5 ms·
You don't even need a traditional app backdoor to do this. The carrier can just send the message to the baseband radio itself, which has a direct connection to
by ranger_danger 5y ago
You don't even need a traditional app backdoor to do this. The carrier can just send the message to the baseband radio itself, which has a direct connection to your GPS receiver, among other things (usually) like the camera and microphone. That means these peripherals are accessible (in theory, Snowden says it has been done in the past) even if the main app OS is shut down.
- flotzam 5y agoI'm not sure this is still true (on modern devices): https://grapheneos.org/faq#baseband-isolation https://grapheneos.org/faq#baseband-isolation There's Enhanced 9-1-1 but its GPS access should be mediated by the OS? Hopefully?
- numpad0 5y agoGPS in 3G or later is integral to Baseband Processor which is a separate ARM CPU that runs its own RTOS. If your adversary gets to push BP patch over SMS you're probably owned no matter what OS you run on Application Processor.
- chriscappuccio 5y agoGraphene suggests that it uses iommu and similar hardware on supported devices to mitigate (some) attacks like this.
- ozymandias12 5y agoWhat’s the story Apple/Samsung etc tell for GPS to be this leaky? Shouldn’t the GPS be solely handled by the OS?
- numpad0 5y agoThere's only so much you could without making your own modem... Current cellular modems are autonomous and integrated. It's architectural.