3 ms·

The thing people always say about mandated backdoors is that they make devices less secure for everyone. Ie, if the government can get in, so can other bad acto

The thing people always say about mandated backdoors is that they make devices less secure for everyone. Ie, if the government can get in, so can other bad actors. If this is true (and I generally believe this is is), and if basebands do indeed have backdoors for the government, why hasn't anyone found them? Why haven't we seen CVEs on this? Can anyone point to a published baseband CVE that smells like a government plant, rather than a well-intentioned accident?

dylan604 3y ago
If we believe governments can convince hardware makers to add backdoors, why do we not believe governments can convince CVEs from being removed or not allowed?
- Wowfunhappy 3y ago
  Because a lot of security research is done by individuals or small firms, and the NSA doesn't generally review disclosures. I find it hard to believe this wouldn't leak, at least in the western world.
  - dylan604 3y ago
    And? I don't know the CVE process, so I'm honestly asking while you're not actually answering. Who controls the release of CVEs? Sure, individuals can report something as a vuln, but does the report automatically create a CVE? Or do the reports get verified and then "promoted" to CVE? If the latter, then there's absolutely a part in the process that can be subverted
    - wepple 3y ago
      CVEs have absolutely nothing to do with finding out whether our devices are backdoored. CVEs come out of Mitre, but lots of countries have equivalent systems or tracking codes. Further, large companies are pre-allocated blocks of CVEs to use. But it’s irrelevant. The original position was that if govt are putting obvious remote access into devices, why has nobody ever seen and blogged or tweeted about it?
byteknight 3y ago
That's simply because you haven't looked. There was literally a black hat talk on exploiting cellular networks this year. Every year there seems like there's a new exploit. Just because it doesn't make it to your particular side of the internet doesn't mean it's not happening. Now, can anyone definitively prove that they are back doors and not mistakes or exploits? No. But that's thanks to the age old "Never ascribe to malice that which is adequately explained by incompetence."
- Akronymus 3y ago
  > There was literally a black hat talk on exploiting cellular networks this year. Is that talk recorded somewhere?
  - ccooffee 3y ago
    I assume GP is referring to Title: "Over the Air, Under the Radar: Attacking and Securing the Pixel Modem" Summary/Slides: https://www.blackhat.com/us-23/briefings/schedule/#over-the-air-under-the-radar-attacking-and-securing-the-pixel-modem-33009 https://www.blackhat.com/us-23/briefings/schedule/#over-the-... YouTube (48 minute): https://www.youtube.com/watch?v=QrkB_enz2Pk https://www.youtube.com/watch?v=QrkB_enz2Pk
- ActorNightly 3y ago
  >There was literally a black hat talk on exploiting cellular networks this year. Talk at black hat =/= everyones devices are de facto vulnerable. For as tech savy as this forum is, its surprising how many people are not well read up on security. The summary of vulnerability is this - if you use a cellular network, your baseband chip vulnerability is next to irrelevant. Your location can be triangulated from radio signals, and its likely that there are messaging contacts and calls that are logged that use the respective celluar services. Now for pure data transmission from a secure messaging app. Most of the communication for privacy is done using end to end encryption apps like Telegram. While those can be compromised, those require a direct targeted attack on the device, you cant just remotely do this over the internet.
smoldesu 3y ago
This article does a good job summing things up: https://www.devever.net/~hl/nosecuresmartphone https://www.devever.net/~hl/nosecuresmartphone > Modern smartphones have a CPU chip, and a baseband chip which handles radio network communications (GSM/UMTS/LTE/etc.) This chip is connected to the CPU via DMA. Thus, unless an IOMMU is used, the baseband has full access to main memory, and can compromise it arbitrarily. > It can be safely assumed that this baseband is highly insecure. It is closed source and probably not audited at all. The problem is less that there are identified issues, and more that the variety of hardware and vulnerability of the implementation is suspicious.
- hlandau 3y ago
  Author of the above blogpost here. To my knowledge the situation has changed nowadays and IOMMUs on smartphone SoCs are now common. Having said that I still don't rate the security of any smartphone and you should assume it will get compromised. There's a million reasons for this: - Baseband is still radioactive and probably trivially compromised by any nation-state adversary so it's all down to the IOMMU. - IOMMUs are hard to configure correctly and frequently misconfigured by drivers which don't use them correctly. - Any host driver bugs in talking to the baseband might be exploitable. - It's hard to verify an IOMMU is actually working correctly, so it's not like any of this is commonly audited. - We're talking about SoCs here with the baseband usually integrated on the same chip, so there's always the risk of some undocumented channel between the baseband and the rest of the chip the vendor omitted to notice or tell anyone about. The situation is at least better than it was but it's still 100% my assumption that no phone can be trusted in the face of an adversary who can put up a fake cellular network. There's simply far too much proprietary firmware, mysterious black boxes, etc. to be able to really trust these things. Also I'm assuming here there's a desire to get access to the host processor and stored data, but you don't need to do that if you just want to get at the microphone or GPS or leak someone's location or so on. There's a million bad things someone could do getting access just to the baseband even if the IOMMU works right.
- ActorNightly 3y ago
  Article from 2016 in this area is irrelevant in 2023.
reactordev 3y ago
Normally these agencies “discover” these back doors through admitted confession by those bad actors. Tell us how you did it and we’ll reduce the sentence, kind of thing. Sometimes it’s of their own accord if they are high up enough (NSA) but the majority of law enforcement relies on vendors who use the same exploits as the nefarious bad actors. Only “for good”… the bad actors are always a step ahead and continue to give talks on how badly insecure our pocket computers really are.
warner25 3y ago
I tried to express a similar question / curiosity last year in a discussion about the Intel Management Engine (https://news.ycombinator.com/item?id=33345040#33346166 https://news.ycombinator.com/item?id=33345040#33346166) but you have expressed it better. It's like what intelligent skeptics keep saying in the ongoing discussion of UFOs / UAPs and claims of extraterrestrial visits: With everyone having a camera in their pocket (or, more likely, in their hand) these days, shouldn't there be more compelling photographic evidence of extraordinary things at this point, if extraordinary things are really happening? Edited to add: I guess I said it pretty well further down in that thread, "It does seem like some researcher or journalist should have blown the case open by now if this thing were systematically providing telemetry from everyone's "powered off" (but still plugged in) machines to an intelligence agency."
- solardev 3y ago
  If you discover a zero day in a major operating system, you can sell it and become rich overnight. Or you can play the public hero and end up best buddies with Snowden and exiled from every Western country. The governments don't particularly like whistle blowers. And if you found a backdoor, you probably wouldn't want to use it on every device all at once and reveal its existence. Somebody somewhere will log it. But if you carefully pick and choose your targets, just a few in a million (or several billion), it might not be detected for a long time. White hack groups like Project Zero routinely find these exploits. That doesn't necessarily mean they're planted, it just means that it's definitely possible to hide them from common view, and it takes a lot of skill and dedication to uncover that, then also a strong enough corporate shield to protect you from any possible fallout. Unlike taking pictures of UFOs, it's not just being in the right place at the right time. It takes a very high level of skill that the general population doesn't have.
cookiengineer 3y ago
But "we" have found them for MediaTek chipsets. There is even an APK shared in almost all Telegram channels related to hacking, which includes even uploading your implant for future use as a "demonstration". Also check Mexico incidents of deactivated devices, Samsung, Oppo, Motorola and others have rootkits, too.

