5 ms·

As the article mentions, this is for assisted GPS. I've worked quite a bit with this system on android and implemented (or rather fixed) it for a custom android

As the article mentions, this is for assisted GPS. I've worked quite a bit with this system on android and implemented (or rather fixed) it for a custom android device. I've also worked with separate Qualcomm modems in the past. They are basically a whole small Linux computer in a package. You supply voltage, antennas, and connect via serial or USB, and then you can send AT commands to control it. On the one hand it wouldn't surprise me if the Qualcomm modem accesses the network on it's own - it very much wants to be a black box - on the other hand I doubt this story for two reasons: - WiFi is implemented on the Android side. In all Android implementations I've seen, the WiFi module is part of the SoC or a separate chip, and Android runs the regular wpa_supplicant and so on. The chip cannot see the contents of packages, it only passes the bytes to the MAC (not sure if it is called that with WiFi). (Now, of course in the case of a SoC the chip could, with driver support, peel back the encryption and inject it's own traffic, just like some IPMIs can share an ethernet connection with the OS. I just have not seen this yet.) - In Android, it is usually the responsibility of the OS to fetch the AGPS data / almanach. You have a HAL consisting of a proprietary library (.so) that you get from the GPS vendor, some glue code, and a gps.conf. The gps.conf file lists the URLs to get the AGPS data. I'm not sure if the download is performed in the .so or in Java code, but anyway it is totally in the OS and not in the modem, at least in the cases I know. When a custom ROM, even a "degoogled" one, is made, you include a customized kernel and custom drivers, and the AGPS URLs are part of this "driver".

krn 3y ago
> When a custom ROM, even a "degoogled" one, is made, you include a customized kernel and custom drivers, and the AGPS URLs are part of this "driver". Thanks, this should be the top comment. Both, Sony and Google, provide driver downloads for their smartphones[1][2]. In this case, the tested "de-Googled" OS (/e/OS) did exactly what it promised to do: removed all network connections made by Google – and not by Qualcomm or anybody else. Since Pixel smartphones now use Google's own Tensor chips (which are based on Samsung Exynos), they obviously don't make any connections to Qualcomm servers. This blog post is clearly an ad for NitroPhone, which is simply a Google Pixel smartphone with a different open-source OS pre-installed. GrapheneOS[3] is only targeting Google Pixel line-up at the moment, and therefore is able to make sure that even A-GPS URLs are "de-Googled" on the latest models. But the older Google Pixel models with Qualcomm chips make exactly the same connections – from the driver, not from the firmware[4]: > GrapheneOS has modified all references to these servers to use HTTPS rather than a mix of HTTP and HTTPS. No query / data is sent to the server. [1] https://developer.sony.com/develop/drivers/ https://developer.sony.com/develop/drivers/ [2] https://developers.google.com/android/drivers https://developers.google.com/android/drivers [3] https://grapheneos.org/ https://grapheneos.org/ [4] https://www.reddit.com/r/CalyxOS/comments/pym8l1/comment/heveec5/ https://www.reddit.com/r/CalyxOS/comments/pym8l1/comment/hev...
- IYasha 3y ago
  Literally hours after your post I'm reading this: Founder of GrapheneOS Daniel Micay hit with a Swatting Attempt https://nitter.takebackourtech.org/i/status/1650947535500898313?s=19 https://nitter.takebackourtech.org/i/status/1650947535500898...
  - krn 3y ago
    It seems that there is something very wrong with the entire Android privacy community, because fighting between different open-source projects in this space never stops. From the technical point of view, only Daniel Micay's GrapheneOS currently takes security really seriously by providing constant system updates. It seems that you either have to use GrapheneOS, or buy an iPhone, if you care about both – security and privacy. The people who are attacking Daniel Micay often incorporate a lot of his work into their own projects. And, naturally, that might make many of them feel inferior or even incompetent – if they are doing this for years to stay in the competition.
- greggsy 3y ago
  > This blog post is clearly an ad for NitroPhone Thanks - somehow I completely glossed over that possibility. This kind of biased rage bait has no place in privacy stories.
palata 3y ago
This comment alone is worth 100x the blog post (which IMO is not worth reading, and is actually confusing). Thanks for the insights!
wrs 3y ago
They make the source of these requests sound like some nefarious mystery, but in two minutes I found the code right there on master: https://cs.android.com/android/platform/superproject/+/master:hardware/qcom/sdm845/gps/loc_api/libloc_api_50001/loc_eng.cpp;l=929 https://cs.android.com/android/platform/superproject/+/maste... (and vicinity)

krn 3y ago

> When a custom ROM, even a "degoogled" one, is made, you include a customized kernel and custom drivers, and the AGPS URLs are part of this "driver". Thanks, this should be the top comment. Both, Sony and Google, provide driver downloads for their smartphones[1][2]. In this case, the tested "de-Googled" OS (/e/OS) did exactly what it promised to do: removed all network connections made by Google – and not by Qualcomm or anybody else. Since Pixel smartphones now use Google's own Tensor chips (which are based on Samsung Exynos), they obviously don't make any connections to Qualcomm servers. This blog post is clearly an ad for NitroPhone, which is simply a Google Pixel smartphone with a different open-source OS pre-installed. GrapheneOS[3] is only targeting Google Pixel line-up at the moment, and therefore is able to make sure that even A-GPS URLs are "de-Googled" on the latest models. But the older Google Pixel models with Qualcomm chips make exactly the same connections – from the driver, not from the firmware[4]: > GrapheneOS has modified all references to these servers to use HTTPS rather than a mix of HTTP and HTTPS. No query / data is sent to the server. [1] https://developer.sony.com/develop/drivers/ https://developer.sony.com/develop/drivers/ [2] https://developers.google.com/android/drivers https://developers.google.com/android/drivers [3] https://grapheneos.org/ https://grapheneos.org/ [4] https://www.reddit.com/r/CalyxOS/comments/pym8l1/comment/heveec5/ https://www.reddit.com/r/CalyxOS/comments/pym8l1/comment/hev...

IYasha 3y ago
Literally hours after your post I'm reading this: Founder of GrapheneOS Daniel Micay hit with a Swatting Attempt https://nitter.takebackourtech.org/i/status/1650947535500898313?s=19 https://nitter.takebackourtech.org/i/status/1650947535500898...
- krn 3y ago
  It seems that there is something very wrong with the entire Android privacy community, because fighting between different open-source projects in this space never stops. From the technical point of view, only Daniel Micay's GrapheneOS currently takes security really seriously by providing constant system updates. It seems that you either have to use GrapheneOS, or buy an iPhone, if you care about both – security and privacy. The people who are attacking Daniel Micay often incorporate a lot of his work into their own projects. And, naturally, that might make many of them feel inferior or even incompetent – if they are doing this for years to stay in the competition.
greggsy 3y ago
> This blog post is clearly an ad for NitroPhone Thanks - somehow I completely glossed over that possibility. This kind of biased rage bait has no place in privacy stories.

palata 3y ago

This comment alone is worth 100x the blog post (which IMO is not worth reading, and is actually confusing). Thanks for the insights!

wrs 3y ago

They make the source of these requests sound like some nefarious mystery, but in two minutes I found the code right there on master: https://cs.android.com/android/platform/superproject/+/master:hardware/qcom/sdm845/gps/loc_api/libloc_api_50001/loc_eng.cpp;l=929 https://cs.android.com/android/platform/superproject/+/maste... (and vicinity)