Guessing the Tensor G1..3 based Android phones are not affected by 5Ghoul? https://asset-group.github.io/disclosures/5ghoul/
it probably is, but you won't get the usual academic work for free as you get with more common platforms.
Hardening cellular basebands in Android
21–30 of 109 posts
Re: Hardening cellular basebands in Android
#22For those who don't eat and breathe this stuff, "basebands" are the processors that do all the cellular radio stuff on your smartphone. They're separate from device CPUs (referred to as the Application Processor), and are loaded with firmware. This post is about securing the firmware that runs on these little processors. When baseband firmware is compromised, it can lead to complete device compromise.
It can but doesn't necessarily, right? There's a variety of interconnect and IOMMU architectures here, so it's not a given that a baseband processor has or is one step away from unrestricted access to the whole platform.
it can't and it shouldn't IF IOMMUs were properly used
Re: Hardening cellular basebands in Android
#23The ASAN etc. are nice suggestions for parsing the OTA messages delivered over a link. It really mattered with serial links But if there's a CPU, and the link has access to the IO space, I'd prefer to first have IOMMU to avoid giving too much trust to the baseband: a takeover or exploit of whatever's parsing the messages would then be a lesser concern. Most 4G/5G modems are connected straight to the PCI bus and I bel…
It's actually strictly worse: even if they had an IOMMU and the drivers were implemented correctly, phone vendors provide remote access tools as part of their firmware stack (e.g., see https://www.fsf.org/blogs/community/replicant-developers-fin...). To reiterate one of the other commenters, as long as users don't control what code runs on the baseband, they do not in fact have ownership of the device. The same holds for anything else that has a baseband (such as most modern cars). This sentiment is publicly communicated by telco's and manufacturers and convenient for regulators.
Re: Hardening cellular basebands in Android
#24For those who don't eat and breathe this stuff, "basebands" are the processors that do all the cellular radio stuff on your smartphone. They're separate from device CPUs (referred to as the Application Processor), and are loaded with firmware. This post is about securing the firmware that runs on these little processors. When baseband firmware is compromised, it can lead to complete device compromise.
> When baseband firmware is compromised, it can lead to complete device compromise.
I believe that’s generally only still true for Android and fixing that is what this is talking about. I don’t actually know but I recall when I worked at Apple many years ago that the baseband was firewalled already for this exact reason.
Edit: can’t find any reports of a baseband compromise for iPhones although I wouldn’t rely on a 30 second DuckDuckGo search to state something definitively.
Re: Hardening cellular basebands in Android
#25The ASAN etc. are nice suggestions for parsing the OTA messages delivered over a link. It really mattered with serial links But if there's a CPU, and the link has access to the IO space, I'd prefer to first have IOMMU to avoid giving too much trust to the baseband: a takeover or exploit of whatever's parsing the messages would then be a lesser concern. Most 4G/5G modems are connected straight to the PCI bus and I bel…
It's actually strictly worse: even if they had an IOMMU and the drivers were implemented correctly, phone vendors provide remote access tools as part of their firmware stack (e.g., see https://www.fsf.org/blogs/community/replicant-developers-fin... ). To reiterate one of the other commenters, as long as users don't control what code runs on the baseband, they do not in fact have ownership of the device. The same hold…
That's true, but as long as the baseband doesn't have access to the rest of the device, there is at least a limit to how much damage it can do, which is a good incremental step. If it can't exploit the OS, then worst case, it has access to network traffic (just like the next router in the chain, which is why all the traffic should be encrypted), and it has the ability to help locate the device against the user's wishes (but so do the cell towers).
Rewriting baseband firmware is also a great opportunity to make it Open Source, and I hope that happens as well.
Re: Hardening cellular basebands in Android
#26I'd rather say the issue is NOT that basebands need hardening (ok they do need it), but that we should stop putting things there.
The article mentions parsing XML, doing DNS, IMS, TCP and IP stacks. As far as I know, all of those are down for one single purpose which is VoLTE (And VoWifi, and other related features which all go under the umbrella of "IMS"). On top of that, they also need to do IPSec (should be pretty safe) and SIP (gosh wait too much string handling). The remote Pixel security flaw few months ago was in that VoLTE stack.
This stack should NOT be in an embedded closed source un-auditable system. It should be in a "dumb" sandboxed opensource app in a sandboxed language.
This is exactly what I'm doing: https://github.com/phhusson/ims This is a FLOSS VoLTE + VoWifi[1] implementation for Android written in kotlin with no native code [2].
I'm not recommending it for anyone (I managed to make my first outgoing call with it yesterday), it has real issues (you do want baseband cooperation on various parts, like QoS or roaming to 3G, which I'm choosing to ignore), but I think software IMS is the way of the future.
