5 ms·

Personally I consider this to be all phones: the baseband firmware is a blob that does who knows what, and is likely the weakest component of nearly every phone

by xfitm3 7y ago

Personally I consider this to be all phones: the baseband firmware is a blob that does who knows what, and is likely the weakest component of nearly every phone on the market. Most baseband processors are connected via DMA. Prior discussion from 2016: https://news.ycombinator.com/item?id=10905643 https://news.ycombinator.com/item?id=10905643

mirimir 7y ago
I'm reminded of the 90s joke about Windows PCs being pwned within minutes after going online. That is, going online directly via dial-up modem, rather than through a router. So yeah, the baseband firmware is a huge vulnerability. But if you use a separate modem/router, and disable the onboard baseband, that's far less of an issue. And with the PinePhone, it's easy: https://wiki.pine64.org/index.php/PinePhone#Killswitch_configuration https://wiki.pine64.org/index.php/PinePhone#Killswitch_confi...
- teruakohatu 7y ago
  It was not a joke. I once saw a new WinXP install get hacked soon after being plugin into a modem. The Register reported the avaerge time to infection was 20 minutes. https://www.theregister.co.uk/2004/08/19/infected_in20_minutes/ https://www.theregister.co.uk/2004/08/19/infected_in20_minut...
  - mirimir 7y ago
    OK, I guess that "joke" was a poor choice. More like "wry observation".
    - DaiPlusPlus 7y ago
      No worries - Until SP2, Windows XP’s security was very much a joke :)
  - Gibbon1 7y ago
    Back around 2000 I tried restoring Windows from the original CD and the thing would get hacked before it could install it's updates. Eventually punted and bought a hard drive with Windows pre-installed.
  - userbinator 7y ago
    These days almost everyone is behind a NAT, which effectively defeats all the scanners trying to exploit Internet-listening services (and XP comes with an unfortunately large number of them in a default install.)
    - mirimir 7y ago
      Except for almost all people using smartphones ;)
      - DaiPlusPlus 7y ago
        All modern smartphones came out after XP SP2 so the industry knew the problems with exposed ports - I don’t believe any shipping smartphone in the US today comes with any processes with open listening ports by default (even carrier bundleware) - please correct me if I’m wrong. That said - because of the sheer number of phones in existence, on IPv4 you’re guaranteed to be running behind a giant NAT operated by your network carrier - and on IPv6 the address space is too big to port-scan (at least) but while it’s no help if attackers know your address - I understand there’s still a mix of carrier-based and handset-based network lockdown going on.
        mirimir 7y ago
        Sure, industry learned that exposing ports is dangerous. But they apparently didn't understand the deeper risk of trusting the network. Cellular baseband is poorly secured, and it's privileged over userland. And its firmware is a closed-source blob, so it's ~impossible to fully assess the risks. And so it's arguable that adversaries can pwn smartphones through baseband. That's the analogy to Windows XP machines. Windows Firewall was just a stopgap. What helped most was going from dial-up modems, which are no more secure than network interfaces, to modem/routers with NAT firewalls. So smartphones ought to have discrete cellular modem/routers. And that's an easy option for the PinePhone, given the kill switch.
      - xfitm3 7y ago
        Many mobile devices (especially those connected to a MVNO) are on one big giant subnet with "L2" style connectivity to each other. This is how Charlie Miller and Chris Valasek were able to remotely compromise vehicles with a vulnerable infotainment system via a pwned femtocell. "To find vulnerable vehicles you just need to scan on port 6667 from a Sprint device on the IP addresses 21.0.0.0/8 and 25.0.0.0/8."[0] [0] http://illmatics.com/Remote%20Car%20Hacking.pdf http://illmatics.com/Remote%20Car%20Hacking.pdf, pdf page 46.
danielheath 7y ago
No iphone currently sold is connected to its modem via DMA. They've all got some type of iommu. Given that most traffic is encrypted (eg any major website via https, or mail provider with smtp-over-tls, or most apps via https), a baseband vulnerability isn't a great deal of help without an iommu bypass (AFAIK only one has ever been publicly disclosed for ios, and it took the researchers over 6 months). IIRC correctly (from a few years back) the pixel phones also have one, but most Samsung phones did not.
- deogeo 7y ago
  I've found that information on which phones have a directly connected baseband is incredibly hard to come by.

