9 ms·

PinePhone Modem SDK

199 points by csdvrx 3y ago

csdvrx 3y ago
Following the discussion on illegal cell tracking where several comments mentioned the firmware can be a problem, here's a link to a free-software firmware. I believe this is important, because on Android the firmware controls the network connection (and GPS, etc). It has its own embedded Linux, flash and CPU so even if you have root and run a firewall on android, it can send packets that will not be visible to the android kernel. Most firmware have adb and fastboot, which can be used to replace what's running there by something you can recompile and audit. If you don't like it, you can also restore the initial firmware, for ex: https://github.com/Biktorgj/quectel_eg25_recovery https://github.com/Biktorgj/quectel_eg25_recovery EDIT: replaced baseband by firmware. I confused one for the other. For context as to why it matters, see https://news.ycombinator.com/item?id=36658078 https://news.ycombinator.com/item?id=36658078
- BasedAnon 3y ago
  oh no breaking the law!!! /s
  - bee_rider 3y ago
    It is a pretty big problem when the authorities break the law, why does this provoke a sarcastic response?
    - BasedAnon 3y ago
      So it's fine if it's legal?
  - nurple 3y ago
    Show me the man and I'll show you the crime. - chief of Stalin's secret police
- nurple 3y ago
  It's pretty interesting to see the added features this replacement userland provides when considering the tenacity of the TLAs in slurping up the data of citizens and non-citizens alike. It's capabilities like these that freak me out when considering similar stacks like the rPI GPU blobs and intel management engine/SGX. I don't expect with the public failure of Clipper that they simply gave up on the capability to run clandestine code on your hardware, I think they just changed tactics.
- kaba0 3y ago
  It’s just the userspace, so you are not much closer to actual “free-software”.
my123 3y ago
Note: it's not a free software baseband FW as you'd expect from that being said. What the PinePhone does is using a low end Qualcomm SoC as the modem (which has a CPU core and all, and runs a stripped-down Android in the stock configuration). This just replaces that part which you can already edit on your own Android phone, but doesn't touch the actual modem bits at all, which remain the provided binary.
- csdvrx 3y ago
  You're right and I'm wrong! I'm currently editing my summary to clarify. Still, I believe having full control on the firmware of the phone modem is at least as important as having root on the phone - otherwise, the firmware can say "location off? no problem!" while continuing to get GPS position locks + transmit the position inside UDP packets that won't be visible to the CPU running the android kernel and communicating to the firmware. EDIT: actually, you are partly wrong when you say "This just replaces that part which you can already edit on your own Android phone": many android phones use a modem module to have certification in different markets. So you can't replace the modem firmware on most android phones I'm familiar with. Don't be confused by the modem using adb and fastboot like the android phones: it has its own software stack, and runs its own OS a bit like Intel ME or AMD PSP on PCs.
  - newhouseb 3y ago
    Modern LTE/5G provides pretty accurate location out of the box without GPS so if you really wanted to hide you would really need to just shut off the entire modem. Fortunately, the PinePhone has hardware switches to do this!
  - deleted 3y ago
    [deleted]
  - chupasaurus 3y ago
    > you can't replace the modem firmware you can, but the modem would refuse to load uncertified fw.
    - 3y ago
pcdoodle 3y ago
Anything stopping us from throwing a mini pcie version of this modem into a laptop and using it as a speaker phone?
- brianmorris10 3y ago
  Common decency.
- 3np 3y ago
  Totally feasible. Or, hey, put it on an SBC, use it as an incoming SMS proxy with a dedicated SIM so you can recieve 2FA SMS without need of having the SIM and a phone with you.
  - yjftsjthsd-h 3y ago
    Wouldn't you still need the SIM? We're just talking about shoving a headless phone inside a slot on a laptop, aren't we?
    - pmontra 3y ago
      You must have a SIM in the laptop at home (that's a "2FA mule") but you can use the WiFi on the phone. That helps also in other scenarios. The last time I was in Australia I had a dual SIM phone. I put an Australian SIM in the second slot and used it for calls within the country and for data. SMS from my country didn't reach me or cost an absurd amount, can't remember. The point is that I was out of reach of 2FA SMSes and I couldn't use one of my credit cards online. Of course their customer service told me that I could switch my account to my Australian number but that never worked, it's probably a common move in scams and identity thefts. A 2FA mule would have saved me somewhat, as in some remote areas there was only voice, if lucky, and data was so slow to be useless and WiFi doesn't exist in the middle of nowhere. Anyway, would have I left my primary SIM at home and be unreachable on my way to and from the airport? Probably not. 2FA on SMS should die. Unfortunately it's very convenient for companies. There is little setup and they can send an SMS to any random customer with little friction on customer side. No app to install, nothing.
- 3y ago
_rdvw 3y ago
This is just the user-space aspect of the modem, it still has a 40MB proprietary firmware blob that does all the fun stuff. Also running long end-of-life and insecure Linux 3.18: https://github.com/the-modem-distro/quectel_eg25_kernel/blob/linux-3.18.140/Makefile https://github.com/the-modem-distro/quectel_eg25_kernel/blob... I submitted a PR with my CVE auto-patcher which fixed many issues including numerous modem related ones which was ignored and closed: https://github.com/the-modem-distro/quectel_eg25_kernel/pull/7 https://github.com/the-modem-distro/quectel_eg25_kernel/pull...
- c-c-c-c-c 3y ago
  [flagged]
  - _rdvw 3y ago
