4 ms·

You don't have to suspect a deliberate back-door in the "modem" software to be worried about this; you just need to think that it might have an exploitable bug.

by rst 13y ago

You don't have to suspect a deliberate back-door in the "modem" software to be worried about this; you just need to think that it might have an exploitable bug. And odds are very good that it does. See, for example, the following: http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...

flyinglizard 13y ago
No doubt this thing is full of holes, but the fact the modem can directly access the RFS barely registers as an elevated security threat. There's so much an attacker can normally do when they control the modem (MITM, exploiting system services, etc).
- sillysaurus3 13y ago
  A modem can't MITM https without the key. And all http traffic can be MITM'd anyway. So having control of the modem doesn't get you anything that you wouldn't otherwise be able to get by vacuuming up the traffic further upstream. What's an example of exploiting system services?
  - fleitz 13y ago
    Let me get this straight, you're equating having control of a device with DMA with being able to sniff a network connection? If you really think they're the same thing, I have some baseband software for you.
    - sillysaurus3 13y ago
      I didn't know they had DMA.
      - rsync 13y ago
        Ding! That's the key. There is no news here because every phone running every OS is back-doored[1]. Completely, totally back-doored. This includes every single phone "replicant" has ever been installed on. There is a computer in your phone, that you cannot access, running a closed source, proprietary OS that your carrier controls, that has (in many cases) DMA access to your "actual" phone. Your carrier has total control over that computer in your pocket. Game Over. [1] With the very tiny exceptions of calypso-based motorola phones running osmocom and possibly the neo freerunner phones ... but I could be wrong about those...
    - swetland 13y ago
      The modems in question here don't have direct access to system ram or flash, which is why Samsung is using an RPC mechanism to the application processor to store data on behalf of the modem (which quite possibly has no local flash at all -- designs do vary). Typically these are supposed to restrict the modem's storage to its little sandbox -- sounds like this one fails to do so (and runs as root which should not be necessary to provide the service).
      - gcb0 13y ago
        This is merely a helper, but not necessarily to circumvent "sandboxing". Probably the honest firmware update routines use this route to make code smaller.
  - flyinglizard 13y ago
    How do you MITM someone specific that may be thousands of miles from you? Much easier when you have access to their modem. Exploiting system services - you can attack any kind of non encrypted traffic flowing through the modem. Such as unsecured applications running with broad permissions. Or you can inject data into kernel services that communicate directly with the modem. I don't know if on these phones the modem presents itself as a simple serial device, or if it has its own kernel driver (/dev/modem). If it does have its own kernel driver running in the phone, then this driver becomes an easy target for attack, granting full system access.
- gcb0 13y ago
  You are clueless on how the modem works on Android phones. On all nexus, which I'm familiar, modem firmware runs with more ring priority/privileges than the OS. Have https keys in memory? Now so does the modem firmware if it wishes.
pfraze 13y ago
I've spoken to a Qualcomm engineer about this article. He responded by telling me, in fact, he was one of the engineers that dealt with the issues that highlighted after it was published. He asserted all of those remote-execution holes were addressed, and the article has been a constant pain since because it was never updated to reflect that. I'm not a close friend of his, but I've met him on multiple occasions and felt confident he was telling the truth.
- na85 13y ago
  I'm not sure what this post is supposed to accomplish. Even if Qualcomm has patched all their vulns and isn't in cahoots with the NSA (a laughable claim), it still needs to prove that to the users. Otherwise it's just the word of some anonymous person on the internet who "knows a guy at Qualcomm" .... I'm glad you trust the guy but I'd rather not waste time on this. The world needs a modern, auditable, free RTOS for baseband processors.
  - pfraze 13y ago
    Yeah, I agree. I just wanted to mention it, since that article does get dragged out quite often.
- msh 13y ago
  Unless they can point to a update that have been pushed to all Galaxy devices which solves this problem I don't think Qualcomm can complain.
  - deleted 13y ago
    [deleted]
- akiselev 13y ago
  I've worked with Qualcomm chips before and I guarantee you that it was only due to the public response that they fixed those holes. Qualcomm has an institutional problem that makes it nearly impossible for them to make secure silicon and any fixes they apply now are just damage control. For example, this is how firmware is treated: https://news.ycombinator.com/item?id=7336248 https://news.ycombinator.com/item?id=7336248

by rst 13y ago

flyinglizard 13y ago

No doubt this thing is full of holes, but the fact the modem can directly access the RFS barely registers as an elevated security threat. There's so much an attacker can normally do when they control the modem (MITM, exploiting system services, etc).