by xfitm3 7y ago

mirimir 7y ago

I'm reminded of the 90s joke about Windows PCs being pwned within minutes after going online. That is, going online directly via dial-up modem, rather than through a router. So yeah, the baseband firmware is a huge vulnerability. But if you use a separate modem/router, and disable the onboard baseband, that's far less of an issue. And with the PinePhone, it's easy: https://wiki.pine64.org/index.php/PinePhone#Killswitch_configuration https://wiki.pine64.org/index.php/PinePhone#Killswitch_confi...

teruakohatu 7y ago
It was not a joke. I once saw a new WinXP install get hacked soon after being plugin into a modem. The Register reported the avaerge time to infection was 20 minutes. https://www.theregister.co.uk/2004/08/19/infected_in20_minutes/ https://www.theregister.co.uk/2004/08/19/infected_in20_minut...
- mirimir 7y ago
  OK, I guess that "joke" was a poor choice. More like "wry observation".
  - DaiPlusPlus 7y ago
    No worries - Until SP2, Windows XP’s security was very much a joke :)
- Gibbon1 7y ago
  Back around 2000 I tried restoring Windows from the original CD and the thing would get hacked before it could install it's updates. Eventually punted and bought a hard drive with Windows pre-installed.
- userbinator 7y ago
  These days almost everyone is behind a NAT, which effectively defeats all the scanners trying to exploit Internet-listening services (and XP comes with an unfortunately large number of them in a default install.)
  - mirimir 7y ago
    Except for almost all people using smartphones ;)
    - DaiPlusPlus 7y ago
      All modern smartphones came out after XP SP2 so the industry knew the problems with exposed ports - I don’t believe any shipping smartphone in the US today comes with any processes with open listening ports by default (even carrier bundleware) - please correct me if I’m wrong. That said - because of the sheer number of phones in existence, on IPv4 you’re guaranteed to be running behind a giant NAT operated by your network carrier - and on IPv6 the address space is too big to port-scan (at least) but while it’s no help if attackers know your address - I understand there’s still a mix of carrier-based and handset-based network lockdown going on.
      - mirimir 7y ago
        Sure, industry learned that exposing ports is dangerous. But they apparently didn't understand the deeper risk of trusting the network. Cellular baseband is poorly secured, and it's privileged over userland. And its firmware is a closed-source blob, so it's ~impossible to fully assess the risks. And so it's arguable that adversaries can pwn smartphones through baseband. That's the analogy to Windows XP machines. Windows Firewall was just a stopgap. What helped most was going from dial-up modems, which are no more secure than network interfaces, to modem/routers with NAT firewalls. So smartphones ought to have discrete cellular modem/routers. And that's an easy option for the PinePhone, given the kill switch.
    - xfitm3 7y ago
      Many mobile devices (especially those connected to a MVNO) are on one big giant subnet with "L2" style connectivity to each other. This is how Charlie Miller and Chris Valasek were able to remotely compromise vehicles with a vulnerable infotainment system via a pwned femtocell. "To find vulnerable vehicles you just need to scan on port 6667 from a Sprint device on the IP addresses 21.0.0.0/8 and 25.0.0.0/8."[0] [0] http://illmatics.com/Remote%20Car%20Hacking.pdf http://illmatics.com/Remote%20Car%20Hacking.pdf, pdf page 46.

danielheath 7y ago

No iphone currently sold is connected to its modem via DMA. They've all got some type of iommu. Given that most traffic is encrypted (eg any major website via https, or mail provider with smtp-over-tls, or most apps via https), a baseband vulnerability isn't a great deal of help without an iommu bypass (AFAIK only one has ever been publicly disclosed for ios, and it took the researchers over 6 months). IIRC correctly (from a few years back) the pixel phones also have one, but most Samsung phones did not.

deogeo 7y ago
I've found that information on which phones have a directly connected baseband is incredibly hard to come by.