    I'm happy to see things done right in the form of mainlining the necessary parts, but that takes _years_. Users shouldn't have to suffer with known security issues that have fixes readily available. I've used this tool to support many dozens of end-of-life devices working well over the past six years, and it is even purpose-built for these Android/Qualcomm downstream kernels.
    - tadfisher 3y ago
      Maybe you could rework your process a bit, as a drive-by patchset with 400+ commits is not a great way to start a conversation. Some ideas: - Open an issue or post to the project's mailing list, proposing the use of your tool. - If you don't do so already, have your tool only apply patches to code that is actually compiled for the target, e.g. give it a .config and trace which source files are used in make. - Obtain the hardware for the devices your tool supports and donate your time to test the changes generated by your tool.
      - _rdvw 3y ago
        Only applying patches that may be necessary is absolutely non-trivial to compute, especially with dependent patchsets, kernel trees used by multiple devices, or future changes to their configs. I already provide monthly software updates for 170 devices using this tool which I've personally tested on two dozen devices plus many user reports on others. Making a (near) working PR conversation starter to demonstrate the tool I've spent years of my time on is my contribution. In this case where I didn't have a PinePhone I explicitly found a closest match (Google Pixel 1/marlin iirc) to the kernel at hand and applied my fix database to it as matching to increase the chance that it would be successful. I have absolutely zero doubts that someone can't apply the PR and be up and running in an hour. edit: to be extra clear, I'm not a company selling this tool or anything, it is purely a passion project for me and I do want others to use it or help them use it.
_8j50 3y ago
What is the actual risk of closed baseband with it's own cpu? Does it have access to the same memory as the OS kernel? If so, is it not possible to design SoCs/boards that have dedicated memory for the baseband so that the main OS can treat the baseband and data in its memory as untrusted?
- nurple 3y ago
  The risk is that the baseband could be implementing similar features that this userland adds to the "distro" running on the modem (call, data, and SMS recording), and these features could be driven by signals from the cell network. Unless you have a tap on the data egress path to the RF section, it would be difficult to know if data like this was being exfiltrated from your device as it completely bypasses the host's stack.
  - Nextgrid 3y ago
    But isn't all this something the carrier can do anyway on their side? What do they gain by controlling the modem that they can't already get just from their own equipment?
    - hiatus 3y ago
      This expands the pool of actors beyond network operators. If you can just interact with the cell directly by sending signals to it, you can interfere with the cell without involving the network operator.
  - coretx 3y ago
    Maybe we should also mention that the SIM talks to both.
    - hedora 3y ago
      Ignoring that (which we shouldn’t), if the CPU has an IOMMU it can completely isolate the modem from the rest of the system. (“Completely” here is also ignoring denial of service and side channel attacks, like timing or the sim card.)
nurple 3y ago
I wonder if it'd be possible, at this level, to create an E2EE voice connection between two devices. I'm not familiar with the stack or the voice data stream through the hardware. If code in the blob is responsible for encoding maybe it would still be possible to use a methodology similar to video mpeg where the raw data producer is aware of the blocking scheme and can formulate the data in a way that it is not compromised by encoding. If the stream is encoded in userland I suppose it would be quite a bit easier. Another feature this makes me ponder on is if perhaps you could send arbitrary data over the voice channel (if the above is possible, this should be). Since most providers these days provide unlimited voice, you could proxy your internet traffic to a second device located elsewhere and gain unlimited data, as well as perhaps reap the benefits of the steganographic nature of the channel.
- callalex 3y ago
  I hope you realize you are describing dial-up internet? I could see having an automated dialer integrated with the OS do a decent job of masking the set up and tear down time of the connections, but it would have even slower data rates than the days of landlines, because cellular audio quality is much, much, much worse. And more importantly the jitter is significantly worse. Even sending faxes over cellular, or even wired VoIP fails regularly and that is an even slower data rate than would be acceptable for dial-up internet. Also I haven’t looked it up but I assume the battery life of the pine phone while on a phone call is at most a few hours, compared to days for an active LTE connection. It’s a funny thought experiment though.
  - nurple 3y ago
    Yeah, true. They've made some pretty impressive perceptual voice codecs that take very little data, and using that as the carrier for transmitting data would eat into that quite a bit more. Though, I find steganographic methods quite fascinating and often catch myself pondering ways to exchange data privately where efficiency is a small aspect of the overall goal of the communication channel. I suppose "thought experiment" is a good description. The most effective/efficient way to do E2EE voice is definitely to use an app that supports voice and transfers via the data channel.
pmontra 3y ago
> Modem will answer to the number: +22 33 44 55 66 77 +223 is the country code of Mali.
- biktor_gj 3y ago
  It has had different phone numbers before, but we always ended up having some issue with some app where the it (correctly) thought the number was invalid, wouldn't allow you to reply etc. So I settled with two easy to remember numbers: +22 33 44 55 66 77 for normal user<-->modem communication and +22 33 44 55 66 78 for Cell Broadcast message relays

