3 ms·

Your cellular phone modem is both remotely programmable and has full root memory access 24/7. Let that sink in a bit.

tptacek 7y ago
Your "cellular phone" does not in fact have "full root memory access 24/7". In modern phone designs, the baseband is a USB peripheral. The notion that the closed, secret baseband is a DMA backdoor into AP memory is a message board meme, not engineering reality.
- hjkgfdfgh 7y ago
  That may be true of Apple, and is true of the PinePhone and Librem, but for the majority of Android devices, that's blatantly false. On Qualcomm chipsets in particular heavily utilize shared memory for baseband to application processor communication.
  - tptacek 7y ago
    "The majority of Android devices" is a very wide net to cast.
    - hjkgfdfgh 7y ago
      Qualcomm alone covers 40%, and they're arguably the most likely to correctly implement their MMU (nevermind they've seen quite a few vulnerabilities in their MMU implementations over the years..) Meditek uses a similar architecture, and I sure as hell don't trust their MMU. Outside of Apple, Librem and Pine are just about the only way you're getting a USB attached baseband. edit - Here's a Mediatek Baseband->AP PoC even: https://comsecuris.com/blog/posts/path_of_least_resistance/ https://comsecuris.com/blog/posts/path_of_least_resistance/
      - weeks 7y ago
        https://googleprojectzero.blogspot.com/2017/10/over-air-vol-2-pt-3-exploiting-wi-fi.html https://googleprojectzero.blogspot.com/2017/10/over-air-vol-... Even Apple's IOMMU has had vulnerabilities allowing for full memory access from the WiFi modem.
        tptacek 7y ago
        The wifi stack isn't the cellular modem. There's a reason people are particularly concerned about the baseband.
      - mirimir 7y ago
        Right. and even better, move the baseband to a USB-tethered device.
      - tptacek 7y ago
        The HTC One M9+, you say.
        hjkgfdfgh 7y ago
        Where are you trying to go with this? You start off trying to claim the entire class of vulnerability isn't possible because a few vendors made sane architectural decisions. When it's pointed out those sane vendors are in the minority, and there are real world examples of the terrible shared memory architecture being exploited, you scoff at the example being for a single device. Nobody is claiming baseband == root, only that the terrible architecture prevalent in Android phones (the devices that make up the majority of the market) combined with the terrible software practices of SoC vendors results in a situation far more likely to be exploitable than shunting the baseband off on a non-dma capable bus.

Your "cellular phone" does not in fact have "full root memory access 24/7". In modern phone designs, the baseband is a USB peripheral. The notion that the closed, secret baseband is a DMA backdoor into AP memory is a message board meme, not engineering reality.

hjkgfdfgh 7y ago
That may be true of Apple, and is true of the PinePhone and Librem, but for the majority of Android devices, that's blatantly false. On Qualcomm chipsets in particular heavily utilize shared memory for baseband to application processor communication.
- tptacek 7y ago
  "The majority of Android devices" is a very wide net to cast.
  - hjkgfdfgh 7y ago
    Qualcomm alone covers 40%, and they're arguably the most likely to correctly implement their MMU (nevermind they've seen quite a few vulnerabilities in their MMU implementations over the years..) Meditek uses a similar architecture, and I sure as hell don't trust their MMU. Outside of Apple, Librem and Pine are just about the only way you're getting a USB attached baseband. edit - Here's a Mediatek Baseband->AP PoC even: https://comsecuris.com/blog/posts/path_of_least_resistance/ https://comsecuris.com/blog/posts/path_of_least_resistance/
    - weeks 7y ago
      https://googleprojectzero.blogspot.com/2017/10/over-air-vol-2-pt-3-exploiting-wi-fi.html https://googleprojectzero.blogspot.com/2017/10/over-air-vol-... Even Apple's IOMMU has had vulnerabilities allowing for full memory access from the WiFi modem.
      - tptacek 7y ago
        The wifi stack isn't the cellular modem. There's a reason people are particularly concerned about the baseband.
    - mirimir 7y ago
      Right. and even better, move the baseband to a USB-tethered device.
    - tptacek 7y ago
      The HTC One M9+, you say.
      - hjkgfdfgh 7y ago
        Where are you trying to go with this? You start off trying to claim the entire class of vulnerability isn't possible because a few vendors made sane architectural decisions. When it's pointed out those sane vendors are in the minority, and there are real world examples of the terrible shared memory architecture being exploited, you scoff at the example being for a single device. Nobody is claiming baseband == root, only that the terrible architecture prevalent in Android phones (the devices that make up the majority of the market) combined with the terrible software practices of SoC vendors results in a situation far more likely to be exploitable than shunting the baseband off on a non-dma capable bus.