4 ms·

A very high likelihood that there are parsing vulnerabilities in common basebands that allows a malformed message to change the firmware. These messages can be

A very high likelihood that there are parsing vulnerabilities in common basebands that allows a malformed message to change the firmware. These messages can be radio link layer messages or handshakes before encryption is applied. Even without DMA access, a baseband can deliver a malformed message to the baseband’s kernel driver on the android side and use that as a means to get full system access. The lack of scrutiny in baseband source code review, encryption in relevant messages, and the opaqueness makes it a great target.

qball 4y ago
>The lack of scrutiny in baseband source code review, encryption in relevant messages, and the opaqueness makes it a great target. Sure, but why hasn't anyone actually used it in this way yet (that we know of; I'm sure relevant government actors already have at least a proof of concept given they can just request/steal the code and signing keys wholesale)? Phones have operated this way for the last 15 years and yet not one significant baseband exploit has been used- and maybe that's just for fear that as soon as someone does do this it won't ever be possible again- but that doesn't stop Intel from including their Management Engine, so...