4 ms·

> Qualcomm actively botches the security of their products as per request of many governments. Interesting, I was not aware that's what they're doing. Is there

by xiipie 3y ago

> Qualcomm actively botches the security of their products as per request of many governments. Interesting, I was not aware that's what they're doing. Is there evidence of this?

avidiax 3y ago
I doubt there's publicly available evidence. Assuming incompetence before malice, I'd say that Qualcomm and the other 5G baseband manufacturers have such a moat around cellular modems that it doesn't need to be secure. It's not a competitive advantage. A security critical application simply assumes that the network and the 5G baseband are compromised.
- jjav 3y ago
  I have no idea how the bugs ends up where they end up. I remember a pretty egregious mis-implementation in a qualcomm rsa encryption module many startups ago when I was using that, I never heard back about the bug report. That was over a decade ago so surely it's fixed by now I guess. I guess?
- mschuster91 3y ago
  > Assuming incompetence before malice You may be on the right track here. It's just one anonymous HN comment [1], but it fits other pieces (e.g. BSP code dump quality). The sad thing is, there is no competition where one could go to - it's either Mediatek who have serious issues of their own, or Samsung who mostly stick to themselves. [1] https://news.ycombinator.com/item?id=38607205 https://news.ycombinator.com/item?id=38607205
  - tripdout 3y ago
    > BSP code dump quality I know they're proprietary, but got any more info on this? Would be super interesting.
- tuckerpo 3y ago
  Mobile standards themselves are largely driven by groups like 3GPP in order to hopefully skirt around oligopolies like Qualcomm who intentionally patent the entire superset of the Latin alphabet in order to sue anyone with a heartbeat. So, security itself is driven by third party organization(s) that consists of engineers from mobile technology companies. If Qualcomm wants their cell modems to be 3GPP certified, they _must_ comply to the 5G standard in it's fullest, including all security features (the same will be true for future revisions, 6G, etc) There's also groups attempting to make mobile protocols and provisioning entirely open source (O-RAN) which, ironically, will likely improve mobile protocol implementation security practices as they can be audited by anyone with an internet connection.

by xiipie 3y ago

> Qualcomm actively botches the security of their products as per request of many governments. Interesting, I was not aware that's what they're doing. Is there evidence of this?

avidiax 3y ago

I doubt there's publicly available evidence. Assuming incompetence before malice, I'd say that Qualcomm and the other 5G baseband manufacturers have such a moat around cellular modems that it doesn't need to be secure. It's not a competitive advantage. A security critical application simply assumes that the network and the 5G baseband are compromised.

jjav 3y ago
I have no idea how the bugs ends up where they end up. I remember a pretty egregious mis-implementation in a qualcomm rsa encryption module many startups ago when I was using that, I never heard back about the bug report. That was over a decade ago so surely it's fixed by now I guess. I guess?
mschuster91 3y ago
> Assuming incompetence before malice You may be on the right track here. It's just one anonymous HN comment [1], but it fits other pieces (e.g. BSP code dump quality). The sad thing is, there is no competition where one could go to - it's either Mediatek who have serious issues of their own, or Samsung who mostly stick to themselves. [1] https://news.ycombinator.com/item?id=38607205 https://news.ycombinator.com/item?id=38607205
- tripdout 3y ago
  > BSP code dump quality I know they're proprietary, but got any more info on this? Would be super interesting.
tuckerpo 3y ago
Mobile standards themselves are largely driven by groups like 3GPP in order to hopefully skirt around oligopolies like Qualcomm who intentionally patent the entire superset of the Latin alphabet in order to sue anyone with a heartbeat. So, security itself is driven by third party organization(s) that consists of engineers from mobile technology companies. If Qualcomm wants their cell modems to be 3GPP certified, they _must_ comply to the 5G standard in it's fullest, including all security features (the same will be true for future revisions, 6G, etc) There's also groups attempting to make mobile protocols and provisioning entirely open source (O-RAN) which, ironically, will likely improve mobile protocol implementation security practices as they can be audited by anyone with an internet connection.