Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening cellular basebands in Android

security.googleblog.com

Post reply on HN
Print view View original

51–60 of 109 posts

Re: Hardening cellular basebands in Android

#51

Post by BobbyTables2 »

dwbehappy wrote: post #33
phh wrote: post #26

I'd rather say the issue is NOT that basebands need hardening (ok they do need it), but that we should stop putting things there. The article mentions parsing XML, doing DNS, IMS, TCP and IP stacks. As far as I know, all of those are down for one single purpose which is VoLTE (And VoWifi, and other related features which all go under the umbrella of "IMS"). On top of that, they also need to do IPSec (should be pretty…

Not to take away from your excellent work, but what the hell is the point of VoWifi ? Why not just handle this with a well tuned user space app that runs on udp/whatever over any network connectivity you have already, whether it's wifi/cellular/pigeon carrier. It seems like its an entirely US-centric thing, motivated by a] cost savings from not using data on the cell network (not a problem for most of the world who h…

I think your concerns are misplaced.

Things like TCP/IP and DNS are child’s play compared to the complexity of cellular baseband firmware — even for just a single 2G/3G/4G standard.

The SIM card layer is also another nightmare in itself.

Re: Hardening cellular basebands in Android

#52

Post by BobbyTables2 »

I feel like this article was surely written by someone who has never actually looked at cellular baseband firmware, listened to researcher’s talks, or even stayed at a Holiday Inn.

Cellular hardware companies have to care first… As in NOT using crappy 32bit processors without virtual memory.

Things like non-executable stacks have merit… ASLR has merit…

Then, we can start yapping about compiler flags…

Re: Hardening cellular basebands in Android

#53

Post by abdullahkhalids »

DiabloD3 wrote: post #47
abdullahkhalids wrote: post #40

Earlier quoted context omitted.

What's stopping two trillion dollar corporations who assemble/build their own phones and phone OSes from designing/manufacturing their own secure baseband chip and getting it certified?

Qualcomm owns patents on an international standard. They sued Apple and arguably won, although they settled out of court. Apple had bought Intel's LTE unit and the patents that came with it, and Qualcomm and Intel both licensed patents into a common pool (and as such, any member of that pool did not owe any other member royalties); Apple inherited Intel's position in the pool and continued licensing patents to the po…

Thank you. I didn't know that.

It seems two essential patents will expire in 2029 and 2030 [1]. So we are basically stuck in this mess till then.

[1] http://www.fosspatents.com/2022/06/lessons-from-rejection-of...

Re: Hardening cellular basebands in Android

#54

Post by numpad0 »

iforgotpassword wrote: post #39
danielheath wrote: post #34

Earlier quoted context omitted.

There have been, but iPhones all have the baseband connected via an MMU, so even if you get code execution it's hard to exploit usefully (you can see/modify packets, but nearly everything is encrypted these days). Some android manufacturers also have an MMU but others connect the baseband directly to main memory, leading to total device takeover when the baseband is compromised.

I can't find any trace of this with a quick Google search, but I'm super sure I read about the very first iPhones having the baseband module talk to the soc via USB as an isolation measure, since USB didn't have DMA or anything "dangerous". Anybody else heard that, or am I hallucinating?

USB? Not UART serial? It seemed a lot of early smartphones did have the modem over AT commands through serial port, like good old DOS computers.

Re: Hardening cellular basebands in Android

#55

Post by acaloiar »

uncertainrhymes wrote: post #37
acaloiar wrote: post #16

For those who don't eat and breathe this stuff, "basebands" are the processors that do all the cellular radio stuff on your smartphone. They're separate from device CPUs (referred to as the Application Processor), and are loaded with firmware. This post is about securing the firmware that runs on these little processors. When baseband firmware is compromised, it can lead to complete device compromise.

This particular comment became the first Google search result (or 'featured snippet') for me for "What is Android Baseband" -- weirdly claiming to be posted four hours ago when this comment was two hours old. That is mindblowing to me. Full credit to the poster for becoming the canonical answer, but I'm not sure how I feel about Google picking comments without even some kind of page-rank-weighted attempt at deciding…

Yikes. Google put my grug brain [1] synopsis on full display?

Google, please use less grug brained explanation of baseband processors [2]. ty

[1] https://grugbrain.dev/

[2] https://en.wikipedia.org/wiki/Baseband_processor

Re: Hardening cellular basebands in Android

#56

Post by numpad0 »

winter_blue wrote: post #36
acaloiar wrote: post #16

For those who don't eat and breathe this stuff, "basebands" are the processors that do all the cellular radio stuff on your smartphone. They're separate from device CPUs (referred to as the Application Processor), and are loaded with firmware. This post is about securing the firmware that runs on these little processors. When baseband firmware is compromised, it can lead to complete device compromise.

