9 ms·

Samsung Galaxy Back-door

437 points by wfn 13y ago

higherpurpose 13y ago
So it seems our biggest worry, that the modem firmware could be backdoored was very warranted indeed. We need to push OEMs and modem makers to open source the firmware for their modems.
- mschuster91 13y ago
  Which doesnt help against silicon-level backdoors, which for all we know, exist and get exploited :/ edit: this includes so called "undocumented features" like maintenance access etc.
  - yeukhon 13y ago
    That's my least concern to be honest. My rice cooker could have a spy device installed without me knowing. I think the first priority is software exploits and backdoors because they are the easiest to implement and the cheapest to operate with.
    - sillysaurus3 13y ago
      Actually, it's sort of a myth that hardware is fundamentally harder than software. The toolsets simply haven't been as powerful until recently. Hardware can be thought of as hardcoded software. But it's no longer the case that hardware is hardcoded. Hardware is becoming increasingly sophisticated, especially in their ability to be reprogrammed on the fly.
      - nathancahill 13y ago
        > "Hardware.. ability to be reprogrammed on the fly." Um.. that's not hardware.
        mschuster91 13y ago
        Yeah, firmware. Programmable hardware. And these days, everyone and their dog is programmable...
        GeneralMayhem 13y ago
        The line is a little fuzzy, but I'd consider EEPROM to be essentially programmable hardware. x86 has dozens of nonstandard but functional opcodes; how do you know that none of them does something unfortunate?
        im3w1l 13y ago
        You don't even need that. You could even just have a completely ordinary, run of the mill, valid opcode do something unexpected when given "magic" data. Like if you mov the value 0xDEADBEEFBAADF00D, the code also jmp's to the top of the stack, as an easter egg.
        drdaeman 13y ago
        FPGAs are pretty much hardware. And they're reprogrammable, as in "re-wireable".
        nathancahill 13y ago
        Interesting. I did not know that.
      - yeukhon 13y ago
        Regarding hardware reprogrammed on the fly. That sounds like something FPGA is really good at for powerful computation, except, you can't make a sensor detector unless there is already a physical sensor detector attached. It would be cool to make hardware to make hardware :)
    - taneliv 13y ago
      That's true, but network equipment, including mobile baseband processors, are silicon as well. Exploiting them would need help from the network operator, but I think mobile carriers are not very protective of their customers against government inquiries (or at all).
      - mschuster91 13y ago
        Why go to the network operator? Simply fire up your own, the hardware is sub-$1000 these days and the software open source.
        deleted 13y ago
        [deleted]
  - nathancahill 13y ago
    That's exactly right. Also, maintenance access is one of the easiest backdoors to exploit. The Target credit card breach was done through the maintence access in the HVAC system.
  - bsder 13y ago
    True. Nevertheless, silicon backdoors tend to be way more expensive to exploit and often require physical access. This is in opposition to software backdoors which allow someone sitting in a room 4000km away to own you with no outlay of money or resources on their part. One problem at a time. Once we get the software stack open, then we can start going after the hardware stack.
jmomo 13y ago
This reads mostly like an advert for Replicant. "However, when Replicant is installed on the device, this back-door is not effective: Replicant does not cooperate with back-doors." I am sure that people who run alternative ROMs/OSes would like to know if they are affected or not, but there doesn't seem to be much mention of that... except this line, which seems to indicate that at least Cyanogen IS affected: "Alternatively, the kernel could block the incriminated RFS requests and keep a trace of them in the logs for the record. That option would work for CyanogenMod, where the incriminated proprietary blob is still used." I've heard about Replicant before and am interested in it, but something about a self-serving warning like that turns me off. EDIT: Okay, my bad. I thought this was like a public announcement, not just a wiki page. That makes the context different, so my comments about reading like an advert are not nearly as applicable.
deleted 13y ago
[deleted]
fragsworth 13y ago
It's not clear to me the important issues: what data can they access (all of it?), who can access it, and under what circumstances?
- db48x 13y ago
  On phones where the IPC driver is running as root, then it can access any file on the device. On phones where it is running as the user, then it can access any file owned by the user. There's a chart.