199 points by csdvrx 3y ago

Following the discussion on illegal cell tracking where several comments mentioned the firmware can be a problem, here's a link to a free-software firmware. I believe this is important, because on Android the firmware controls the network connection (and GPS, etc). It has its own embedded Linux, flash and CPU so even if you have root and run a firewall on android, it can send packets that will not be visible to the android kernel. Most firmware have adb and fastboot, which can be used to replace what's running there by something you can recompile and audit. If you don't like it, you can also restore the initial firmware, for ex: https://github.com/Biktorgj/quectel_eg25_recovery https://github.com/Biktorgj/quectel_eg25_recovery EDIT: replaced baseband by firmware. I confused one for the other. For context as to why it matters, see https://news.ycombinator.com/item?id=36658078 https://news.ycombinator.com/item?id=36658078

BasedAnon 3y ago
oh no breaking the law!!! /s
- bee_rider 3y ago
  It is a pretty big problem when the authorities break the law, why does this provoke a sarcastic response?
  - BasedAnon 3y ago
    So it's fine if it's legal?
- nurple 3y ago
  Show me the man and I'll show you the crime. - chief of Stalin's secret police
nurple 3y ago
It's pretty interesting to see the added features this replacement userland provides when considering the tenacity of the TLAs in slurping up the data of citizens and non-citizens alike. It's capabilities like these that freak me out when considering similar stacks like the rPI GPU blobs and intel management engine/SGX. I don't expect with the public failure of Clipper that they simply gave up on the capability to run clandestine code on your hardware, I think they just changed tactics.
kaba0 3y ago
It’s just the userspace, so you are not much closer to actual “free-software”.

my123 3y ago

Note: it's not a free software baseband FW as you'd expect from that being said. What the PinePhone does is using a low end Qualcomm SoC as the modem (which has a CPU core and all, and runs a stripped-down Android in the stock configuration). This just replaces that part which you can already edit on your own Android phone, but doesn't touch the actual modem bits at all, which remain the provided binary.

