4 ms·

When I read about "binary blobs" present in electronics like in a SIM, a baseband processor, or DDR memory controller or CPU management engine, the risks they p

When I read about "binary blobs" present in electronics like in a SIM, a baseband processor, or DDR memory controller or CPU management engine, the risks they pose seem distant. This opens my eyes a bit to that they actually do phone home, hidden from and unblockable by the OS.

jcun4128 5y ago
> binary blobs Was a concern with Pinephone but doesn't seem to be the case anymore from what I saw. (referring to modem)
- tmzt 5y ago
  Does it allow disabling STK apps out of the box or just with modified Linux on the Quectel? Are there any details?
  - jcun4128 5y ago
    I don't know about that, here is more info: https://www.pine64.org/2020/01/24/setting-the-record-straight-pinephone-misconceptions/ https://www.pine64.org/2020/01/24/setting-the-record-straigh... > In short, unless you explicitly send data to the modem, it is never in contact with the blobs running inside it. The modem cannot send any data to the phone unless phone is willing to receive it I guess there are some legal concerns with open source modems http://wiki.openmoko.org/wiki/Open_GSM_modem http://wiki.openmoko.org/wiki/Open_GSM_modem
  - lxgr 5y ago
    You can't disable STK applications: They are an integral part of the SIM card. If anything, you could hide the user-facing icon, but that wouldn't do anything about any background processing the applications might be doing. However, they can only interact with the baseband in any case: While that still allows extensive tracking and potential mischief (like making expensive calls on your behalf), this is nothing your phone provider can't already do, i.e. knowing where you are and bill you arbitrary amounts for services you might not have initiated (when on postpaid).
- marcan_42 5y ago
  The Pinephone is just like every other phone in this respect. The baseband runs a closed blob that talks to the SIM and can send arbitrary SMSes of its own accord. There are no viable fully open source phones in existence today, particularly the baseband. The more practical question is around whether those binary blobs can take over your OS, not just do things behind its back. This is what sets apart devices like the Pinephone and Apple M1 Macs (which make an effort to isolate blobs from the main OS running on the AP) from typical Android phones and Intel PCs (which have blobs in hyper-privileged positions that have full access to the entire system). Yes, I'm putting Apple M1 machines on a similar level as the Pinephone in this respect. How well designed a device is from a security/privacy perspective is tangential to whether the manufacturer markets themselves as an open source friendly company. It turns out Apple have done a great job making sure even their own blobs aren't allowed to take over the system. Once you run you own OS on an M1 machine, you're in a similar security position as on a PinePhone (though not exactly the same; M1s run more blobs, e.g. the display controller, so in principle a colluding set of malicious blobs could do more damage that way, but they still wouldn't be able to directly compromise your OS's execution).
  - robbedpeter 5y ago
    Can that closed source blob be bypassed and still allow compatible communication with carrier networks? Or is there some ip or contract nonsense that allows Qualcomm this stranglehold? This seems like exactly what we dealt with in requiring phone companies to allow dialup modems to connect to whoever the customer wants, and so on. Seems shady as hell.
    - judge2020 5y ago
      Most likely the blobs are signed/encrypted and the modem ensures that before running them, so without them it wouldn't work.
      - robbedpeter 5y ago
        I guess I was thinking more in line with SDR or foss hardware and not using Qualcomm at all. I need to do a deep dive, but it looks like there's a couple FOSS 4g LTE and 5g modems around - maybe running a soft phone and personal voip setup would bypass a lot of the security concerns. It sucks that any time you start to inspect almost any tech, there are assholes trying to exploit every last bit of data and microamp of processing power to screw you in some way.

jcun4128 5y ago

> binary blobs Was a concern with Pinephone but doesn't seem to be the case anymore from what I saw. (referring to modem)

tmzt 5y ago
Does it allow disabling STK apps out of the box or just with modified Linux on the Quectel? Are there any details?
- jcun4128 5y ago
  I don't know about that, here is more info: https://www.pine64.org/2020/01/24/setting-the-record-straight-pinephone-misconceptions/ https://www.pine64.org/2020/01/24/setting-the-record-straigh... > In short, unless you explicitly send data to the modem, it is never in contact with the blobs running inside it. The modem cannot send any data to the phone unless phone is willing to receive it I guess there are some legal concerns with open source modems http://wiki.openmoko.org/wiki/Open_GSM_modem http://wiki.openmoko.org/wiki/Open_GSM_modem
- lxgr 5y ago
  You can't disable STK applications: They are an integral part of the SIM card. If anything, you could hide the user-facing icon, but that wouldn't do anything about any background processing the applications might be doing. However, they can only interact with the baseband in any case: While that still allows extensive tracking and potential mischief (like making expensive calls on your behalf), this is nothing your phone provider can't already do, i.e. knowing where you are and bill you arbitrary amounts for services you might not have initiated (when on postpaid).
marcan_42 5y ago
The Pinephone is just like every other phone in this respect. The baseband runs a closed blob that talks to the SIM and can send arbitrary SMSes of its own accord. There are no viable fully open source phones in existence today, particularly the baseband. The more practical question is around whether those binary blobs can take over your OS, not just do things behind its back. This is what sets apart devices like the Pinephone and Apple M1 Macs (which make an effort to isolate blobs from the main OS running on the AP) from typical Android phones and Intel PCs (which have blobs in hyper-privileged positions that have full access to the entire system). Yes, I'm putting Apple M1 machines on a similar level as the Pinephone in this respect. How well designed a device is from a security/privacy perspective is tangential to whether the manufacturer markets themselves as an open source friendly company. It turns out Apple have done a great job making sure even their own blobs aren't allowed to take over the system. Once you run you own OS on an M1 machine, you're in a similar security position as on a PinePhone (though not exactly the same; M1s run more blobs, e.g. the display controller, so in principle a colluding set of malicious blobs could do more damage that way, but they still wouldn't be able to directly compromise your OS's execution).
- robbedpeter 5y ago
  Can that closed source blob be bypassed and still allow compatible communication with carrier networks? Or is there some ip or contract nonsense that allows Qualcomm this stranglehold? This seems like exactly what we dealt with in requiring phone companies to allow dialup modems to connect to whoever the customer wants, and so on. Seems shady as hell.
  - judge2020 5y ago
    Most likely the blobs are signed/encrypted and the modem ensures that before running them, so without them it wouldn't work.
    - robbedpeter 5y ago
      I guess I was thinking more in line with SDR or foss hardware and not using Qualcomm at all. I need to do a deep dive, but it looks like there's a couple FOSS 4g LTE and 5g modems around - maybe running a soft phone and personal voip setup would bypass a lot of the security concerns. It sucks that any time you start to inspect almost any tech, there are assholes trying to exploit every last bit of data and microamp of processing power to screw you in some way.