4 ms·

”someone can send a message straight to your base station to operate the camera in your phone, and the firewall will show you that the camera has been actuated

by josho 12y ago

”someone can send a message straight to your base station to operate the camera in your phone, and the firewall will show you that the camera has been actuated [even though] the user hasn’t pressed a button to do it.” You've got to be kidding me. The GSM/HSPDA specs provide for the ability to remotely control my cell phone camera? What other gems do the spec provide for that ATT/Verizon/Phantom Cell towers can do that people aren't aware of?

sp332 12y ago
I'm pretty sure it's talking about a malicious baseband.
- schoen 12y ago
  For example, there's NSO Group, which has exploits against common smartphone basebands and can use them to activate sensors in the device: http://online.wsj.com/articles/smartphones-become-next-frontier-in-cybersecurity-1406808182?mod=rss_Technology http://online.wsj.com/articles/smartphones-become-next-front... http://blogs.wsj.com/digits/2014/08/01/can-this-israeli-startup-hack-your-phone/ http://blogs.wsj.com/digits/2014/08/01/can-this-israeli-star... In addition to the use of IMSI catchers for MITMing calls and text messages, and the use of IMSI catchers for detecting the presence of devices, there's the use of IMSI catchers for delivering baseband exploits.
  - tedunangst 12y ago
    Heh. We've come full circle. The "sources" for that second link include a comment thread on HN that was later deleted. Fortunately somebody at WSJ was kind enough to blog about it so you still have something to link to.
a-priori 12y ago
No, they're talking about an exploit for the phone's baseband software. All the radio signal processing and the lower layers of the cellular network stack in a cell phone happens on a dedicated chip, the baseband processor. Presumably, they deliver an exploit for its software, e.g. by exploiting a buffer overrun in the baseband processor's HSDPA stack, to install malware code of some kind on this processor. Because it's not on the CPU, it's invisible to the phone's main operating system and bypasses all its security and process isolation. And, since these chips run real-time operating systems, a low-priority task is guaranteed to never interrupt a higher priority running on the chip, so the payload would not affect cellular communications (cellular protocols have tight timing constraints). Because the baseband processor is also attached to the phone's system bus (that's how the CPU sends it commands), it can use it to control other devices on the bus, such as the camera. This is a very devious attack because it's almost impossible to detect, and allows deep access to the phone's hardware.
- jacquesm 12y ago
  Very scary that such buses are multi-master to begin with, that's simply asking for trouble. It makes every device on the bus a potential target for exploits, after all, once you have gained a beach-head on the baseband processor you can use that to attempt to exploit the other devices (in so far as that is still a requirement, but possibly there are other buses not directly visible from the baseband processor) at will. Back in the days there was a HF hack that allowed a remote operator to listen in on conversations in the room by using the fact that such signals would totally ignore the 'on hook' disconnect of old style 'wired' phones ('POTS'), these baseband processors are a much worse instance of the same phenomenon. Not that it matters much, after all, if you have access to the cell phone towers you can listen in on whatever you want, making pictures is of a lower threat level (to me) than listening in on random conversations in the vicinity of the phone.
  - bravo22 12y ago
    The buses aren't multi-master. They're often USB, or SDIO. They would use the bus to deliver another exploit directly to CPU driver which is often running in supervisor ring, i.e. kernel privilege.
    - disjointrevelry 12y ago
      Atleast for some of the Samsung Phones which are becoming quickly popular for custom Android-based operating systems. Some setups with an independent USB to a baseband module can still control the bus to other devices by exploiting USB host modes. (i.e. if the log output indicates it can no longer control/communicate with the usb, or the usb disconnected, then it is very likely the usb bus was hijacked by another device). Others phones still have some type of bus overlap, and they provide no way to block the baseband chip from accessing other devices on the shared bus. Even then, this is not an easy task as the baseband chip would be competing with the processor chip in accessing devices. edit: It is possible in future revisions, SoC Chips in mobile phones in the US will include capabilities to control the phone irrespective of the running soft OS. As of now there are very few phone manufacturers that include open access to the phone's hardware, and the processor. It's a hunch the US companies will try to blockade open phones, as foreign phones, particularly Samsung/LG/HTC, are providing a way for secure phones to be developed. Apple's attempts and level of aggression to blockade Samsung all around the world was incredibly suspicious, to say the least, and only S.Job sycophants tend to think it was for 'competitive' value. The US is fast becoming a strange place.