csdvrx 3y ago
You're right and I'm wrong! I'm currently editing my summary to clarify. Still, I believe having full control on the firmware of the phone modem is at least as important as having root on the phone - otherwise, the firmware can say "location off? no problem!" while continuing to get GPS position locks + transmit the position inside UDP packets that won't be visible to the CPU running the android kernel and communicating to the firmware. EDIT: actually, you are partly wrong when you say "This just replaces that part which you can already edit on your own Android phone": many android phones use a modem module to have certification in different markets. So you can't replace the modem firmware on most android phones I'm familiar with. Don't be confused by the modem using adb and fastboot like the android phones: it has its own software stack, and runs its own OS a bit like Intel ME or AMD PSP on PCs.
- newhouseb 3y ago
  Modern LTE/5G provides pretty accurate location out of the box without GPS so if you really wanted to hide you would really need to just shut off the entire modem. Fortunately, the PinePhone has hardware switches to do this!
- deleted 3y ago
  [deleted]
- chupasaurus 3y ago
  > you can't replace the modem firmware you can, but the modem would refuse to load uncertified fw.
  - 3y ago

pcdoodle 3y ago

Anything stopping us from throwing a mini pcie version of this modem into a laptop and using it as a speaker phone?

brianmorris10 3y ago
Common decency.
3np 3y ago
Totally feasible. Or, hey, put it on an SBC, use it as an incoming SMS proxy with a dedicated SIM so you can recieve 2FA SMS without need of having the SIM and a phone with you.
- yjftsjthsd-h 3y ago
  Wouldn't you still need the SIM? We're just talking about shoving a headless phone inside a slot on a laptop, aren't we?
  - pmontra 3y ago
    You must have a SIM in the laptop at home (that's a "2FA mule") but you can use the WiFi on the phone. That helps also in other scenarios. The last time I was in Australia I had a dual SIM phone. I put an Australian SIM in the second slot and used it for calls within the country and for data. SMS from my country didn't reach me or cost an absurd amount, can't remember. The point is that I was out of reach of 2FA SMSes and I couldn't use one of my credit cards online. Of course their customer service told me that I could switch my account to my Australian number but that never worked, it's probably a common move in scams and identity thefts. A 2FA mule would have saved me somewhat, as in some remote areas there was only voice, if lucky, and data was so slow to be useless and WiFi doesn't exist in the middle of nowhere. Anyway, would have I left my primary SIM at home and be unreachable on my way to and from the airport? Probably not. 2FA on SMS should die. Unfortunately it's very convenient for companies. There is little setup and they can send an SMS to any random customer with little friction on customer side. No app to install, nothing.
3y ago

_rdvw 3y ago

This is just the user-space aspect of the modem, it still has a 40MB proprietary firmware blob that does all the fun stuff. Also running long end-of-life and insecure Linux 3.18: https://github.com/the-modem-distro/quectel_eg25_kernel/blob/linux-3.18.140/Makefile https://github.com/the-modem-distro/quectel_eg25_kernel/blob... I submitted a PR with my CVE auto-patcher which fixed many issues including numerous modem related ones which was ignored and closed: https://github.com/the-modem-distro/quectel_eg25_kernel/pull/7 https://github.com/the-modem-distro/quectel_eg25_kernel/pull...

c-c-c-c-c 3y ago
[flagged]
- _rdvw 3y ago
  I'm happy to see things done right in the form of mainlining the necessary parts, but that takes _years_. Users shouldn't have to suffer with known security issues that have fixes readily available. I've used this tool to support many dozens of end-of-life devices working well over the past six years, and it is even purpose-built for these Android/Qualcomm downstream kernels.
  - tadfisher 3y ago
    Maybe you could rework your process a bit, as a drive-by patchset with 400+ commits is not a great way to start a conversation. Some ideas: - Open an issue or post to the project's mailing list, proposing the use of your tool. - If you don't do so already, have your tool only apply patches to code that is actually compiled for the target, e.g. give it a .config and trace which source files are used in make. - Obtain the hardware for the devices your tool supports and donate your time to test the changes generated by your tool.
    - _rdvw 3y ago
      Only applying patches that may be necessary is absolutely non-trivial to compute, especially with dependent patchsets, kernel trees used by multiple devices, or future changes to their configs. I already provide monthly software updates for 170 devices using this tool which I've personally tested on two dozen devices plus many user reports on others. Making a (near) working PR conversation starter to demonstrate the tool I've spent years of my time on is my contribution. In this case where I didn't have a PinePhone I explicitly found a closest match (Google Pixel 1/marlin iirc) to the kernel at hand and applied my fix database to it as matching to increase the chance that it would be successful. I have absolutely zero doubts that someone can't apply the PR and be up and running in an hour. edit: to be extra clear, I'm not a company selling this tool or anything, it is purely a passion project for me and I do want others to use it or help them use it.

