Hardening cellular basebands in Android
security.googleblog.com
Hardening cellular basebands in Android
1–10 of 109 posts
Re: Hardening cellular basebands in Android
#2Isn't all of this obvious for a modern C or C++ codebase? Is the state of Android baseband so bad that these are useful suggestions? Are they at least properly ring-fenced from the host CPU/RAM these days?
Re: Hardening cellular basebands in Android
#3The ASAN etc. are nice suggestions for parsing the OTA messages delivered over a link. It really mattered with serial links
But if there's a CPU, and the link has access to the IO space, I'd prefer to first have IOMMU to avoid giving too much trust to the baseband: a takeover or exploit of whatever's parsing the messages would then be a lesser concern.
Most 4G/5G modems are connected straight to the PCI bus and I believe that's far more unsafe: with no IOMMU, in case of a baseband takeover, it's game over.
Old serial ports on well-known IO (ex: COM1 0x03f8, COM2 0x02f8) seem to have provided a natural checkpoint and chokepoints.
Or am I missing something obvious?
Re: Hardening cellular basebands in Android
#4All good points, but why write this in an 'open letter' style to unnamed baseband vendors?
Does Google not have sufficient contact with key decision makers at Qualcomm, MediaTek, Samsung, etc. to encourage them to improve the the security of their baseband firmware? Those are the people who really need to be convinced.
Re: Hardening cellular basebands in Android
#5All good points, but why write this in an 'open letter' style to unnamed baseband vendors? Does Google not have sufficient contact with key decision makers at Qualcomm, MediaTek, Samsung, etc. to encourage them to improve the the security of their baseband firmware? Those are the people who really need to be convinced.
[deleted]
Re: Hardening cellular basebands in Android
#6Isn't all of this obvious for a modern C or C++ codebase? Is the state of Android baseband so bad that these are useful suggestions? Are they at least properly ring-fenced from the host CPU/RAM these days?
[deleted]
Re: Hardening cellular basebands in Android
#7Isn't all of this obvious for a modern C or C++ codebase? Is the state of Android baseband so bad that these are useful suggestions? Are they at least properly ring-fenced from the host CPU/RAM these days?
The problem is it isn't "Android baseband", it doesn't run on the CPU that Android does at al. Instead, an entire second whole computer (not even a "microcontroller", in many cases they are just as powerful per-core as your real CPU) that runs a closed source realtime OS that Google (et al.) has zero visibility into.
Some phones straight up admit the baseband is actively hostile and only communicates with it via serial (which leads to poor performance, but a secure phone). Some phones, such as any using a vanilla Qualcomm Snapdragon setup of any generation simply don't care: the baseband firmware has more holes than a slice of swiss, and the IOMMU refuses to allow the OS to restrict the baseband processor's view into system RAM.
This is a known attack vector used by state sponsored actors, including the US breaking into the phones of so-called "drug lords" to ease drop on them live from their own phones , without a call being active.
Until basebands are mandated to be FOSS for security and safety reasons, Google is just moving the chairs around on the deck of a sinking ship.
Re: Hardening cellular basebands in Android
#8All good points, but why write this in an 'open letter' style to unnamed baseband vendors? Does Google not have sufficient contact with key decision makers at Qualcomm, MediaTek, Samsung, etc. to encourage them to improve the the security of their baseband firmware? Those are the people who really need to be convinced.
It isn't about "sufficient contact". Google knows exactly who to call at any of these companies, and those people will pick up the phone when they see Google is the one calling.
Qualcomm actively botches the security of their products as per request of many governments.
The purpose of the letter is to openly shame these companies without directly accusing them of foul play, instead of gently painting them with the brush of mere incompetence, mere lack of knowledge how modern tooling works.
Re: Hardening cellular basebands in Android
#9The ASAN etc. are nice suggestions for parsing the OTA messages delivered over a link. It really mattered with serial links But if there's a CPU, and the link has access to the IO space, I'd prefer to first have IOMMU to avoid giving too much trust to the baseband: a takeover or exploit of whatever's parsing the messages would then be a lesser concern. Most 4G/5G modems are connected straight to the PCI bus and I bel…
Take a few steps back, the obvious problem is that all phones are chock full of mysterious black boxes that the owner of the device has zero say over.
Android has the problem of being too open to prevent backwards implementations and shitty, vulnerable, and bug prone code, but not open enough for anyone with the incentive to fix those issues to actually be allowed to fix them.
I see the eventualities to be either Google locks down android significantly, and the market shifts to something more akin to Nvidia's board partner model, or, it opens way up, and device manufacturers open source their implementations of various system devices in order to crowd source fixes/improvements/etc. The former is much more likely than the latter, but, as a consumer, the latter would be preferable.
Re: Hardening cellular basebands in Android
#10Guessing the Tensor G1..3 based Android phones are not affected by 5Ghoul? https://asset-group.github.io/disclosures/5ghoul/