4 ms·

It isn't plausible that the baseband is routinely incorporating backdoors. However it is very plausible that nation states do lots of testing of baseband firmwa

It isn't plausible that the baseband is routinely incorporating backdoors. However it is very plausible that nation states do lots of testing of baseband firmware, with an eye towards exploiting it. If baseband protocols were as easy to test as wifi we would probably see more vuln reports about them. It is unlikely that they would be able to remotely update the baseband firmware though, especially on an iPhone. Also, an increasing number of baseband systems use highly verified kernels, such as sel4. As to phones in flight mode routinely pinging, this is incorrect. It would easily be detected by standard tools and counter-surveillance equipment. It isn't plausible that a modern phone would interfere with a modern jet IMO, but I still turn it to flight mode. Doesn't mean a passenger couldn't cause problems if they wanted too though -- turn on a GPS jammer and ADS-B/mode-S spoofer while onboard and watch everything go kooky. A more realistic security problem is that of phones listening to wifi when turned off for geolocation purposes. Just the listening is exposing the stack to some degree.

beagle3 7y ago
> It isn't plausible that the baseband is routinely incorporating backdoors. Intel and AMD effectively incorporate a back door into every processor, one that they refuse to document or give the keys for (but which likely some government agencies have, whether provided willingly or not). Why is it implausible that basebands incorporate something similar?
- angry_octet 7y ago
  Features like Intel ME were actually requested by major IHVs, like Dell/HP etc. VISA is a debug system you need ring 0 access to use. In contrast, Qualcomm/Intel clients like Apple are very concerned to not have magic backdoors (Apple bought Intel's bandband IP and team recently, supposedly to make their own 5G chip). In any case, there are plenty of garden variety vulnerabilities in bandband chips, no need for NSA voodoo.
  - beagle3 7y ago
    Yes, some users find them somewhat useful. That does not explain the complete lack of documentation, access keys, and the inability to turn it off under any circumstances. It is possible that this is not and has not been used as a back door. But why is that so implausible?
    - angry_octet 7y ago
      Intel ME could have been used as a backdoor in a circumstance where they knew it wouldn't be analyzed, but that is a small percentage of jobs. Really only when you know a JDAM is coming through the roof soon after, or it's a no fail type of mission, i.e. taking over NK ground control during a missile launch. It isn't going to be wasted trying to hack the Kremlin, where everything gets logged. For baseband chips, I haven't heard of Qualcomm having these types of interfaces at all. Fleet management happens via MDM at the iOS/Android level. I don't think NSA would be able to coerce Qualcomm to introduce a huge feature like ME in secret, and besides that isn't their MO, there would be a standards process etc. I really don't think something like that could be kept completely under wraps, and then as soon as you used it once it would be burnt. Chinese chipsets not so sure. So far Huawei has so many bugs in everything they have implausible deniability. Like dozens of level 10, full RCE exploits. That's a good reason to ban them.

beagle3 7y ago

> It isn't plausible that the baseband is routinely incorporating backdoors. Intel and AMD effectively incorporate a back door into every processor, one that they refuse to document or give the keys for (but which likely some government agencies have, whether provided willingly or not). Why is it implausible that basebands incorporate something similar?

angry_octet 7y ago
Features like Intel ME were actually requested by major IHVs, like Dell/HP etc. VISA is a debug system you need ring 0 access to use. In contrast, Qualcomm/Intel clients like Apple are very concerned to not have magic backdoors (Apple bought Intel's bandband IP and team recently, supposedly to make their own 5G chip). In any case, there are plenty of garden variety vulnerabilities in bandband chips, no need for NSA voodoo.
- beagle3 7y ago
  Yes, some users find them somewhat useful. That does not explain the complete lack of documentation, access keys, and the inability to turn it off under any circumstances. It is possible that this is not and has not been used as a back door. But why is that so implausible?
  - angry_octet 7y ago
    Intel ME could have been used as a backdoor in a circumstance where they knew it wouldn't be analyzed, but that is a small percentage of jobs. Really only when you know a JDAM is coming through the roof soon after, or it's a no fail type of mission, i.e. taking over NK ground control during a missile launch. It isn't going to be wasted trying to hack the Kremlin, where everything gets logged. For baseband chips, I haven't heard of Qualcomm having these types of interfaces at all. Fleet management happens via MDM at the iOS/Android level. I don't think NSA would be able to coerce Qualcomm to introduce a huge feature like ME in secret, and besides that isn't their MO, there would be a standards process etc. I really don't think something like that could be kept completely under wraps, and then as soon as you used it once it would be burnt. Chinese chipsets not so sure. So far Huawei has so many bugs in everything they have implausible deniability. Like dozens of level 10, full RCE exploits. That's a good reason to ban them.