3 ms·

Isn't it time Google and Apple build some protections inside Android and iOS against this? Maybe do something like what these guys did, but I'm sure they can c

Isn't it time Google and Apple build some protections inside Android and iOS against this? Maybe do something like what these guys did, but I'm sure they can come up with even more comprehensive protections: http://www.wired.com/2014/09/cryptophone-firewall-identifies-rogue-cell-towers/ http://www.wired.com/2014/09/cryptophone-firewall-identifies...

adolph 12y ago
Given the nature of the sniffing, the best offering would probably be "turn off cell antenna, use wifi." Given the above, I wonder if the airplanes are also listening to other stuff past cellular.
- cowsandmilk 12y ago
  with T-mobile and iOS, I have wifi calling. I would not be opposed if it turned off the cell antenna whenever I could instead make and receive calls over wifi.
mindslight 12y ago
The application OS is basically irrelevant when talking about cell communications. They'd have to design their own boards to even have a chance at isolating the "baseband" processor - to say nothing of controlling its behavior, especially as carriers want to keep its workings secret for "security" Most phones (anything CDMA, or most everything LTE) use a Qualcomm SOC, with both the baseband and application processor sharing the same memory space. This is a recipe for anything on the application processor being pwned beyond recognition. The last time I played with Qualcomm/CDMA (around 2007), I used proprietary software (QPST) to do undocumented incantations to clone an ESN from one phone to another. When I called the number, both rang. Picking both up led to hearing the conversation in both. This tells you precisely how good their idea of "encryption" is. The entire Qualcomm ecosystem is a black box, and is there even a remote chance they don't have a partnership with the NSA? I'm sure San Diego is seen as a key national security interest - if it weren't "secured" by the NSA, then China/Russia intelligence would do so (or an uppity colony looking for a leg up). I'll happily eat these words when there's an open source GSM or CDMA stack, portable hardware to run it, and the ability to pay for network access anonymously. But fr now, I see Wifi/Mifi as the only plausible way forward.
- droopybuns 12y ago
  Can you provide some technical documentation that supports your assertion that the baseband and the application processor are sharing memory space? I thought they use different processors that are supporting essentially independent operating systems.
  - mindslight 12y ago
    They're independent operating environments, but that doesn't mean their memories are isolated. It's commonly accepted that most mobile SoCs operate this way. See the diagram/text on page 2 of https://www.usenix.org/system/files/conference/woot12/woot12-final24.pdf https://www.usenix.org/system/files/conference/woot12/woot12... . To the extent that a specific Qualcomm processor might avoid such a design, it's impossible to know due to their longstanding culture of security through obscurity. AFAIK, the Raspberry Pi is setup the same way, with the black box GPU being the master of the CPU that is commonly used to run Linux. This setup is only less problematic because the GPU lacks an unobservable network link. Even the i9100, with an independent modem, was found to be setup with shared memory for communication - http://redmine.replicant.us/projects/replicant/wiki/GalaxySI9000 http://redmine.replicant.us/projects/replicant/wiki/GalaxySI... Models like the Samsung i9300 have the modem chipset as an independent unit, although I've seen a block diagram indicating that the eMMC flash and modem RAM are in the same package, which is worrying.
    - mike_hearn 12y ago
      Your information is out of date. Modern Qualcomm basebands are restricted by an MMU and isolated from the main OS. Carriers wanted this because baseband exploits were such a common way for phones to get rooted. Additionally they have been hardened considerably in recent times, apparently modern Qualcomm basebands are much, much harder to hack than they once were. And they run now on a proprietary CPU design called, I think, Hexagon, which makes even just disassembling the thing a bit tricky.
      - mindslight 12y ago
dobbsbob 12y ago
If you have a Samsung s3 International version you can use this to identify when your GSM connection has no encryption https://github.com/darshakframework/darshak https://github.com/darshakframework/darshak Works on Intel xgold basebands by giving access to the event log

adolph 12y ago

Given the nature of the sniffing, the best offering would probably be "turn off cell antenna, use wifi." Given the above, I wonder if the airplanes are also listening to other stuff past cellular.

cowsandmilk 12y ago
with T-mobile and iOS, I have wifi calling. I would not be opposed if it turned off the cell antenna whenever I could instead make and receive calls over wifi.

mindslight 12y ago

The application OS is basically irrelevant when talking about cell communications. They'd have to design their own boards to even have a chance at isolating the "baseband" processor - to say nothing of controlling its behavior, especially as carriers want to keep its workings secret for "security" Most phones (anything CDMA, or most everything LTE) use a Qualcomm SOC, with both the baseband and application processor sharing the same memory space. This is a recipe for anything on the application processor being pwned beyond recognition. The last time I played with Qualcomm/CDMA (around 2007), I used proprietary software (QPST) to do undocumented incantations to clone an ESN from one phone to another. When I called the number, both rang. Picking both up led to hearing the conversation in both. This tells you precisely how good their idea of "encryption" is. The entire Qualcomm ecosystem is a black box, and is there even a remote chance they don't have a partnership with the NSA? I'm sure San Diego is seen as a key national security interest - if it weren't "secured" by the NSA, then China/Russia intelligence would do so (or an uppity colony looking for a leg up). I'll happily eat these words when there's an open source GSM or CDMA stack, portable hardware to run it, and the ability to pay for network access anonymously. But fr now, I see Wifi/Mifi as the only plausible way forward.

droopybuns 12y ago
Can you provide some technical documentation that supports your assertion that the baseband and the application processor are sharing memory space? I thought they use different processors that are supporting essentially independent operating systems.
- mindslight 12y ago
  They're independent operating environments, but that doesn't mean their memories are isolated. It's commonly accepted that most mobile SoCs operate this way. See the diagram/text on page 2 of https://www.usenix.org/system/files/conference/woot12/woot12-final24.pdf https://www.usenix.org/system/files/conference/woot12/woot12... . To the extent that a specific Qualcomm processor might avoid such a design, it's impossible to know due to their longstanding culture of security through obscurity. AFAIK, the Raspberry Pi is setup the same way, with the black box GPU being the master of the CPU that is commonly used to run Linux. This setup is only less problematic because the GPU lacks an unobservable network link. Even the i9100, with an independent modem, was found to be setup with shared memory for communication - http://redmine.replicant.us/projects/replicant/wiki/GalaxySI9000 http://redmine.replicant.us/projects/replicant/wiki/GalaxySI... Models like the Samsung i9300 have the modem chipset as an independent unit, although I've seen a block diagram indicating that the eMMC flash and modem RAM are in the same package, which is worrying.
  - mike_hearn 12y ago
    Your information is out of date. Modern Qualcomm basebands are restricted by an MMU and isolated from the main OS. Carriers wanted this because baseband exploits were such a common way for phones to get rooted. Additionally they have been hardened considerably in recent times, apparently modern Qualcomm basebands are much, much harder to hack than they once were. And they run now on a proprietary CPU design called, I think, Hexagon, which makes even just disassembling the thing a bit tricky.
    - mindslight 12y ago

dobbsbob 12y ago

If you have a Samsung s3 International version you can use this to identify when your GSM connection has no encryption https://github.com/darshakframework/darshak https://github.com/darshakframework/darshak Works on Intel xgold basebands by giving access to the event log