Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There are no secure smartphones

devever.net

Post reply on HN
Print view View original

91–100 of 124 posts

Re: There are no secure smartphones

#91

Post by [deleted] »

rsync wrote: post #61
gue5t wrote: post #3

The folks at http://neo900.org/ are well aware of this and that phone is designed accordingly (details at http://neo900.org/faq#privacy ). Hype-driven products like BlackPhone misrepresent their devices as being perfectly secure when this significant attack vector is completely unmitigated. On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. There is no…

"On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA." I have been "Mr. Cry About Baseband Ownage From The Rooftops" for years around here, and even I have to admit that a lot of baseband implementation in modern smartphones uses this same USB connected model. It's not universal, but a lot of USB-connected baseband is out in the world... Still closed sou…

[deleted]

Re: There are no secure smartphones

#92

Post by LunaSea »

venomsnake wrote: post #83
beatpanda wrote: post #34

Earlier quoted context omitted.

>somehow even among people who describe themselves as "hackers", most just want to run Android or iOS and buy/run closed-source apps, and are more interested in Javascript and employment [read: eating, having shelter] than reverse-engineering and doing things that have never been done before. How many opportunities are there to work on secure communications software full time and still put food on the table?

A LOT. But on the other side of the fence. LEO are paying like mad for secure communication solutions. And breaking into others.

* ethics not included

Re: There are no secure smartphones

#93

Post by fulafel »

pslam wrote: post #13
gue5t wrote: post #3

The folks at http://neo900.org/ are well aware of this and that phone is designed accordingly (details at http://neo900.org/faq#privacy ). Hype-driven products like BlackPhone misrepresent their devices as being perfectly secure when this significant attack vector is completely unmitigated. On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. There is no…

> On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. You'll find the modem on most smartphones is connected via USB - or rather its chip-to-chip version, HSIC. For SoCs where it's on-die - on the same bus/fabric - they will (if it's not an idiotic design) use an IOMMU of some sort, to prevent DMA from having access outside of its sandbox. Even if it's…

How does one find out about this for a particular phone? I just tried it for one model and the SoC was on the Wikipedia page, but a cursory web search couldn't tell me what kind of modem setup is in it. The SoC in question was the Snapdragon 410. I suppose a dmesg or lsusb on a (rooted?) Android device might do it.

Re: There are no secure smartphones

#94

Post by [deleted] »

seba_dos1 wrote: post #35
pslam wrote: post #13

Earlier quoted context omitted.

> On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. You'll find the modem on most smartphones is connected via USB - or rather its chip-to-chip version, HSIC. For SoCs where it's on-die - on the same bus/fabric - they will (if it's not an idiotic design) use an IOMMU of some sort, to prevent DMA from having access outside of its sandbox. Even if it's…

"Evil USB" (or "bad USB") is possible thanks to the U part of USB - universal. If you connect a pendrive to your computer, it can easily say that it's a keyboard, because your computer cannot easily verify that you haven't just connected a keyboard. It would need to ask you in some trustworthy way to be sure, which sometimes can be problematic. OTOH, on the device like Neo900 it is well-known what kind of device is c…

[deleted]

Re: There are no secure smartphones

#95

Post by drdaeman »

xlayn wrote: post #52

I have address as a response to gue5t how creating a chain of trust may not be a doable goal as probably every part of the system is not trust-able. However I'm thinking a different approach can be taken, suppose we abstract the different ways for communication a device has and use them as sockets or layers and then create an algorithm that distributes the communication through several channels. For example two cellp…

> extra large keys (think 20480 bits instead of 2048)

Don't think it's a wise idea. This was briefly discussed recently: https://news.ycombinator.com/item?id=10794991

Re: There are no secure smartphones

#96

Post by BillinghamJ »

jwise0 wrote: post #78
tptacek wrote: post #58

Earlier quoted context omitted.

I don't think you should trust the baseband. My objection is with the idea that you can look at a design, not see an IOMMU, and extrapolate from that the notion that the baseband has full access to the memory of the other chips in the design. That's a reasonable assumption in a PC design. There may have been a point, for some phones, where it was a valid assumption for phones. It's not with a modern phone design.

In my research on phones from the Unrevoked project (admittedly, 4+ years ago), this was the case: the baseband and the CPU shared the same memory. The baseband memory was carved out from the CPU such that the CPU could not access it, but the microcontrollers serving the baseband had CPU access, as I recall from the Qualcomm boot documentation: the chain of trust from CPU boot was established by the baseband processo…

Bear in mind that the baseband's host system doesn't necessarily need to be the same as the phone's core systems. You could just isolate the baseband and only communicate with it via a defined interface.

Re: There are no secure smartphones

#97

Post by mahouse »

revelation wrote: post #28
chc4 wrote: post #15

Earlier quoted context omitted.

Not only is OsmocomBB incomplete, but it's illegal to use. I've heard it mentioned multiple times that the baseband and the full stack that communicates with the modem has to be verified by the FCC, in order to comply with regulation on RF bandwidth and power. Even if you got it working in your new cell phone, using it would be illegal. I'm not how true that actually is when you can flash router firmware to use illeg…

Well any RF equipment that you either modified or built yourself is per default illegal to use. You can buy a bluetooth-stack-on-a-chip and talk to it with your Arduino but once you sell that as a product you'll still require FCC certification. But the FCC isn't overly concerned if you're doing WiFi or Bluetooth, their area are the broad analog strokes, correct bandwidth and correct power. As such, if you use somethi…

Well, that's actually a problem: if you are forced to use something like OsmocomBB, law enforcement will be more than glad to see they have a new reason to have you in jail.

Re: There are no secure smartphones

#98

Post by wolfgke »

hackuser wrote: post #72

Based on what I've read from more authoritative sources (or is the author an authority in this area?), this information is outdated: > It can be safely assumed that this baseband is highly insecure. It is closed source and probably not audited at all. My understanding is that the genesis of modern baseband firmware is a development effort for GSM basebands dating back to the 1990s during which the importance of secur…

> I've read in several places that basebands now widely use the OKL4 microvisor,[1] based on the formally verified (fwiw) seL4 microkernel, and are much more secure than before. Does anyone know more about this? > > [1] https://gdmissionsystems.com/cyber/products/trusted-computin...

Surely baseband processors are not based on seL4, since it currently has no realtime support (though it is in development: https://wiki.sel4.systems/seL4%200.0.1-rt-dev).

OKL4 is based on a kernel of the L4 family (source: https://en.wikipedia.org/wiki/L4_microkernel_family#Commerci...):

> https://en.wikipedia.org/wiki/L4_microkernel_family

seL4 is another kernel of this family that has been formally verified.

Re: There are no secure smartphones

#100

Post by tptacek »

viraptor wrote: post #81
NateLawson wrote: post #73

Earlier quoted context omitted.

For one example, see the Android kernel for Qualcomm HSIC baseband interface (baseband-qct-mdm-hsic.c) https://git.sphere.ly/Lloir/android_kernel_htc_evitareul/tre... The way manufacturers "mitigate" baseband to main CPU compromise is by using a protocol that allows no initiation from the peripheral device (baseband). It can only talk to the main CPU via a serial-like protocol, not access its memory directly. Other r…

There's a difference between "what it does" and "what it can do" however. I mean, whatever well-defined interface is used, hardware design may leave other options open and unused. Kind of like vmware provides nice interface for folder sharing, but in practice can just write directly to whatever files/memory they want.

It can't DMA. It's not that it chooses not to.
Post reply on HN