The device drivers for these baseband processors really should be run inside virtual machines. Most modern processors support IOMMUs [1], and assuming that (hopefully) modern cellphone processors have IOMMU support, the operating system should be updated to running device drivers in an isolated container or VM. With Linux not being a microkernel there’s a high likelihood the device driver expects to run in kernel mod…

It's usually Linux that gets isolated by classical(not like modern VMM) monitor and kept away from baseband, not the other way around.

Re: Hardening cellular basebands in Android

#57

Post by eightysixfour »

lstodd wrote: post #49
eightysixfour wrote: post #42

Earlier quoted context omitted.

VoWifi is neither US centric nor purely about efficiency - it allows you to make calls with your phone to another phone via a third party network when you don’t have cellular connectivity. For example if you have poor cell coverage at your home or office, you can still make and receive calls via a wifi connection using your phone number instead of forcing everyone to sign up for some third party service.

Well, this sort of reinforces the point - there are about zero places in Europe where you have Wifi but do not have cheap almost-unlimited 4G/LTE. In fact it's wifi that's dying out here, the only thing that keeps it alive is that in a cafe setting it's still somewhat faster, and it eats a bit less battery.

I’m not sure we are talking about the same thing - just because you have cheap unlimited 4G doesn’t mean you get that 4G signal in a basement. VoWifi lets you still call someone with your phone number when the signal is bad but you have wifi access…

Re: Hardening cellular basebands in Android

#58

Post by sib »

lstodd wrote: post #49
eightysixfour wrote: post #42

Earlier quoted context omitted.

VoWifi is neither US centric nor purely about efficiency - it allows you to make calls with your phone to another phone via a third party network when you don’t have cellular connectivity. For example if you have poor cell coverage at your home or office, you can still make and receive calls via a wifi connection using your phone number instead of forcing everyone to sign up for some third party service.

Well, this sort of reinforces the point - there are about zero places in Europe where you have Wifi but do not have cheap almost-unlimited 4G/LTE. In fact it's wifi that's dying out here, the only thing that keeps it alive is that in a cafe setting it's still somewhat faster, and it eats a bit less battery.

Europe is approximately 7% of the land surface area of the world. We don't all live in small, densely populated places :)

Re: Hardening cellular basebands in Android

#59

Post by cyberax »

lstodd wrote: post #49
eightysixfour wrote: post #42

Earlier quoted context omitted.

VoWifi is neither US centric nor purely about efficiency - it allows you to make calls with your phone to another phone via a third party network when you don’t have cellular connectivity. For example if you have poor cell coverage at your home or office, you can still make and receive calls via a wifi connection using your phone number instead of forcing everyone to sign up for some third party service.

Well, this sort of reinforces the point - there are about zero places in Europe where you have Wifi but do not have cheap almost-unlimited 4G/LTE. In fact it's wifi that's dying out here, the only thing that keeps it alive is that in a cafe setting it's still somewhat faster, and it eats a bit less battery.

That's not quite true. There are older buildings with brick walls that have bad cellular reception.

Conversely, some high rises have a too _good_ reception and the radio spectrum can get congested.

Re: Hardening cellular basebands in Android

#60

Post by numpad0 »

alufers wrote: post #43
dwbehappy wrote: post #33

Earlier quoted context omitted.

Not to take away from your excellent work, but what the hell is the point of VoWifi ? Why not just handle this with a well tuned user space app that runs on udp/whatever over any network connectivity you have already, whether it's wifi/cellular/pigeon carrier. It seems like its an entirely US-centric thing, motivated by a] cost savings from not using data on the cell network (not a problem for most of the world who h…

I used to live in an old apartment block with thick concrete walls, and away from a cellular base station. VoWifi was really helpful if I wanted to make calls from my home. I guess I could use WhatsApp/Facetime/Signal, but the insurance agent won't call me on WhatsApp from her landline phone :) And it is not handled by an app on your phone, because of legacy reasons. I believe that, before LTE was introduced, 2G and…

I think it was lots of parallel development - some mid-to-late 3G phones had carrier hand-rolled Wi-Fi calling, some had femtocell support instead, LTE was to be just faster packet-only Internet mode for 3G, became its own thing too late which necessitated CSFB, and then Wi-Fi calling became reimplemented as part of standard, etc.
Post reply on HN