3 ms·

Ok. I do go a bit overboard sometimes with the rants about closed baseband firmware. But it needs to be stressed that these kind of things are not the magic f

by rsync 12y ago

Ok. I do go a bit overboard sometimes with the rants about closed baseband firmware. But it needs to be stressed that these kind of things are not the magic fix for mobile phone comms that people think they are. A lot of use cases in our current world involve state owned telecom entities and Joe-Arab-Spring-Six-Pack should not be confused into thinking this solves that problem.

mike_hearn 12y ago
I pointed this out in a comment a few days ago, but the era in handset design when basebands were unilaterally trusted is over. I believe modern Qualcomm basebands are firewalled off from the rest of the device using MMUs, they do not have the ability to do DMA and their firmware is significantly hardened using techniques like ASLR, stack canaries and even using a proprietary VLIW instruction set that is barely documented. Handset makers and carriers all have strong financial incentives to harden the basebands against hacks because they don't want people unlocking their phones, which was often being done by exploiting bugs in basebands. Also, they need the airwaves to have integrity and mobile protocols are all based on the assumption of trusted endpoints that don't violate the rules. Now that DIY GSM base stations have become a reality, carriers face a nightmare scenario of someone running a buggy or malicoius "tower" that infects basebands of any phones that enters into range and starts them doing some kind of horrible attack against the carrier infrastructure. E.g. you can imagine an extortion attempt that works this way. It's in their best interests for their devices to behave predictably and be controlled only be themselves.
- tedunangst 12y ago
  But what if the MMU is backdoored???
  - conformal 12y ago
    oh, you mean like VT-d etc on intel cpus. what reason could you possibly have to suspect that the IOMMUs from a company named "intel" are backdoored? :)
    - tptacek 12y ago
      Does someone seriously think the IOMMUs on Intel CPUs are backdoored?
      - conformal 12y ago
        this work from 2011 by IVT doesn't exactly inspire confidence. http://theinvisiblethings.blogspot.com/2011/05/following-white-rabbit-software-attacks.html http://theinvisiblethings.blogspot.com/2011/05/following-whi...
        tptacek 12y ago
        Sure, but getting an IOMMU right on a complicated platform that didn't historically lean on IOMMUs is different than "the IOMMU is backdoored". Why this isn't just a nit is, if you believe (say) VT-d is backdoored, a lack of IVT research projects isn't evidence of the absence of backdoors. Presumably, if the NSA is serious enough to backdoor Intel chipsets, they'll do it in a manner that a couple of independent security researchers can't black-box.
- Canada 12y ago
  ARM TrustZone. It controls access to various hardware. Other software, including the kernel and baseband isn't supposed to be able to even observe its state. There's a base set of functions which handset vendors can add to. Of course, it has vulnerabilities too. I haven't heard of any process hardening going on though. Do you have a source for that? I want to learn more about it.
  - mike_hearn 12y ago
    http://media.ccc.de/browse/congress/2013/30C3_-_5618_-_en_-_saal_1_-_201312272145_-_baseband_exploitation_in_2013_-_rpw_esizkur.html#video http://media.ccc.de/browse/congress/2013/30C3_-_5618_-_en_-_...

by rsync 12y ago

mike_hearn 12y ago

I pointed this out in a comment a few days ago, but the era in handset design when basebands were unilaterally trusted is over. I believe modern Qualcomm basebands are firewalled off from the rest of the device using MMUs, they do not have the ability to do DMA and their firmware is significantly hardened using techniques like ASLR, stack canaries and even using a proprietary VLIW instruction set that is barely documented. Handset makers and carriers all have strong financial incentives to harden the basebands against hacks because they don't want people unlocking their phones, which was often being done by exploiting bugs in basebands. Also, they need the airwaves to have integrity and mobile protocols are all based on the assumption of trusted endpoints that don't violate the rules. Now that DIY GSM base stations have become a reality, carriers face a nightmare scenario of someone running a buggy or malicoius "tower" that infects basebands of any phones that enters into range and starts them doing some kind of horrible attack against the carrier infrastructure. E.g. you can imagine an extortion attempt that works this way. It's in their best interests for their devices to behave predictably and be controlled only be themselves.

tedunangst 12y ago
But what if the MMU is backdoored???
- conformal 12y ago
  oh, you mean like VT-d etc on intel cpus. what reason could you possibly have to suspect that the IOMMUs from a company named "intel" are backdoored? :)
  - tptacek 12y ago
    Does someone seriously think the IOMMUs on Intel CPUs are backdoored?
    - conformal 12y ago
      this work from 2011 by IVT doesn't exactly inspire confidence. http://theinvisiblethings.blogspot.com/2011/05/following-white-rabbit-software-attacks.html http://theinvisiblethings.blogspot.com/2011/05/following-whi...
      - tptacek 12y ago
        Sure, but getting an IOMMU right on a complicated platform that didn't historically lean on IOMMUs is different than "the IOMMU is backdoored". Why this isn't just a nit is, if you believe (say) VT-d is backdoored, a lack of IVT research projects isn't evidence of the absence of backdoors. Presumably, if the NSA is serious enough to backdoor Intel chipsets, they'll do it in a manner that a couple of independent security researchers can't black-box.
Canada 12y ago
ARM TrustZone. It controls access to various hardware. Other software, including the kernel and baseband isn't supposed to be able to even observe its state. There's a base set of functions which handset vendors can add to. Of course, it has vulnerabilities too. I haven't heard of any process hardening going on though. Do you have a source for that? I want to learn more about it.
- mike_hearn 12y ago
  http://media.ccc.de/browse/congress/2013/30C3_-_5618_-_en_-_saal_1_-_201312272145_-_baseband_exploitation_in_2013_-_rpw_esizkur.html#video http://media.ccc.de/browse/congress/2013/30C3_-_5618_-_en_-_...