Why is it that the baseband has full access to main memory?
There are no secure smartphones
41–50 of 124 posts
Re: There are no secure smartphones
#42It's good to draw attention on baseband processors, but there are technical assertions in this post that are probably not accurate (lack of auditing and the notion that you can assess the security of a whole phone system by whether or not there's an IOMMU). The systems security of modern phones is surprisingly complex. Google and Apple both care very deeply about these problems, and both have extremely capable engine…
The premise of the article is flat out wrong. Mainstream smartphones do not provide DMA access from the baseband to the application processor's memory.
The connection is usually HSIC, which is a chip-to-chip USB derivative.
https://www.synopsys.com/dw/dwtb.php?a=hsic_usb2_device
The AP is responsible for setting up buffers for communication and manages its own host controller. But like I2C or even older UARTs, the AP remains in control of the communications.
Yes, basebands need more auditing and a security model more like modern APs (e.g., separation of privileges and exploit countermeasures like ASLR and non-exec). Yes, getting baseband access then lets you monitor regular voice and SMS comms. But no, it does not instantly compromise the AP so using the Signal app would still be secure.
Re: There are no secure smartphones
#43The folks at http://neo900.org/ are well aware of this and that phone is designed accordingly (details at http://neo900.org/faq#privacy ). Hype-driven products like BlackPhone misrepresent their devices as being perfectly secure when this significant attack vector is completely unmitigated. On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. There is no…
I have kind of confusion, your rant about people on HN not understanding that "re-programmable computers that, at a low level, run the code you ask them to" and the fact that no one has a complete ownership of all the parts inside that phone or any other option makes difficult to sustain an option as secure, because those options would comprise several different cpus. The closest way I can see to get something to be…
To add to this madness, even if you design your own chips and software stack, the fab that printed your chips might have modified your design. Perhaps you can design a chip that's resilient to modifications?
Is it possible to build a chip that only executes instructions encrypted by your key? I'm not talking about just decoding to L1 and executing plaintext there, but having a full pipeline that can only work on your encrypted instructions.
Re: There are no secure smartphones
#44There is something in between nothing and a full IOMMU. I've been working with a TMS570 processor lately whose DMA engine supports an IOMPU. This hardware is equivalent to the Cortex-R/M Memory protection unit.
An MPU has all of the same protection domains that an MMU does, except for a few major differences:
- The total number of protected regions is very small (12 or so), such that the hardware cost is somewhat smaller than a TLB cache.
- To offset the small number of regions, the size of each region can be almost any power of two.
- The MPU does not perform address translation, again reducing the hardware cost.
Thus, the kernel can configure the peripheral's DMA engine to only allow access to a page or few.
Re: There are no secure smartphones
#45Why is it that the baseband has full access to main memory?
Integration, miniaturization, power management, cost reduction... it's the easiest way, so when you disregard proper isolation and security, then it actually seems like the way to go.
Re: There are no secure smartphones
#46Earlier quoted context omitted.
I have kind of confusion, your rant about people on HN not understanding that "re-programmable computers that, at a low level, run the code you ask them to" and the fact that no one has a complete ownership of all the parts inside that phone or any other option makes difficult to sustain an option as secure, because those options would comprise several different cpus. The closest way I can see to get something to be…
To add to this madness, even if you design your own chips and software stack, the fab that printed your chips might have modified your design. Perhaps you can design a chip that's resilient to modifications? Is it possible to build a chip that only executes instructions encrypted by your key? I'm not talking about just decoding to L1 and executing plaintext there, but having a full pipeline that can only work on your…
"To add to this madness, even if you design your own chips and software stack, you the fab that printed your chips might have modified your design" True, changes can be so subtle, remember how the Playstation were hacked on the basis of altering the current provided to the CPU?
"His approach is clever and is known as a “glitching attack“. This kind of hardware attack involves sending a carefully-timed voltage pulse in order to cause the hardware to misbehave in some useful way" from http://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was-...
edit: typos
Re: There are no secure smartphones
#47Earlier quoted context omitted.
