Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There are no secure smartphones

devever.net

Post reply on HN
Print view View original

111–120 of 124 posts

Re: There are no secure smartphones

#111

Post by NateLawson »

pslam wrote: post #79
NateLawson wrote: post #75

Earlier quoted context omitted.

This is correct. The problem in this example is not the pendrive, but the automatic selection of device drivers based on the PC OS 100% trusting physical access. An easy way to see this is recompile the USB keyboard driver to ignore keyboard descriptors with a particular address or vendor ID. If you do this, the pendrive can't do anything because USB is host-controlled, as implemented by the OS. Without the OS initia…

I picked a terrible example which doesn't demonstrate what I intended to. Any USB link requires the host to maintain some persistent state in data structures mirroring what it thinks the state of the device is. There's no "DMA" in the sense that the device has direct access to the host - but that doesn't preclude something as mundane as a buffer overflow, use-after-free and so on. "DMA", with appropriate IOMMU, is ju…

Yes, parsing of untrusted data, race conditions, etc. are still a problem in general. My complaint was with the uninformed article, not your analysis.

Re: There are no secure smartphones

#112

Post by mindslight »

NateLawson wrote: post #71
mindslight wrote: post #51

Earlier quoted context omitted.

What is the impetus to trust assertions of independence given both processors are still on the same die? Mobile phones have a readily available control/backhaul channel and there's a long history of carrier enforced device control and state mandated telecom surveillance effecting [sic] the design culture. Qualcomm obviously works with the NSA, if only to protect against infiltration by other intelligence agencies. So…

The original post talks about DMA being a method the baseband can use to compromise the AP, which is false for any mainstream design. Trust doesn't have anything to do with it; the protocol literally does not support DMA.

The conclusion of the original post isn't wrong though, despite the exact details being out of date by (a scant) 5 years.

I have a hard time believing that HSIC is the entire extent of interconnection, with the processors being on the same die and all. Are you asserting that the baseband and application processors use completely independent rams and flashes? Independent memories seem more expensive (price+power) than a single shared bank with MMU, but since the storage requirements of the baseband are known at design time then perhaps not terribly.

If they aren't independent memories, then the term DMA actually still applies even if the interconnect protocol is not based on it. Mobile literature is quite inaccessible (another symptom), but everything I've seen refers to having an MMU as the advancement. I have a hard time believing that would be controlled by the application processor (leaving the baseband vulnerable), but please correct me with specifics if this is wrong.

Re: There are no secure smartphones

#113

Post by yuubi »

rsync wrote: post #66
yuubi wrote: post #59

Earlier quoted context omitted.

The SIM in 3G isn't really much like a DRM thingy, apart from containing a key; it's more like a securid keyfob. The only interesting thing it does (apart from storing constants like its serial number and variables like your phone book and text messages) is to generate authentication responses (to prove to the network that you have it) and derive session keys (so your phone can encrypt and authenticate what it sends…

"The only interesting thing it does (apart from storing constants like its serial number and variables like your phone book and text messages) is to generate authentication responses" The most interesting thing your SIM card does is run arbitrary programs that can be uploaded to them, without your knowledge, by the carrier: https://www.defcon.org/images/defcon-21/dc-21-presentations/... The SIM card is a full compute…

These programs can't do much that the carrier couldn't do without your help: set up calls, send/receive SMS/USSD, sort of thing. It's not as if they ran on the application processor as root or had DMA to the app processor's memory.

Re: There are no secure smartphones

#114

Post by tptacek »

mindslight wrote: post #112
NateLawson wrote: post #71

Earlier quoted context omitted.

The original post talks about DMA being a method the baseband can use to compromise the AP, which is false for any mainstream design. Trust doesn't have anything to do with it; the protocol literally does not support DMA.

The conclusion of the original post isn't wrong though, despite the exact details being out of date by (a scant) 5 years. I have a hard time believing that HSIC is the entire extent of interconnection, with the processors being on the same die and all. Are you asserting that the baseband and application processors use completely independent rams and flashes? Independent memories seem more expensive (price+power) than…

You can use this same kind of logic to suggest that any system is broken.

Some of the cores on a complicated mobile device might have their own memories, and some of them might be isolated from the memories of other cores with silicon. I'm sure there are devices where there are insecure cores with no isolation at all --- just like there's a ton of C code that will read a URL off the wire into a 128 buffer on the stack.

The problem you're suggesting device designers have to solve --- allowing core A access only to a range of the total memory available "on the die" --- isn't a hard one.

From the suggestions you've made in your comments --- and I mean this respectfully --- I think you'd be very surprised by the hardware systems design in a modern mobile device. They are in some ways more sophisticated than the designs used for PCs.

So, the point of this subthread is that mobile devices are much more complicated than the simplistic ("no IOMMU? the baseband can read/write AP memory!") model proposed in the article. It makes an OK overall point (we should care about baseband security!) but uses a very flawed argument to get there.

Re: There are no secure smartphones

#115

Post by seba_dos1 »

tptacek wrote: post #100
viraptor wrote: post #81

Earlier quoted context omitted.

There's a difference between "what it does" and "what it can do" however. I mean, whatever well-defined interface is used, hardware design may leave other options open and unused. Kind of like vmware provides nice interface for folder sharing, but in practice can just write directly to whatever files/memory they want.

It can't DMA. It's not that it chooses not to.