by josho 12y ago

sp332 12y ago

I'm pretty sure it's talking about a malicious baseband.

schoen 12y ago
For example, there's NSO Group, which has exploits against common smartphone basebands and can use them to activate sensors in the device: http://online.wsj.com/articles/smartphones-become-next-frontier-in-cybersecurity-1406808182?mod=rss_Technology http://online.wsj.com/articles/smartphones-become-next-front... http://blogs.wsj.com/digits/2014/08/01/can-this-israeli-startup-hack-your-phone/ http://blogs.wsj.com/digits/2014/08/01/can-this-israeli-star... In addition to the use of IMSI catchers for MITMing calls and text messages, and the use of IMSI catchers for detecting the presence of devices, there's the use of IMSI catchers for delivering baseband exploits.
- tedunangst 12y ago
  Heh. We've come full circle. The "sources" for that second link include a comment thread on HN that was later deleted. Fortunately somebody at WSJ was kind enough to blog about it so you still have something to link to.

a-priori 12y ago

No, they're talking about an exploit for the phone's baseband software. All the radio signal processing and the lower layers of the cellular network stack in a cell phone happens on a dedicated chip, the baseband processor. Presumably, they deliver an exploit for its software, e.g. by exploiting a buffer overrun in the baseband processor's HSDPA stack, to install malware code of some kind on this processor. Because it's not on the CPU, it's invisible to the phone's main operating system and bypasses all its security and process isolation. And, since these chips run real-time operating systems, a low-priority task is guaranteed to never interrupt a higher priority running on the chip, so the payload would not affect cellular communications (cellular protocols have tight timing constraints). Because the baseband processor is also attached to the phone's system bus (that's how the CPU sends it commands), it can use it to control other devices on the bus, such as the camera. This is a very devious attack because it's almost impossible to detect, and allows deep access to the phone's hardware.

jacquesm 12y ago
Very scary that such buses are multi-master to begin with, that's simply asking for trouble. It makes every device on the bus a potential target for exploits, after all, once you have gained a beach-head on the baseband processor you can use that to attempt to exploit the other devices (in so far as that is still a requirement, but possibly there are other buses not directly visible from the baseband processor) at will. Back in the days there was a HF hack that allowed a remote operator to listen in on conversations in the room by using the fact that such signals would totally ignore the 'on hook' disconnect of old style 'wired' phones ('POTS'), these baseband processors are a much worse instance of the same phenomenon. Not that it matters much, after all, if you have access to the cell phone towers you can listen in on whatever you want, making pictures is of a lower threat level (to me) than listening in on random conversations in the vicinity of the phone.
- bravo22 12y ago
  The buses aren't multi-master. They're often USB, or SDIO. They would use the bus to deliver another exploit directly to CPU driver which is often running in supervisor ring, i.e. kernel privilege.
  - disjointrevelry 12y ago
    Atleast for some of the Samsung Phones which are becoming quickly popular for custom Android-based operating systems. Some setups with an independent USB to a baseband module can still control the bus to other devices by exploiting USB host modes. (i.e. if the log output indicates it can no longer control/communicate with the usb, or the usb disconnected, then it is very likely the usb bus was hijacked by another device). Others phones still have some type of bus overlap, and they provide no way to block the baseband chip from accessing other devices on the shared bus. Even then, this is not an easy task as the baseband chip would be competing with the processor chip in accessing devices. edit: It is possible in future revisions, SoC Chips in mobile phones in the US will include capabilities to control the phone irrespective of the running soft OS. As of now there are very few phone manufacturers that include open access to the phone's hardware, and the processor. It's a hunch the US companies will try to blockade open phones, as foreign phones, particularly Samsung/LG/HTC, are providing a way for secure phones to be developed. Apple's attempts and level of aggression to blockade Samsung all around the world was incredibly suspicious, to say the least, and only S.Job sycophants tend to think it was for 'competitive' value. The US is fast becoming a strange place.