16 ms·

All good points, but why write this in an 'open letter' style to unnamed baseband vendors? Does Google not have sufficient contact with key decision makers at

by xiipie 3y ago

All good points, but why write this in an 'open letter' style to unnamed baseband vendors? Does Google not have sufficient contact with key decision makers at Qualcomm, MediaTek, Samsung, etc. to encourage them to improve the the security of their baseband firmware? Those are the people who really need to be convinced.

deleted 3y ago
[deleted]
DiabloD3 3y ago
It isn't about "sufficient contact". Google knows exactly who to call at any of these companies, and those people will pick up the phone when they see Google is the one calling. Qualcomm actively botches the security of their products as per request of many governments. The purpose of the letter is to openly shame these companies without directly accusing them of foul play, instead of gently painting them with the brush of mere incompetence, mere lack of knowledge how modern tooling works.
- xiipie 3y ago
  > Qualcomm actively botches the security of their products as per request of many governments. Interesting, I was not aware that's what they're doing. Is there evidence of this?
  - avidiax 3y ago
    I doubt there's publicly available evidence. Assuming incompetence before malice, I'd say that Qualcomm and the other 5G baseband manufacturers have such a moat around cellular modems that it doesn't need to be secure. It's not a competitive advantage. A security critical application simply assumes that the network and the 5G baseband are compromised.
    - jjav 3y ago
      I have no idea how the bugs ends up where they end up. I remember a pretty egregious mis-implementation in a qualcomm rsa encryption module many startups ago when I was using that, I never heard back about the bug report. That was over a decade ago so surely it's fixed by now I guess. I guess?
    - mschuster91 3y ago
      > Assuming incompetence before malice You may be on the right track here. It's just one anonymous HN comment [1], but it fits other pieces (e.g. BSP code dump quality). The sad thing is, there is no competition where one could go to - it's either Mediatek who have serious issues of their own, or Samsung who mostly stick to themselves. [1] https://news.ycombinator.com/item?id=38607205 https://news.ycombinator.com/item?id=38607205
      - tripdout 3y ago
        > BSP code dump quality I know they're proprietary, but got any more info on this? Would be super interesting.
    - tuckerpo 3y ago
      Mobile standards themselves are largely driven by groups like 3GPP in order to hopefully skirt around oligopolies like Qualcomm who intentionally patent the entire superset of the Latin alphabet in order to sue anyone with a heartbeat. So, security itself is driven by third party organization(s) that consists of engineers from mobile technology companies. If Qualcomm wants their cell modems to be 3GPP certified, they _must_ comply to the 5G standard in it's fullest, including all security features (the same will be true for future revisions, 6G, etc) There's also groups attempting to make mobile protocols and provisioning entirely open source (O-RAN) which, ironically, will likely improve mobile protocol implementation security practices as they can be audited by anyone with an internet connection.
- abdullahkhalids 3y ago
  What's stopping two trillion dollar corporations who assemble/build their own phones and phone OSes from designing/manufacturing their own secure baseband chip and getting it certified?
  - DiabloD3 3y ago
    Qualcomm owns patents on an international standard. They sued Apple and arguably won, although they settled out of court. Apple had bought Intel's LTE unit and the patents that came with it, and Qualcomm and Intel both licensed patents into a common pool (and as such, any member of that pool did not owe any other member royalties); Apple inherited Intel's position in the pool and continued licensing patents to the pool with no change. Apple stopped paying Qualcomm the LTE blood money. _Qualcomm still sued and made money_. If Apple can't secure a win against Qualcomm, how the hell can Google? Also, Qualcomm will _never_ license patents (under FRAND or otherwise) to competing vendors; the only way to be allowed to make LTE modems for the west is to be part of that pool. Oh, and btw? Apple was making their (Intel-based) modem in-house for like two generations while that whole thing happened. They're back to buying Qualcomm modems again.
    - abdullahkhalids 3y ago
      Thank you. I didn't know that. It seems two essential patents will expire in 2029 and 2030 [1]. So we are basically stuck in this mess till then. [1] http://www.fosspatents.com/2022/06/lessons-from-rejection-of-apples-cert.html http://www.fosspatents.com/2022/06/lessons-from-rejection-of...
    - wyldfire 3y ago
      > Apple stopped paying Qualcomm the LTE blood money. "blood money"? Why so many tears for the most valuable business on Earth? When they picked Qualcomm for their 4G modem, the terms were clear. And then they decided to renegotiate the terms afterwards by telling their manufacturer to withhold the payments to Qualcomm. > _Qualcomm still sued and made money_. They negotiated a settlement, Qualcomm got less than they were owed and Apple paid less than the royalties due. Why did Apple settle? Because they had to make design decisions about their new phone - like which modem vendor to use. If you decide not to pay your supplier you could imagine they'd want to work that out before agreeing to give you samples of their new design. If Apple felt that they'd win the case on the merits and that the Qualcomm modem design didn't perform well, they would have just picked a competitor like Samsung. But they didn't do that. They even dual-sourced modems for iphone 7 in order to preserve their negotiating position. But that didn't work because the iphones with Intel modem performed worse than iphones with Qualcomm modems. > If Apple can't secure a win against Qualcomm, how the hell can Google? Google "did" secure a win, didn't they? They took their ball and went home. They decided to take the Samsung Exynos SoC and modem for their flagship phone. > They're back to buying Qualcomm modems again. ... because they're better than the competition - including their acquisition? Is it your contention that Qualcomm somehow forced Apple to pick them over their own?