hydralist 13y ago
eli5?
- jmomo 13y ago
  This isn't reddit, and if you are five, then you should be in day care.
  - jonalmeida 13y ago
    You shouldn't insult people who are curious to learn and/or shun them.
    - acjohnson55 13y ago
      I agree that the response was disrespectful. But I also don't think the original post showed much intellectual curiosity.
  - vacri 13y ago
    Hacker News is a marketing implement for a business development company, whose primary mission is taking inexperienced people and giving them a leg up. The idea that you have to be an expert in everything before you ask anything runs counter to the point of the site.
- chinpokomon 13y ago
  Your phone has 2 (or more) processors in it. One that runs the kernel and the operating system that you think about as being Android. The other is another ARM processor that runs closed, proprietary code, and it controls the radio. The concern is that the proprietary code has an API that can access the filesystem. If the MODEM receives a command from the cellular tower, or another device that looks like the cellular tower, it looks as though the radio's processor could be instructed to extract data from your phone and perhaps send it out over the radio to some other party. The reverse could be done as well, putting data on your device. Since this happens low-level, it communicates with the kernel on your main processor and is outside the normal security measures placed on regular applications running on your device. If the radio firmware doesn't have an explicit way to perform this task, the other concern is that a vulnerability in the radio firmware might be exploited to do this anyway. Because the radio firmware itself is closed source and proprietary, the real implications of this are still not well understood. The project that discovered this about the radio firmware is trying to create an open-source replacement firmware that runs on your radio's processor. In the course of trying to implement a compatible firmware, they discovered these questionable APIs. The implication is that even if you completely replaced your ROM on device with a trusted and secure open-sourced one, the proprietary closed-source drivers that are needed to communicate with the hardware, may be able to do things without your permission or detection.
flyinglizard 13y ago
My understanding is that there's simply filesystem access for the modem, through some Samsung supplied kernel driver. Replicant implies Samsung may have another backdoor in the modem itself, allowing to remotely issue commands accessing the phone's filesystem. That is pure speculation and FUD. "Samsung Galaxy devices running proprietary Android versions come with a back-door that provides remote access to the data stored on the device. In particular, the proprietary software that is in charge of handling the communications with the modem, using the Samsung IPC protocol, implements a class of requests known as RFS commands, that allows the modem to perform remote I/O operations on the phone's storage. As the modem is running proprietary software, it is likely that it offers over-the-air remote control, that could then be used to issue the incriminated RFS messages and access the phone's file system." Nothing substantiated there, just speculation. Edit: This is not even interesting, and I'll explain why: normally, any component that has a kernel driver can already access all your data. The network interface in your PC can already do just the same - it has some proprietary firmware running on it, as well as a privileged OS driver that can see anything the system does; and it's connected to the internet. Most likely, Samsung placed the driver there for providing a convenient storage area for the modem's firmware, in case it requires one (for logging, updating or whatever).
- rst 13y ago
  You don't have to suspect a deliberate back-door in the "modem" software to be worried about this; you just need to think that it might have an exploitable bug. And odds are very good that it does. See, for example, the following: http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...
  - flyinglizard 13y ago
    No doubt this thing is full of holes, but the fact the modem can directly access the RFS barely registers as an elevated security threat. There's so much an attacker can normally do when they control the modem (MITM, exploiting system services, etc).
undoware 13y ago
I know this will not be a popular thing to hear, but the scope of the problem has convinced me that this won't end until everything is open. The only trustable stack is one that begins with open hardware and ends with creative commons content in ogg in VLC on linux. I love open source, but.... it's going to be damn hard to turn a buck. So, which do we want more: the ability to make money and the right to be paid for our work, or liberty and privacy? That is one hell of a would-you-rather. Thanks, NSA, for forcing a disgusting thought experiment into the real world.
