risk. Part of the problem is that the complexity of the systems grows at the same time as improvements in security and correctness. Sometimes it grows faster, sometimes slower, but it's dynamic.
ptx 7y ago
Do you have links to any of the refutations? I recall hearing that the iPhone separates the baseband, but I thought it was otherwise usually on the same chip.
fulafel 7y ago
Cursory web searches seem to point away from the USB device theory. Usually the modem is integrated on the main SoC. You can't find mentions of USB associated with the recent Qualcomm onchip modems, for example.