by xiipie 3y ago

deleted 3y ago

[deleted]

DiabloD3 3y ago

It isn't about "sufficient contact". Google knows exactly who to call at any of these companies, and those people will pick up the phone when they see Google is the one calling. Qualcomm actively botches the security of their products as per request of many governments. The purpose of the letter is to openly shame these companies without directly accusing them of foul play, instead of gently painting them with the brush of mere incompetence, mere lack of knowledge how modern tooling works.

xiipie 3y ago
> Qualcomm actively botches the security of their products as per request of many governments. Interesting, I was not aware that's what they're doing. Is there evidence of this?
- avidiax 3y ago
  I doubt there's publicly available evidence. Assuming incompetence before malice, I'd say that Qualcomm and the other 5G baseband manufacturers have such a moat around cellular modems that it doesn't need to be secure. It's not a competitive advantage. A security critical application simply assumes that the network and the 5G baseband are compromised.
  - jjav 3y ago
    I have no idea how the bugs ends up where they end up. I remember a pretty egregious mis-implementation in a qualcomm rsa encryption module many startups ago when I was using that, I never heard back about the bug report. That was over a decade ago so surely it's fixed by now I guess. I guess?
  - mschuster91 3y ago
    > Assuming incompetence before malice You may be on the right track here. It's just one anonymous HN comment [1], but it fits other pieces (e.g. BSP code dump quality). The sad thing is, there is no competition where one could go to - it's either Mediatek who have serious issues of their own, or Samsung who mostly stick to themselves. [1] https://news.ycombinator.com/item?id=38607205 https://news.ycombinator.com/item?id=38607205
    - tripdout 3y ago
      > BSP code dump quality I know they're proprietary, but got any more info on this? Would be super interesting.
  - tuckerpo 3y ago
    Mobile standards themselves are largely driven by groups like 3GPP in order to hopefully skirt around oligopolies like Qualcomm who intentionally patent the entire superset of the Latin alphabet in order to sue anyone with a heartbeat. So, security itself is driven by third party organization(s) that consists of engineers from mobile technology companies. If Qualcomm wants their cell modems to be 3GPP certified, they _must_ comply to the 5G standard in it's fullest, including all security features (the same will be true for future revisions, 6G, etc) There's also groups attempting to make mobile protocols and provisioning entirely open source (O-RAN) which, ironically, will likely improve mobile protocol implementation security practices as they can be audited by anyone with an internet connection.
abdullahkhalids 3y ago
What's stopping two trillion dollar corporations who assemble/build their own phones and phone OSes from designing/manufacturing their own secure baseband chip and getting it certified?
- DiabloD3 3y ago
  Qualcomm owns patents on an international standard. They sued Apple and arguably won, although they settled out of court. Apple had bought Intel's LTE unit and the patents that came with it, and Qualcomm and Intel both licensed patents into a common pool (and as such, any member of that pool did not owe any other member royalties); Apple inherited Intel's position in the pool and continued licensing patents to the pool with no change. Apple stopped paying Qualcomm the LTE blood money. _Qualcomm still sued and made money_. If Apple can't secure a win against Qualcomm, how the hell can Google? Also, Qualcomm will _never_ license patents (under FRAND or otherwise) to competing vendors; the only way to be allowed to make LTE modems for the west is to be part of that pool. Oh, and btw? Apple was making their (Intel-based) modem in-house for like two generations while that whole thing happened. They're back to buying Qualcomm modems again.
  - abdullahkhalids 3y ago
    Thank you. I didn't know that. It seems two essential patents will expire in 2029 and 2030 [1]. So we are basically stuck in this mess till then. [1] http://www.fosspatents.com/2022/06/lessons-from-rejection-of-apples-cert.html http://www.fosspatents.com/2022/06/lessons-from-rejection-of...
  - wyldfire 3y ago
    > Apple stopped paying Qualcomm the LTE blood money. "blood money"? Why so many tears for the most valuable business on Earth? When they picked Qualcomm for their 4G modem, the terms were clear. And then they decided to renegotiate the terms afterwards by telling their manufacturer to withhold the payments to Qualcomm. > _Qualcomm still sued and made money_. They negotiated a settlement, Qualcomm got less than they were owed and Apple paid less than the royalties due. Why did Apple settle? Because they had to make design decisions about their new phone - like which modem vendor to use. If you decide not to pay your supplier you could imagine they'd want to work that out before agreeing to give you samples of their new design. If Apple felt that they'd win the case on the merits and that the Qualcomm modem design didn't perform well, they would have just picked a competitor like Samsung. But they didn't do that. They even dual-sourced modems for iphone 7 in order to preserve their negotiating position. But that didn't work because the iphones with Intel modem performed worse than iphones with Qualcomm modems. > If Apple can't secure a win against Qualcomm, how the hell can Google? Google "did" secure a win, didn't they? They took their ball and went home. They decided to take the Samsung Exynos SoC and modem for their flagship phone. > They're back to buying Qualcomm modems again. ... because they're better than the competition - including their acquisition? Is it your contention that Qualcomm somehow forced Apple to pick them over their own?