3 ms·

I wonder if some combination of Fuchsia, Titan, and Tensor would be sufficient to mitigate a baseband processor vulnerability.

junon 5y ago
Probably not. Processor vulnerabilities have the perpensity to affect most OSes because they're often pretty fundamental flaws in the basic CPU security mechanisms when discovered.
- webmaven 5y ago
  If I wasn't clear, I'm asking about vulnerabilities in the baseband processor (BBP), not the CPU. The BBP is what makes a smartphone a phone, rather than a small tablet: https://en.m.wikipedia.org/wiki/Baseband_processor https://en.m.wikipedia.org/wiki/Baseband_processor The thing about the BBP is that it is a second computer running its own proprietary OS (typically an RTOS) to handle the RF modem. The phone's main OS typically has no visibility into that second computer, even as root, but the reverse may not be true. So I was wondering if any of Google's efforts to increase security can mitigate attacks that might come through this particular channel that lurks, Kuato like, just out of sight.
saagarjha 5y ago
Apple mitigates baseband processor vulnerabilities by putting it behind what's essentially an IOMMU.
- webmaven 5y ago
  I must be missing something. I don't understand how that's supposed to help.
  - saagarjha 5y ago
    On other phones the baseband has full control of the AP because it can read and write to all of its physical RAM. With an IOMMU a compromised baseband can only control things inside its small view, rather than completely compromise everything running on your phone.
    - webmaven 5y ago
      But doesn't the IOMMU itself become additional attack surface for compromising the kernel? At least, I've seen it suggested that the tradeoff to gain a bit of defense-in-depth isn't necessarily worth it.
      - saagarjha 5y ago
        Not having an IOMMU=baseband can access all of the AP's memory. Having an IOMMU=baseband can only access a small section of memory marked for it, ideally. Obviously, it's worth implementing this: it turns a baseband compromise from "instant game over" to "might be a problem, but the IOMMU needs to have been set up incorrectly or the code that deals with it needs to have a serious vulnerability".

junon 5y ago

Probably not. Processor vulnerabilities have the perpensity to affect most OSes because they're often pretty fundamental flaws in the basic CPU security mechanisms when discovered.

webmaven 5y ago
If I wasn't clear, I'm asking about vulnerabilities in the baseband processor (BBP), not the CPU. The BBP is what makes a smartphone a phone, rather than a small tablet: https://en.m.wikipedia.org/wiki/Baseband_processor https://en.m.wikipedia.org/wiki/Baseband_processor The thing about the BBP is that it is a second computer running its own proprietary OS (typically an RTOS) to handle the RF modem. The phone's main OS typically has no visibility into that second computer, even as root, but the reverse may not be true. So I was wondering if any of Google's efforts to increase security can mitigate attacks that might come through this particular channel that lurks, Kuato like, just out of sight.

saagarjha 5y ago

Apple mitigates baseband processor vulnerabilities by putting it behind what's essentially an IOMMU.

webmaven 5y ago
I must be missing something. I don't understand how that's supposed to help.
- saagarjha 5y ago
  On other phones the baseband has full control of the AP because it can read and write to all of its physical RAM. With an IOMMU a compromised baseband can only control things inside its small view, rather than completely compromise everything running on your phone.
  - webmaven 5y ago
    But doesn't the IOMMU itself become additional attack surface for compromising the kernel? At least, I've seen it suggested that the tradeoff to gain a bit of defense-in-depth isn't necessarily worth it.
    - saagarjha 5y ago
      Not having an IOMMU=baseband can access all of the AP's memory. Having an IOMMU=baseband can only access a small section of memory marked for it, ideally. Obviously, it's worth implementing this: it turns a baseband compromise from "instant game over" to "might be a problem, but the IOMMU needs to have been set up incorrectly or the code that deals with it needs to have a serious vulnerability".