- kordless 13y ago
  > it's going to be damn hard to turn a buck How about turning a micro Bitcoin with it?
- kansface 13y ago
  An open stack is not enough because you can't trust any compiled software. In practice, even if we had a completely open stack and no binaries, we can't even begin to write error free code. Defeating the NSA [via software], a billion dollar agency with the power to ruin your life is completely unrealistic. Any real change must come through political action.
  - badinker 13y ago
    Political action? How has voting worked for you? My hope is as the dollar starts to inflate away (like every other fiat currency that has ever existed) we all instead turn to a block chain currency. Something that can't be manipulated. Something that can't be stolen from us and used to fund three letter agencies.
    - Steko 13y ago
      How are those hyperinflation calls working out for you?
      - dmix 13y ago
        idk about American inflation, but as a Canadian getting paid in USD, the value of USD has decline significantly since last year. Lowest since 2009: http://www.xe.com/currencycharts/?from=CAD&to=USD&view=10Y http://www.xe.com/currencycharts/?from=CAD&to=USD&view=10Y I got a nearly 10% raise thanks to a strong Canadian economy and weak American one. Keep it up guys.
atulagarwal 13y ago
In my understanding, it needs operator level access to control the modem, or is it also possible to control the model using a MITM like scenario (off the air interception). If the latter is possible, it can become all the worrisome! Any ideas?
- mschuster91 13y ago
  Yeah, of course. Calls itself IMSI Catcher (the variant used by police/secret service). You can build one yourself with OsmocomBB and the rest of that open-source GSM network infrastructure stuff. Voila, there is your operator-level access from the radio side.
caiob 13y ago
It's a Samsung. I find hard to believe that Samsung smartphone users have any concern about privacy and/or security.
- Nanzikambe 13y ago
  Care to elaborate? As a linux user, and (very) amateur kernel hacker I've always bought Samsung phones because they've been pretty forecoming with releasing the source for their android devices: http://www.androidcentral.com/samsung-galaxy-s4-kernel-source-released http://www.androidcentral.com/samsung-galaxy-s4-kernel-sourc... Obviously this is a GPL compliance thing, but it enables security minded people like myself to root the device, inspect the underlying source, and secure it pretty much like a regular box. What alternative do you suggest?
  - drdaeman 13y ago
    > releasing the source for their android devices > it enables security minded people like myself to root the device Actually, having kernel sources doesn't enable you anything except for, possibly (but not certainly), building (but not installing) your own kernel. You're able to install customized kernel and/or recovery on most Samsung phones, but that's completely unrelated to any FLOSS source code releases. Actually, this is usually done using proprietary tool (ODIN) communicating with proprietary hardware and firmware. They're just generous to allow you to do so (but they tick a flag stating your firmware is unofficial, and recently they started to blow a fuse to prevent unticking)
SeanLuke 13y ago
> Samsung Galaxy devices running proprietary Android versions ... > Nexus S I am confused. The Nexus S does not run a proprietary Android version.
- mey 13y ago
  I may be misreading the link, but proprietary seems to be using to describe non-open source binary blobs. This is typical of drivers, most chips on cellphones do not have open source software to control them. Typically these pieces of software are modem/radio chips etc.
- reluck 13y ago
  Binary blobs, drivers.
- zurn 13y ago
  It does - the stock "unspoiled" version of Android that comes with Nexus devices still has lots and lots of proprietary binary-only code. This post is from the Replicant project, who are trying to build an open source system on top of the free Android subset.
chatman 13y ago
Free Software Foundation & Richard Stallman always warned everyone of the potential dangers of non-free software, even as drivers like these modem drivers.
akiselev 13y ago
For those who are saying that this isn't a backdoor, you can actually force execute this command on GSM phones for a few thousand dollars [1] [2]. [1] http://rangenetworks.com/products/openbts-development-kit http://rangenetworks.com/products/openbts-development-kit [2] https://www.youtube.com/watch?v=RXqQioV_bpo https://www.youtube.com/watch?v=RXqQioV_bpo
exo762 13y ago
I wonder how many individuals right now are working on exploiting this potential hole to steal BTC.
johnny635 13y ago
NSA approved phone.

