Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There are no secure smartphones

devever.net

Post reply on HN
Print view View original

31–40 of 124 posts

Re: There are no secure smartphones

#31

Post by doctorshady »

hardwaresofton wrote: post #25

Would really love to see this upvoted more. This basic truth should be common knowledge for privacy-minded or security-minded technologists/developers. There are lots of reasons GSM won't/is hard to make work. What are the options? As more and more carriers in the USA provide wifi-dongles that are connected to 3G, maybe it's better to just do that, and move off making calls directly from your phone completely? For ex…

I think what the author was implying is that the code that runs the UMTS/LTE/whatever else stacks is still based on that nineties source, when the firmware was initially conceived for GSM.

Re: There are no secure smartphones

#32

Post by revelation »

matt_wulfeck wrote: post #19

> For devices with cellular access, the baseband subsystem also utilizes its own similar process of secure booting with signed software and keys verified by the baseband processor. According to the iOS security white paper, the baseband firmware is part of the secure boot chain, and has its own secure boot chain. This allows me to assume it's very hard to inject or replace the the firmware with a malicious code. Whet…

That's just iOS being iOS, on Android the baseband firmware can usually be flashed using fastboot. However, there will presumably still be a bootloader on the baseband processor that checks the authenticity of what you just flashed to it.

It's very interesting to just download a baseband firmware (usually called radio.img) from a random Android forum, unpack it and run strings on the code you get. It'll usually be an ARM processor running a homebrew RTOS, which is concerning enough. When you search for NMEA and realize the baseband processor is running the GPS chip, that's when you are starting to get doubts. And when you finally realize theres a bunch of audio codecs and the baseband is controlling the microphones, that's when the full force of despair hits you. You don't own it, you don't control any part of it. Your Android doesn't either, it begs the baseband for a slice of its information.

Re: There are no secure smartphones

#33

Post by ytjohn »

mahouse wrote: post #21
scientes wrote: post #16

Or you can just use WIFI and turn the baseband off like I do. The cell companies are all crooks anyways (in the US), and I don't want to do business with them.

Doesn't the baseband control wifi too anyway? You should see the amount of things the SoC/baseband does.

The baseband chip is a separate chip than the one providing wifi, bluetooth, nfc, etc. Essentially, the wifi/bt/etc chips fall on the computer side and can be controlled/manipulated by the phone's OS. The baseband chip is a standalone system that is controlled by the cell towers, and then is tied into the phone's cpu directly. Phone builders essentially buy the baseband chip that is certified on different network types and add it to their PCB.

In reality, the baseband should be connected more like a serial port (with some audio channels to the mic and speaker). In fact, it's treated very much that way in software - you interact with it by sending AT commands. But, as others have pointed out, it can send commands directly to the phone's CPU and access the phone's internal memory.

Re: There are no secure smartphones

#34

Post by beatpanda »

gue5t wrote: post #3

The folks at http://neo900.org/ are well aware of this and that phone is designed accordingly (details at http://neo900.org/faq#privacy ). Hype-driven products like BlackPhone misrepresent their devices as being perfectly secure when this significant attack vector is completely unmitigated. On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. There is no…

>somehow even among people who describe themselves as "hackers", most just want to run Android or iOS and buy/run closed-source apps, and are more interested in Javascript and employment [read: eating, having shelter] than reverse-engineering and doing things that have never been done before.

How many opportunities are there to work on secure communications software full time and still put food on the table?

Re: There are no secure smartphones

#35

Post by seba_dos1 »

pslam wrote: post #13
gue5t wrote: post #3

The folks at http://neo900.org/ are well aware of this and that phone is designed accordingly (details at http://neo900.org/faq#privacy ). Hype-driven products like BlackPhone misrepresent their devices as being perfectly secure when this significant attack vector is completely unmitigated. On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. There is no…

> On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. You'll find the modem on most smartphones is connected via USB - or rather its chip-to-chip version, HSIC. For SoCs where it's on-die - on the same bus/fabric - they will (if it's not an idiotic design) use an IOMMU of some sort, to prevent DMA from having access outside of its sandbox. Even if it's…

"Evil USB" (or "bad USB") is possible thanks to the U part of USB - universal. If you connect a pendrive to your computer, it can easily say that it's a keyboard, because your computer cannot easily verify that you haven't just connected a keyboard. It would need to ask you in some trustworthy way to be sure, which sometimes can be problematic.

OTOH, on the device like Neo900 it is well-known what kind of device is connected to the internal bus and software stack (at least on Linux) can easily be advised to not accept anything that doesn't look and behave like the included modem should.

In a properly configured user OS, the modem would need to use some software vulnerability to exploit the USB stack, so the same principles apply there as with, say, OpenSSL, browser or the kernel. Secret zero-days aside, when some bug is found, it is patched and you upgrade the vulnerable component, just like on PC.

Re: There are no secure smartphones

#36

Post by seba_dos1 »

matt_wulfeck wrote: post #19

> For devices with cellular access, the baseband subsystem also utilizes its own similar process of secure booting with signed software and keys verified by the baseband processor. According to the iOS security white paper, the baseband firmware is part of the secure boot chain, and has its own secure boot chain. This allows me to assume it's very hard to inject or replace the the firmware with a malicious code. Whet…

Looking at the kinds and amounts of just standard software vulnerabilities in those firmwares that have been found in the past, I presume there's plenty of low hanging fruit still to be found there. It doesn't really need to be an intentional backdoor, it can be just good old buffer overflow with remote execution.

Re: There are no secure smartphones

#37

Post by mitchtbaum »

scientes wrote: post #16

Or you can just use WIFI and turn the baseband off like I do. The cell companies are all crooks anyways (in the US), and I don't want to do business with them.

On Android:

1. Put ##4636## into the Dialer (or use any application available on the Market like 4636 — takes you to the same service screen)

2. Choose Phone Information

3. Press Turn off radio

(source) http://forum.xda-developers.com/showpost.php?s=c8b62d54e971b...

(more discussion) http://android.stackexchange.com/questions/7133/how-do-i-tur...

Re: There are no secure smartphones

#39

Post by seba_dos1 »

hardwaresofton wrote: post #25

Would really love to see this upvoted more. This basic truth should be common knowledge for privacy-minded or security-minded technologists/developers. There are lots of reasons GSM won't/is hard to make work. What are the options? As more and more carriers in the USA provide wifi-dongles that are connected to 3G, maybe it's better to just do that, and move off making calls directly from your phone completely? For ex…

LTE is basically VoIP, a 180° change from the monstrosity of 3G, although the providers still manage to fail spectacularly at it.

https://media.ccc.de/v/32c3-7502-dissecting_volte

Post reply on HN