It all depends on particular design. There are even some out there where baseband OS and Linux run under the same proprietary hypervisor. On modern phones it's pretty rare to be able to say with 100% certainty that the baseband OS doesn't have any access to user memory - and often you can say with 100% certainty that it can access other interesting stuff, like GPS or microphone, without any supervision from the user.

Re: There are no secure smartphones

#116

Post by mindslight »

tptacek wrote: post #114
mindslight wrote: post #112

Earlier quoted context omitted.

The conclusion of the original post isn't wrong though, despite the exact details being out of date by (a scant) 5 years. I have a hard time believing that HSIC is the entire extent of interconnection, with the processors being on the same die and all. Are you asserting that the baseband and application processors use completely independent rams and flashes? Independent memories seem more expensive (price+power) than…

You can use this same kind of logic to suggest that any system is broken. Some of the cores on a complicated mobile device might have their own memories, and some of them might be isolated from the memories of other cores with silicon. I'm sure there are devices where there are insecure cores with no isolation at all --- just like there's a ton of C code that will read a URL off the wire into a 128 buffer on the stac…

Actually the real problem I'm suggesting device designers need to solve is doing the bare minimum to make the public (ie decentralized vulnerability seekers) believe that the application processor is likely secure from the cell network. Doubly so because the entire history of their industry has been the exact opposite philosophy.

I have no doubt mobile chipsets contain a surprising amount of complexity. I'd love to be surprised by it! But I've only ever run across vague references to various improvements, which are worth just as much as saying "Our code uses AES!".

It's obviously easy to restrict a core to certain memory ranges. But how is that restriction set? Is it fixed in the mask (leading to inflexibility), or is it set through registers? The bullet point is enough to satisfy a PHB's sense of security, but we know it's the details of those loose ends where the exploits lie. And the threat model of Qualcomm is quite different from the threat model of a phone's owner.

Simplistic points like the OP are really a symptom of this not knowing. Can you blame them for not knowing the exact vulnerability? It's like someone picking on a binary blob, saying it can contain a backdoor password. Well, the industry having moved from backdoor passwords to challenge-response isn't really a defense to the overriding point, is it?

Re: There are no secure smartphones

#117

Post by seba_dos1 »

Gregordinary wrote: post #105
gue5t wrote: post #3

The folks at http://neo900.org/ are well aware of this and that phone is designed accordingly (details at http://neo900.org/faq#privacy ). Hype-driven products like BlackPhone misrepresent their devices as being perfectly secure when this significant attack vector is completely unmitigated. On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. There is no…

There is also https://www.freecalypso.org/ which aims to produce libre firmware for the TI Calypso baseband chipset. Their mailing list is fairly active.

Please remember that FreeCalypso is not free software in commonly used sense - it uses unlicensed code from leaks. People behind FreeCalypso don't care about law, so they don't mind.

Re: There are no secure smartphones

#118

Post by Niten »

pslam wrote: post #13
gue5t wrote: post #3

The folks at http://neo900.org/ are well aware of this and that phone is designed accordingly (details at http://neo900.org/faq#privacy ). Hype-driven products like BlackPhone misrepresent their devices as being perfectly secure when this significant attack vector is completely unmitigated. On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. There is no…

> On the Neo900, the modem is connected via USB (bus; there is no physical connector) which means it doesn't have DMA. You'll find the modem on most smartphones is connected via USB - or rather its chip-to-chip version, HSIC. For SoCs where it's on-die - on the same bus/fabric - they will (if it's not an idiotic design) use an IOMMU of some sort, to prevent DMA from having access outside of its sandbox. Even if it's…

> For SoCs where it's on-die - on the same bus/fabric - they will (if it's not an idiotic design) use an IOMMU of some sort, to prevent DMA from having access outside of its sandbox.

Do you happen to know whether this is the case for the latest generation of Qualcomm SoCs such as the Snapdragon 810 / MSM8994?

Re: There are no secure smartphones

#119

Post by tptacek »

mindslight wrote: post #116
tptacek wrote: post #114

Earlier quoted context omitted.

You can use this same kind of logic to suggest that any system is broken. Some of the cores on a complicated mobile device might have their own memories, and some of them might be isolated from the memories of other cores with silicon. I'm sure there are devices where there are insecure cores with no isolation at all --- just like there's a ton of C code that will read a URL off the wire into a 128 buffer on the stac…

Actually the real problem I'm suggesting device designers need to solve is doing the bare minimum to make the public (ie decentralized vulnerability seekers) believe that the application processor is likely secure from the cell network. Doubly so because the entire history of their industry has been the exact opposite philosophy. I have no doubt mobile chipsets contain a surprising amount of complexity. I'd love to b…

I can blame them for not knowing any vulnerability, and then proceeding to make new ones up on message boards, yes.

Re: There are no secure smartphones

#120

Post by mindslight »

tptacek wrote: post #119
mindslight wrote: post #116

Earlier quoted context omitted.

Actually the real problem I'm suggesting device designers need to solve is doing the bare minimum to make the public (ie decentralized vulnerability seekers) believe that the application processor is likely secure from the cell network. Doubly so because the entire history of their industry has been the exact opposite philosophy. I have no doubt mobile chipsets contain a surprising amount of complexity. I'd love to b…

I can blame them for not knowing any vulnerability, and then proceeding to make new ones up on message boards, yes.

"New" one? Was shared memory communication actually never that prevalent?
Post reply on HN