dylan604 3y ago

If we believe governments can convince hardware makers to add backdoors, why do we not believe governments can convince CVEs from being removed or not allowed?

Wowfunhappy 3y ago
Because a lot of security research is done by individuals or small firms, and the NSA doesn't generally review disclosures. I find it hard to believe this wouldn't leak, at least in the western world.
- dylan604 3y ago
  And? I don't know the CVE process, so I'm honestly asking while you're not actually answering. Who controls the release of CVEs? Sure, individuals can report something as a vuln, but does the report automatically create a CVE? Or do the reports get verified and then "promoted" to CVE? If the latter, then there's absolutely a part in the process that can be subverted
  - wepple 3y ago
    CVEs have absolutely nothing to do with finding out whether our devices are backdoored. CVEs come out of Mitre, but lots of countries have equivalent systems or tracking codes. Further, large companies are pre-allocated blocks of CVEs to use. But it’s irrelevant. The original position was that if govt are putting obvious remote access into devices, why has nobody ever seen and blogged or tweeted about it?

byteknight 3y ago

That's simply because you haven't looked. There was literally a black hat talk on exploiting cellular networks this year. Every year there seems like there's a new exploit. Just because it doesn't make it to your particular side of the internet doesn't mean it's not happening. Now, can anyone definitively prove that they are back doors and not mistakes or exploits? No. But that's thanks to the age old "Never ascribe to malice that which is adequately explained by incompetence."