437 points by wfn 13y ago

So it seems our biggest worry, that the modem firmware could be backdoored was very warranted indeed. We need to push OEMs and modem makers to open source the firmware for their modems.

mschuster91 13y ago
Which doesnt help against silicon-level backdoors, which for all we know, exist and get exploited :/ edit: this includes so called "undocumented features" like maintenance access etc.
- yeukhon 13y ago
  That's my least concern to be honest. My rice cooker could have a spy device installed without me knowing. I think the first priority is software exploits and backdoors because they are the easiest to implement and the cheapest to operate with.
  - sillysaurus3 13y ago
    Actually, it's sort of a myth that hardware is fundamentally harder than software. The toolsets simply haven't been as powerful until recently. Hardware can be thought of as hardcoded software. But it's no longer the case that hardware is hardcoded. Hardware is becoming increasingly sophisticated, especially in their ability to be reprogrammed on the fly.
    - nathancahill 13y ago
      > "Hardware.. ability to be reprogrammed on the fly." Um.. that's not hardware.
      - mschuster91 13y ago
        Yeah, firmware. Programmable hardware. And these days, everyone and their dog is programmable...
      - GeneralMayhem 13y ago
        The line is a little fuzzy, but I'd consider EEPROM to be essentially programmable hardware. x86 has dozens of nonstandard but functional opcodes; how do you know that none of them does something unfortunate?
        im3w1l 13y ago
        You don't even need that. You could even just have a completely ordinary, run of the mill, valid opcode do something unexpected when given "magic" data. Like if you mov the value 0xDEADBEEFBAADF00D, the code also jmp's to the top of the stack, as an easter egg.
      - drdaeman 13y ago
        FPGAs are pretty much hardware. And they're reprogrammable, as in "re-wireable".
        nathancahill 13y ago
        Interesting. I did not know that.
    - yeukhon 13y ago
      Regarding hardware reprogrammed on the fly. That sounds like something FPGA is really good at for powerful computation, except, you can't make a sensor detector unless there is already a physical sensor detector attached. It would be cool to make hardware to make hardware :)
  - taneliv 13y ago
    That's true, but network equipment, including mobile baseband processors, are silicon as well. Exploiting them would need help from the network operator, but I think mobile carriers are not very protective of their customers against government inquiries (or at all).
    - mschuster91 13y ago
      Why go to the network operator? Simply fire up your own, the hardware is sub-$1000 these days and the software open source.
      - deleted 13y ago
        [deleted]
- nathancahill 13y ago
  That's exactly right. Also, maintenance access is one of the easiest backdoors to exploit. The Target credit card breach was done through the maintence access in the HVAC system.
- bsder 13y ago
  True. Nevertheless, silicon backdoors tend to be way more expensive to exploit and often require physical access. This is in opposition to software backdoors which allow someone sitting in a room 4000km away to own you with no outlay of money or resources on their part. One problem at a time. Once we get the software stack open, then we can start going after the hardware stack.

jmomo 13y ago

This reads mostly like an advert for Replicant. "However, when Replicant is installed on the device, this back-door is not effective: Replicant does not cooperate with back-doors." I am sure that people who run alternative ROMs/OSes would like to know if they are affected or not, but there doesn't seem to be much mention of that... except this line, which seems to indicate that at least Cyanogen IS affected: "Alternatively, the kernel could block the incriminated RFS requests and keep a trace of them in the logs for the record. That option would work for CyanogenMod, where the incriminated proprietary blob is still used." I've heard about Replicant before and am interested in it, but something about a self-serving warning like that turns me off. EDIT: Okay, my bad. I thought this was like a public announcement, not just a wiki page. That makes the context different, so my comments about reading like an advert are not nearly as applicable.

deleted 13y ago

[deleted]

fragsworth 13y ago

It's not clear to me the important issues: what data can they access (all of it?), who can access it, and under what circumstances?

