5 ms·
They are probably not even lying that the baseband processor is shut down by the application processor, as it controls the power and system clocks. But the dir
by revelation 13y ago
They are probably not even lying that the baseband processor is shut down by the application processor, as it controls the power and system clocks.
But the dirty little secret is that the baseband processor is still a completely uncontrolled subsystem, loaded with some propietary binary blob by trustworthy companies like Qualcomm. GPS and even the microphones are usually integrated into the baseband, not part of the application processor that runs your Android. So you have a perfectly capable ARM processor running a propietary RTOS system, written completely in C (or C++ occasionally) with access to all the vital periphery and a gigantic attack surface in dealing with all the mobile communication protocols. The only reason there hasn't been a complete breakdown yet is that it's difficult for amateur researchers to exploit, you need expensive RF hardware and the mobile communication protocols are huge bodies of closed committee designed standards. But it is without a doubt in the reach of the NSA, and they are probably actively exploiting baseband processors already.
(Interestingly, since baseband processor have grown in complexity, most smartphones can now update the firmware on them, so there are lots of firmware images floating around. I highly recommend just even running strings on them, its quite enlightening. Some examples from a Nexus 4 radio:
Failed do spoof USB cable disconnection
Assertion os_mutex_pool_ptr[mutex_index_in_pool].is_available == 0 failed
hsu_al_ser_open: hsu_al_ser_base_open for port NMEA (%d) returned failure
Conversion to UTF-16 failed! Returned %d, expected %d
Unexpected IP family %d - assuming IPv4
inflate 1.2.3 Copyright 1995-2005 Mark Adler
Received ARP Request
CxM - Received WLAN Early Grant Release
(Yes, these are format strings! And this device has all the good stuff: classic 2005 zlib, a homebrew network stack, homebrew character conversion routines, homebrew operating system, homebrew USB stack...)
- brokenparser 13y agoThe only proper way to turn off a phone is to remove the battery, in lieu of nuking it from orbit (just to be sure).
- lotsofcows 13y agoBut is that the only battery? Is there a battery or cap powering the clock for example? Can that be corrupted?
- nwh 13y agoPhones certainly don't have big enough capacitors to store enough power to run a radio. There's probably only a few pF of capacitance in an entire iPhone for example, though it not having an easily removable battery makes that a little moot.
- lotsofcows 13y agoI've had a look at a few teardowns but can't find another battery. My 'phone copes with the battery being removed while in offline mode so there's power somewhere.
- a3n 13y agoBut they probably do have enough power somewhere to silently turn themselves on, say briefly, according to some schedule or event. Not saying it's being done, but it could be done.
- nwh 13y agoWhere? No other components store power in any way. There's a few small capacitors lying around, but they're so small that you could never power anything from them. If something like this existed, people would have noticed a long, long time ago.
- frandroid 13y agoThe "battery to keep your clock on time problem" was a problem of the offline PC world. Cellphones just need to get network time when they boot if they lost time. Thus manufacturers shouldn't need to include a separate clock battery in the limited space on a phone body.
- joosters 13y agoThat's no good. You might power your phone back on in an area without network coverage, or the signal might take too long to receive after power up, or you are running in flight mode on a plane, or ... Basically, you still need a local clock.
- marvin 13y agoA Faraday cage should also ensure that no one can track you.
- ballard 13y agoAs seen on KS: http://offpocket.com/ http://offpocket.com/
- specto 13y agoSeems like the price is a bit steep for a little bit of fabric.
- headShrinker 13y agoIndeed, a metal cocktail shaker works as a faraday device as well.
- Zenst 13y agoMaybe a use for that old microwave.
- GotAnyMegadeth 13y agoor a tinfoil hat!
- urlwolf 13y agoTotally unrelated, but I'd like to quote something you wrote on the 'academia vs industry' thread. Could you please contact me? (email in my user profile)? Thanks! (this would only work if marvin is monitoring his comments; apologies for the noise, everyone...!)
- dobbsbob 13y agoCryptophone GSMK has a 'baseband firewall' that will shut down the stack if its continuously active without the application cpu also being active, meaning shenanigans are afoot like being spammed with type0 SMS to track you silently. They test it by walking into airports which all have some kind of national security baseband attack going on
- revelation 13y agoThat's nice, but it is one hell of a side channel :) Some people have been trying to implement detection for e.g. silent SMS or IMSI catchers in osmocombb (the first open source baseband), see [1], but there doesn't seem to be any recent progress. 1: https://opensource.srlabs.de/projects/catcher/wiki https://opensource.srlabs.de/projects/catcher/wiki
- dobbsbob 13y agoI guess end to end encryption with Redphone or Ostel would defeat stingray/imsi catchers but no idea with type0 sms spam tracking. Use a faraday pocket :/ Chaos Computer Club reverse engineered some Qualcomm basebands to find them running in ARM supervisor mode with no NX bit. NSA must love that