3 ms·
The baseband firmware almost certainly has backdoors exploitable by certain national intelligence agencies to listen in on you, selectively.
by garmaine 7y ago
The baseband firmware almost certainly has backdoors exploitable by certain national intelligence agencies to listen in on you, selectively.
- ncmncm 7y agoI know someone who worked at Qualcomm with access to that baseband code, who had a personal project to scan it for backdoors. He came up empty. So if they are there, they are subtle. At least in Qualcomm basebands. Exploits probably provide all the backdoors the spooks need.
- DoctorOetker 7y agowhy put it in baseband? does baseband have access to the raw audio buffers? just put it in ARM's secure world, that's what it's designed for...
- garmaine 7y agoBecause the baseband is opaque to the software running elsewhere on the phone, proprietary, and not visible to inspection by security researchers.
- ncmncm 7y agoBaseband processor has access to absolutely everything on all but Purism phones. Android is a guest OS.
- DoctorOetker 7y agoI always thought baseband referred to the processor and firmware/software that responsible for the radio modem? Do Android and baseband firmware run on one and the same processor(s)? Or are we calling ARM Secure World / TrustZone baseband these days?
- ncmncm 7y agoAndroid runs on a processor that operates, or not, at the pleasure of the baseband processor. The latter has complete access to all memory, and complete control over the Android's CPU cores. Android and the cores it runs on have no access to the baseband processor's memory, or any control over its execution.
- stordoff 7y agoTwo alternatives: * Firmware is patched after the fact either by inserting a backdoor into the build process, or binary patching the resulting firmware image. Such an operation is likely to be compartmentalised to avoid employees knowing about it. * Intelligence agencies seed online discussions with false assurances (note that I'm not suggesting any wrongdoing on your part - merely pointing out that an anonymous forum post is hardly verification that can be relied upon). That said, I do agree that exploits are likely sufficient, and that planting a mass backdoor is probably not worth the risk of it being detected.
- DoctorOetker 7y ago>planting a mass backdoor is probably not worth the risk of it being detected. everyone is ignoring what was pointed out by "kennywinker" https://news.ycombinator.com/item?id=20884384 https://news.ycombinator.com/item?id=20884384 the fact that both for android and for iphone seperately, there is a correlation with sound / silence and data usage, even if in the opposite sense. why did this not at least prompt the investigator to dig deeper?
- garmaine 7y agoI was in fact referring to exploits in my post. That's typically how NSA and GCHQ operate these days: either find exploits, or if a sufficient number can't be found, have some hard-to-detect exploits inserted into the code by operatives or as part of unrelated bug fixes. There's also hardware exploits. The firmware doesn't need to have a back door if a certain sequence of packets sent to the network controller will cause key memory to be overwritten and live patch in a backdoor.
- ncmncm 7y agoAgreed, hardware backdoors are very possible, but software is much cheaper to mess with. The spooks have in the past shown a preference for hardware jimmying, but those have been one-off cases. That said: monkey-patching is much more easily concealed than hardware or source-code changes, and is more in line with how US spooks have been seen to operate.