In addition to security, this allows for a lot of de-obsoleting:
- It helps *a lot* for custom Android ROMs, and compatibility with annoying carriers
- I can integrate top-notch audio codecs (EVS) without breaking a sweat, and deployed for everyone in a jiffy (heck I don't even to reboot user's smartphone's to apply the change, I can just deploy it over Play Store)
- I can integrate modern voice improvements
- I can enable VoWifi on 3G smartphones (Granted, I'm not sure that's extremely useful)
- I can enable features that didn't exist when that smartphone model got released like Cross-Sim VoWifi (you have your french main SIM, you're in the US with a local eSIM, you can do VoWifi of the french SIM over the local eSIM to have cheap 4G voice calls)
I see some movement in AOSP source code that make me think Google will release an opensource IMS within two years, so I'm hopeful my work will be able to go to the trash.
[1] I'm kinda cheating for the wifi part, because it's provided by AOSP, I barely lifted the little finger to enable it. [2] Okay, I added rnnoise for the sake of having a denoising, but it's fixed-size-data-in fixed-size-data-out, so I feel safe there.
PS: I know that my knowledge of 3GPP is pretty thin, so if knowledgeable people want to tell me which parts will still need to remain in modem, I'm curious.
PS2: I'm putting this just in case: For GNU/Linux smartphones (or desktops with SIM card reader), you should be able to use that C+py stack to have userspace vowifi: https://github.com/phhusson/doubango
Re: Hardening cellular basebands in Android
#27Anyone surprised by basebands being vulnerable should know these things:
- there are only three big players in town: Qualcomm, Mediatek and Samsung, and the latter is pretty rare to find outside of Samsung's own devices and the Google Pixel lineup (where they also have been implicated in security [4] and battery performance [5] issues)
- Qualcomm is infamous for suing anyone including Apple for patents crap, which is how this oligopoly formed in the first place, and why there's barely any competition
- It's not the first time serious vulnerabilities have appeared in baseband chips [1]
- and finally, to a possible cause, Qualcomm's development practices [2] are even worse than what's reported about Oracle [3], if these (anonymous) HN comments are to be believed.
[1] https://www.bleepingcomputer.com/news/security/qualcomm-vuln...
[2] https://news.ycombinator.com/item?id=38607205
[3] https://news.ycombinator.com/item?id=18442941
[4] https://www.notebookcheck.com/Google-warnt-vor-massiven-Sich...
[5] https://www.nextpit.com/google-pixel-8-pro-5g-modem-battery-...
Re: Hardening cellular basebands in Android
#28Earlier quoted context omitted.
> Qualcomm actively botches the security of their products as per request of many governments. Interesting, I was not aware that's what they're doing. Is there evidence of this?
I doubt there's publicly available evidence. Assuming incompetence before malice, I'd say that Qualcomm and the other 5G baseband manufacturers have such a moat around cellular modems that it doesn't need to be secure. It's not a competitive advantage. A security critical application simply assumes that the network and the 5G baseband are compromised.
> Assuming incompetence before malice
You may be on the right track here. It's just one anonymous HN comment [1], but it fits other pieces (e.g. BSP code dump quality).
The sad thing is, there is no competition where one could go to - it's either Mediatek who have serious issues of their own, or Samsung who mostly stick to themselves.
Re: Hardening cellular basebands in Android
#29Guessing the Tensor G1..3 based Android phones are not affected by 5Ghoul? https://asset-group.github.io/disclosures/5ghoul/
The Pixel lineup uses Samsung modems.
Re: Hardening cellular basebands in Android
#30Earlier quoted context omitted.
> Qualcomm actively botches the security of their products as per request of many governments. Interesting, I was not aware that's what they're doing. Is there evidence of this?
I doubt there's publicly available evidence. Assuming incompetence before malice, I'd say that Qualcomm and the other 5G baseband manufacturers have such a moat around cellular modems that it doesn't need to be secure. It's not a competitive advantage. A security critical application simply assumes that the network and the 5G baseband are compromised.
Mobile standards themselves are largely driven by groups like 3GPP in order to hopefully skirt around oligopolies like Qualcomm who intentionally patent the entire superset of the Latin alphabet in order to sue anyone with a heartbeat.
So, security itself is driven by third party organization(s) that consists of engineers from mobile technology companies. If Qualcomm wants their cell modems to be 3GPP certified, they _must_ comply to the 5G standard in it's fullest, including all security features (the same will be true for future revisions, 6G, etc)
There's also groups attempting to make mobile protocols and provisioning entirely open source (O-RAN) which, ironically, will likely improve mobile protocol implementation security practices as they can be audited by anyone with an internet connection.