db48x 13y ago
On phones where the IPC driver is running as root, then it can access any file on the device. On phones where it is running as the user, then it can access any file owned by the user. There's a chart.

hydralist 13y ago

eli5?

jmomo 13y ago
This isn't reddit, and if you are five, then you should be in day care.
- jonalmeida 13y ago
  You shouldn't insult people who are curious to learn and/or shun them.
  - acjohnson55 13y ago
    I agree that the response was disrespectful. But I also don't think the original post showed much intellectual curiosity.
- vacri 13y ago
  Hacker News is a marketing implement for a business development company, whose primary mission is taking inexperienced people and giving them a leg up. The idea that you have to be an expert in everything before you ask anything runs counter to the point of the site.
chinpokomon 13y ago
Your phone has 2 (or more) processors in it. One that runs the kernel and the operating system that you think about as being Android. The other is another ARM processor that runs closed, proprietary code, and it controls the radio. The concern is that the proprietary code has an API that can access the filesystem. If the MODEM receives a command from the cellular tower, or another device that looks like the cellular tower, it looks as though the radio's processor could be instructed to extract data from your phone and perhaps send it out over the radio to some other party. The reverse could be done as well, putting data on your device. Since this happens low-level, it communicates with the kernel on your main processor and is outside the normal security measures placed on regular applications running on your device. If the radio firmware doesn't have an explicit way to perform this task, the other concern is that a vulnerability in the radio firmware might be exploited to do this anyway. Because the radio firmware itself is closed source and proprietary, the real implications of this are still not well understood. The project that discovered this about the radio firmware is trying to create an open-source replacement firmware that runs on your radio's processor. In the course of trying to implement a compatible firmware, they discovered these questionable APIs. The implication is that even if you completely replaced your ROM on device with a trusted and secure open-sourced one, the proprietary closed-source drivers that are needed to communicate with the hardware, may be able to do things without your permission or detection.

flyinglizard 13y ago

My understanding is that there's simply filesystem access for the modem, through some Samsung supplied kernel driver. Replicant implies Samsung may have another backdoor in the modem itself, allowing to remotely issue commands accessing the phone's filesystem. That is pure speculation and FUD. "Samsung Galaxy devices running proprietary Android versions come with a back-door that provides remote access to the data stored on the device. In particular, the proprietary software that is in charge of handling the communications with the modem, using the Samsung IPC protocol, implements a class of requests known as RFS commands, that allows the modem to perform remote I/O operations on the phone's storage. As the modem is running proprietary software, it is likely that it offers over-the-air remote control, that could then be used to issue the incriminated RFS messages and access the phone's file system." Nothing substantiated there, just speculation. Edit: This is not even interesting, and I'll explain why: normally, any component that has a kernel driver can already access all your data. The network interface in your PC can already do just the same - it has some proprietary firmware running on it, as well as a privileged OS driver that can see anything the system does; and it's connected to the internet. Most likely, Samsung placed the driver there for providing a convenient storage area for the modem's firmware, in case it requires one (for logging, updating or whatever).

rst 13y ago
You don't have to suspect a deliberate back-door in the "modem" software to be worried about this; you just need to think that it might have an exploitable bug. And odds are very good that it does. See, for example, the following: http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...
- flyinglizard 13y ago
  No doubt this thing is full of holes, but the fact the modem can directly access the RFS barely registers as an elevated security threat. There's so much an attacker can normally do when they control the modem (MITM, exploiting system services, etc).

undoware 13y ago

I know this will not be a popular thing to hear, but the scope of the problem has convinced me that this won't end until everything is open. The only trustable stack is one that begins with open hardware and ends with creative commons content in ogg in VLC on linux. I love open source, but.... it's going to be damn hard to turn a buck. So, which do we want more: the ability to make money and the right to be paid for our work, or liberty and privacy? That is one hell of a would-you-rather. Thanks, NSA, for forcing a disgusting thought experiment into the real world.