Akronymus 3y ago
> There was literally a black hat talk on exploiting cellular networks this year. Is that talk recorded somewhere?
- ccooffee 3y ago
  I assume GP is referring to Title: "Over the Air, Under the Radar: Attacking and Securing the Pixel Modem" Summary/Slides: https://www.blackhat.com/us-23/briefings/schedule/#over-the-air-under-the-radar-attacking-and-securing-the-pixel-modem-33009 https://www.blackhat.com/us-23/briefings/schedule/#over-the-... YouTube (48 minute): https://www.youtube.com/watch?v=QrkB_enz2Pk https://www.youtube.com/watch?v=QrkB_enz2Pk
ActorNightly 3y ago
>There was literally a black hat talk on exploiting cellular networks this year. Talk at black hat =/= everyones devices are de facto vulnerable. For as tech savy as this forum is, its surprising how many people are not well read up on security. The summary of vulnerability is this - if you use a cellular network, your baseband chip vulnerability is next to irrelevant. Your location can be triangulated from radio signals, and its likely that there are messaging contacts and calls that are logged that use the respective celluar services. Now for pure data transmission from a secure messaging app. Most of the communication for privacy is done using end to end encryption apps like Telegram. While those can be compromised, those require a direct targeted attack on the device, you cant just remotely do this over the internet.

smoldesu 3y ago

This article does a good job summing things up: https://www.devever.net/~hl/nosecuresmartphone https://www.devever.net/~hl/nosecuresmartphone > Modern smartphones have a CPU chip, and a baseband chip which handles radio network communications (GSM/UMTS/LTE/etc.) This chip is connected to the CPU via DMA. Thus, unless an IOMMU is used, the baseband has full access to main memory, and can compromise it arbitrarily. > It can be safely assumed that this baseband is highly insecure. It is closed source and probably not audited at all. The problem is less that there are identified issues, and more that the variety of hardware and vulnerability of the implementation is suspicious.

hlandau 3y ago
Author of the above blogpost here. To my knowledge the situation has changed nowadays and IOMMUs on smartphone SoCs are now common. Having said that I still don't rate the security of any smartphone and you should assume it will get compromised. There's a million reasons for this: - Baseband is still radioactive and probably trivially compromised by any nation-state adversary so it's all down to the IOMMU. - IOMMUs are hard to configure correctly and frequently misconfigured by drivers which don't use them correctly. - Any host driver bugs in talking to the baseband might be exploitable. - It's hard to verify an IOMMU is actually working correctly, so it's not like any of this is commonly audited. - We're talking about SoCs here with the baseband usually integrated on the same chip, so there's always the risk of some undocumented channel between the baseband and the rest of the chip the vendor omitted to notice or tell anyone about. The situation is at least better than it was but it's still 100% my assumption that no phone can be trusted in the face of an adversary who can put up a fake cellular network. There's simply far too much proprietary firmware, mysterious black boxes, etc. to be able to really trust these things. Also I'm assuming here there's a desire to get access to the host processor and stored data, but you don't need to do that if you just want to get at the microphone or GPS or leak someone's location or so on. There's a million bad things someone could do getting access just to the baseband even if the IOMMU works right.
ActorNightly 3y ago
Article from 2016 in this area is irrelevant in 2023.

reactordev 3y ago

Normally these agencies “discover” these back doors through admitted confession by those bad actors. Tell us how you did it and we’ll reduce the sentence, kind of thing. Sometimes it’s of their own accord if they are high up enough (NSA) but the majority of law enforcement relies on vendors who use the same exploits as the nefarious bad actors. Only “for good”… the bad actors are always a step ahead and continue to give talks on how badly insecure our pocket computers really are.

warner25 3y ago

I tried to express a similar question / curiosity last year in a discussion about the Intel Management Engine (https://news.ycombinator.com/item?id=33345040#33346166 https://news.ycombinator.com/item?id=33345040#33346166) but you have expressed it better. It's like what intelligent skeptics keep saying in the ongoing discussion of UFOs / UAPs and claims of extraterrestrial visits: With everyone having a camera in their pocket (or, more likely, in their hand) these days, shouldn't there be more compelling photographic evidence of extraordinary things at this point, if extraordinary things are really happening? Edited to add: I guess I said it pretty well further down in that thread, "It does seem like some researcher or journalist should have blown the case open by now if this thing were systematically providing telemetry from everyone's "powered off" (but still plugged in) machines to an intelligence agency."

solardev 3y ago
If you discover a zero day in a major operating system, you can sell it and become rich overnight. Or you can play the public hero and end up best buddies with Snowden and exiled from every Western country. The governments don't particularly like whistle blowers. And if you found a backdoor, you probably wouldn't want to use it on every device all at once and reveal its existence. Somebody somewhere will log it. But if you carefully pick and choose your targets, just a few in a million (or several billion), it might not be detected for a long time. White hack groups like Project Zero routinely find these exploits. That doesn't necessarily mean they're planted, it just means that it's definitely possible to hide them from common view, and it takes a lot of skill and dedication to uncover that, then also a strong enough corporate shield to protect you from any possible fallout. Unlike taking pictures of UFOs, it's not just being in the right place at the right time. It takes a very high level of skill that the general population doesn't have.

cookiengineer 3y ago

But "we" have found them for MediaTek chipsets. There is even an APK shared in almost all Telegram channels related to hacking, which includes even uploading your implant for future use as a "demonstration". Also check Mexico incidents of deactivated devices, Samsung, Oppo, Motorola and others have rootkits, too.