_8j50 3y ago

What is the actual risk of closed baseband with it's own cpu? Does it have access to the same memory as the OS kernel? If so, is it not possible to design SoCs/boards that have dedicated memory for the baseband so that the main OS can treat the baseband and data in its memory as untrusted?

nurple 3y ago
The risk is that the baseband could be implementing similar features that this userland adds to the "distro" running on the modem (call, data, and SMS recording), and these features could be driven by signals from the cell network. Unless you have a tap on the data egress path to the RF section, it would be difficult to know if data like this was being exfiltrated from your device as it completely bypasses the host's stack.
- Nextgrid 3y ago
  But isn't all this something the carrier can do anyway on their side? What do they gain by controlling the modem that they can't already get just from their own equipment?
  - hiatus 3y ago
    This expands the pool of actors beyond network operators. If you can just interact with the cell directly by sending signals to it, you can interfere with the cell without involving the network operator.
- coretx 3y ago
  Maybe we should also mention that the SIM talks to both.
  - hedora 3y ago
    Ignoring that (which we shouldn’t), if the CPU has an IOMMU it can completely isolate the modem from the rest of the system. (“Completely” here is also ignoring denial of service and side channel attacks, like timing or the sim card.)

nurple 3y ago

I wonder if it'd be possible, at this level, to create an E2EE voice connection between two devices. I'm not familiar with the stack or the voice data stream through the hardware. If code in the blob is responsible for encoding maybe it would still be possible to use a methodology similar to video mpeg where the raw data producer is aware of the blocking scheme and can formulate the data in a way that it is not compromised by encoding. If the stream is encoded in userland I suppose it would be quite a bit easier. Another feature this makes me ponder on is if perhaps you could send arbitrary data over the voice channel (if the above is possible, this should be). Since most providers these days provide unlimited voice, you could proxy your internet traffic to a second device located elsewhere and gain unlimited data, as well as perhaps reap the benefits of the steganographic nature of the channel.

callalex 3y ago
I hope you realize you are describing dial-up internet? I could see having an automated dialer integrated with the OS do a decent job of masking the set up and tear down time of the connections, but it would have even slower data rates than the days of landlines, because cellular audio quality is much, much, much worse. And more importantly the jitter is significantly worse. Even sending faxes over cellular, or even wired VoIP fails regularly and that is an even slower data rate than would be acceptable for dial-up internet. Also I haven’t looked it up but I assume the battery life of the pine phone while on a phone call is at most a few hours, compared to days for an active LTE connection. It’s a funny thought experiment though.
- nurple 3y ago
  Yeah, true. They've made some pretty impressive perceptual voice codecs that take very little data, and using that as the carrier for transmitting data would eat into that quite a bit more. Though, I find steganographic methods quite fascinating and often catch myself pondering ways to exchange data privately where efficiency is a small aspect of the overall goal of the communication channel. I suppose "thought experiment" is a good description. The most effective/efficient way to do E2EE voice is definitely to use an app that supports voice and transfers via the data channel.

pmontra 3y ago

> Modem will answer to the number: +22 33 44 55 66 77 +223 is the country code of Mali.

biktor_gj 3y ago
It has had different phone numbers before, but we always ended up having some issue with some app where the it (correctly) thought the number was invalid, wouldn't allow you to reply etc. So I settled with two easy to remember numbers: +22 33 44 55 66 77 for normal user<-->modem communication and +22 33 44 55 66 78 for Cell Broadcast message relays