kordless 13y ago
> it's going to be damn hard to turn a buck How about turning a micro Bitcoin with it?
kansface 13y ago
An open stack is not enough because you can't trust any compiled software. In practice, even if we had a completely open stack and no binaries, we can't even begin to write error free code. Defeating the NSA [via software], a billion dollar agency with the power to ruin your life is completely unrealistic. Any real change must come through political action.
- badinker 13y ago
  Political action? How has voting worked for you? My hope is as the dollar starts to inflate away (like every other fiat currency that has ever existed) we all instead turn to a block chain currency. Something that can't be manipulated. Something that can't be stolen from us and used to fund three letter agencies.
  - Steko 13y ago
    How are those hyperinflation calls working out for you?
    - dmix 13y ago
      idk about American inflation, but as a Canadian getting paid in USD, the value of USD has decline significantly since last year. Lowest since 2009: http://www.xe.com/currencycharts/?from=CAD&to=USD&view=10Y http://www.xe.com/currencycharts/?from=CAD&to=USD&view=10Y I got a nearly 10% raise thanks to a strong Canadian economy and weak American one. Keep it up guys.

atulagarwal 13y ago

In my understanding, it needs operator level access to control the modem, or is it also possible to control the model using a MITM like scenario (off the air interception). If the latter is possible, it can become all the worrisome! Any ideas?

mschuster91 13y ago
Yeah, of course. Calls itself IMSI Catcher (the variant used by police/secret service). You can build one yourself with OsmocomBB and the rest of that open-source GSM network infrastructure stuff. Voila, there is your operator-level access from the radio side.

caiob 13y ago

It's a Samsung. I find hard to believe that Samsung smartphone users have any concern about privacy and/or security.

Nanzikambe 13y ago
Care to elaborate? As a linux user, and (very) amateur kernel hacker I've always bought Samsung phones because they've been pretty forecoming with releasing the source for their android devices: http://www.androidcentral.com/samsung-galaxy-s4-kernel-source-released http://www.androidcentral.com/samsung-galaxy-s4-kernel-sourc... Obviously this is a GPL compliance thing, but it enables security minded people like myself to root the device, inspect the underlying source, and secure it pretty much like a regular box. What alternative do you suggest?
- drdaeman 13y ago
  > releasing the source for their android devices > it enables security minded people like myself to root the device Actually, having kernel sources doesn't enable you anything except for, possibly (but not certainly), building (but not installing) your own kernel. You're able to install customized kernel and/or recovery on most Samsung phones, but that's completely unrelated to any FLOSS source code releases. Actually, this is usually done using proprietary tool (ODIN) communicating with proprietary hardware and firmware. They're just generous to allow you to do so (but they tick a flag stating your firmware is unofficial, and recently they started to blow a fuse to prevent unticking)

SeanLuke 13y ago

> Samsung Galaxy devices running proprietary Android versions ... > Nexus S I am confused. The Nexus S does not run a proprietary Android version.

mey 13y ago
I may be misreading the link, but proprietary seems to be using to describe non-open source binary blobs. This is typical of drivers, most chips on cellphones do not have open source software to control them. Typically these pieces of software are modem/radio chips etc.
reluck 13y ago
Binary blobs, drivers.
zurn 13y ago
It does - the stock "unspoiled" version of Android that comes with Nexus devices still has lots and lots of proprietary binary-only code. This post is from the Replicant project, who are trying to build an open source system on top of the free Android subset.

chatman 13y ago

Free Software Foundation & Richard Stallman always warned everyone of the potential dangers of non-free software, even as drivers like these modem drivers.

akiselev 13y ago

For those who are saying that this isn't a backdoor, you can actually force execute this command on GSM phones for a few thousand dollars [1] [2]. [1] http://rangenetworks.com/products/openbts-development-kit http://rangenetworks.com/products/openbts-development-kit [2] https://www.youtube.com/watch?v=RXqQioV_bpo https://www.youtube.com/watch?v=RXqQioV_bpo

exo762 13y ago

I wonder how many individuals right now are working on exploiting this potential hole to steal BTC.

johnny635 13y ago

NSA approved phone.