I think this is an instance where the truth is somewhere in the muddle. I'm sure there are engineers who care very much about securing cellular devices and making the attack surface as small as possible, probably working for Apple, Google, and perhaps for a few of those nation-state actors as well. I'm equally sure there are time crunched engineers who are more than happy to not go looking for problems when they have…
"the truth is somewhere in the muddle" Nice Freudian slip. "Muddle" to me sounded like one, probably because of its similarity to huddle, but a bit to my surprise it is a word, with an even more appropriate meaning "an untidy and disorganized state or collection."
It's how you properly process the mint for a mojito:
http://drinks.seriouseats.com/2011/05/cocktail-101-how-to-mu...
Pretty sure the parent poster was getting close to the end of the day, and could almost feel its minty relief on their tongue, hence the slip.
Re: There are no secure smartphones
#48Tor has a discussion (2014) of Android security, including baseband processors, https://blog.torproject.org/blog/mission-impossible-hardenin...
Re: There are no secure smartphones
#49Earlier quoted context omitted.
I have kind of confusion, your rant about people on HN not understanding that "re-programmable computers that, at a low level, run the code you ask them to" and the fact that no one has a complete ownership of all the parts inside that phone or any other option makes difficult to sustain an option as secure, because those options would comprise several different cpus. The closest way I can see to get something to be…
I agree completely that fully trusted hardware, although a laudable goal, is not achievable in today's reality. However, there are a lot of cool things you can do with hardware that looks like it runs your code, even if you don't know whether it contains backdoors or not. From the perspective of trying to guarantee security when you don't trust manufacturers, there are system-level invariants dictated by the laws of…
"you can be sure, to within measurement precision"
I'm not sure how readily available are this kind of tools for the average joe, correct me if I'm wrong I do also thing is a destructive process, taking as a basis the Core 2 Duo P8400 that the X200 on the libreboot laptop which as per intel page is built on 45nm fabrication[0] and as Wikipedia mention (I know wikipedia could not be a trusted source of information for this) "This attack is not very common because it requires a large investment in effort and special equipment that is generally only available to large chip manufacturers. " [1] which still sounds logical.
about " but you can at least make sure they are behaving generally as CPUs or modems or RAM might at the boundaries between them" you know this is close to impossible, check for example how the RAM tests are performed where a set of patterns are tested and you have some degree of certainty [2] and for which they last concludes "It should be obvious that this strategy requires an exact knowledge of how the memory cells are laid out on the chip. In addition there is a never ending number of possible chip layouts for different chip types and manufacturers making this strategy impractical. However, there are testing algorithms that can approximate this ideal. " notice approximate to ideal.
"If you build a system with enough small chips doing simple tasks" and this is the path to take, a new set of trust-able cpus... but it's not one of the current options.
[0] http://ark.intel.com/products/35569/Intel-Core2-Duo-Processo... [1] https://en.wikipedia.org/wiki/Reverse_engineering#Reverse_en... [2] http://www.memtest86.com/technical.htm
Re: There are no secure smartphones
#50Would really love to see this upvoted more. This basic truth should be common knowledge for privacy-minded or security-minded technologists/developers. There are lots of reasons GSM won't/is hard to make work. What are the options? As more and more carriers in the USA provide wifi-dongles that are connected to 3G, maybe it's better to just do that, and move off making calls directly from your phone completely? For ex…
LTE is basically VoIP, a 180° change from the monstrosity of 3G, although the providers still manage to fail spectacularly at it. https://media.ccc.de/v/32c3-7502-dissecting_volte
LTE is a protocol/standard with more efficient methodology/tech right? -- my main issue was the involvement that certain agencies have with the basebands put into mobile phones and the resistance that people trying to develop completely open-source basebands encounter.
LTE doesn't seem like a solution to this problem, it sounds like just a more efficient baseband. Even if it's easier to reverse engineer, use of it might still be outlawed (as is an issue with the neo9000).
Does LTE use some publicly accessible/modifiable spectrum that I don't know about or something?