sillysaurus3 13y ago
A modem can't MITM https without the key. And all http traffic can be MITM'd anyway. So having control of the modem doesn't get you anything that you wouldn't otherwise be able to get by vacuuming up the traffic further upstream. What's an example of exploiting system services?
- fleitz 13y ago
  Let me get this straight, you're equating having control of a device with DMA with being able to sniff a network connection? If you really think they're the same thing, I have some baseband software for you.
  - sillysaurus3 13y ago
    I didn't know they had DMA.
    - rsync 13y ago
      Ding! That's the key. There is no news here because every phone running every OS is back-doored[1]. Completely, totally back-doored. This includes every single phone "replicant" has ever been installed on. There is a computer in your phone, that you cannot access, running a closed source, proprietary OS that your carrier controls, that has (in many cases) DMA access to your "actual" phone. Your carrier has total control over that computer in your pocket. Game Over. [1] With the very tiny exceptions of calypso-based motorola phones running osmocom and possibly the neo freerunner phones ... but I could be wrong about those...
  - swetland 13y ago
    The modems in question here don't have direct access to system ram or flash, which is why Samsung is using an RPC mechanism to the application processor to store data on behalf of the modem (which quite possibly has no local flash at all -- designs do vary). Typically these are supposed to restrict the modem's storage to its little sandbox -- sounds like this one fails to do so (and runs as root which should not be necessary to provide the service).
    - gcb0 13y ago
      This is merely a helper, but not necessarily to circumvent "sandboxing". Probably the honest firmware update routines use this route to make code smaller.
- flyinglizard 13y ago
  How do you MITM someone specific that may be thousands of miles from you? Much easier when you have access to their modem. Exploiting system services - you can attack any kind of non encrypted traffic flowing through the modem. Such as unsecured applications running with broad permissions. Or you can inject data into kernel services that communicate directly with the modem. I don't know if on these phones the modem presents itself as a simple serial device, or if it has its own kernel driver (/dev/modem). If it does have its own kernel driver running in the phone, then this driver becomes an easy target for attack, granting full system access.
gcb0 13y ago
You are clueless on how the modem works on Android phones. On all nexus, which I'm familiar, modem firmware runs with more ring priority/privileges than the OS. Have https keys in memory? Now so does the modem firmware if it wishes.

pfraze 13y ago

I've spoken to a Qualcomm engineer about this article. He responded by telling me, in fact, he was one of the engineers that dealt with the issues that highlighted after it was published. He asserted all of those remote-execution holes were addressed, and the article has been a constant pain since because it was never updated to reflect that. I'm not a close friend of his, but I've met him on multiple occasions and felt confident he was telling the truth.

na85 13y ago
I'm not sure what this post is supposed to accomplish. Even if Qualcomm has patched all their vulns and isn't in cahoots with the NSA (a laughable claim), it still needs to prove that to the users. Otherwise it's just the word of some anonymous person on the internet who "knows a guy at Qualcomm" .... I'm glad you trust the guy but I'd rather not waste time on this. The world needs a modern, auditable, free RTOS for baseband processors.
- pfraze 13y ago
  Yeah, I agree. I just wanted to mention it, since that article does get dragged out quite often.
msh 13y ago
Unless they can point to a update that have been pushed to all Galaxy devices which solves this problem I don't think Qualcomm can complain.
- deleted 13y ago
  [deleted]
akiselev 13y ago
I've worked with Qualcomm chips before and I guarantee you that it was only due to the public response that they fixed those holes. Qualcomm has an institutional problem that makes it nearly impossible for them to make secure silicon and any fixes they apply now are just damage control. For example, this is how firmware is treated: https://news.ycombinator.com/item?id=7336248 https://news.ycombinator.com/item?id=7336248