Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening cellular basebands in Android

security.googleblog.com

Post reply on HN
Print view View original

61–70 of 109 posts

Re: Hardening cellular basebands in Android

#61

Post by lstodd »

cyberax wrote: post #59
lstodd wrote: post #49

Earlier quoted context omitted.

Well, this sort of reinforces the point - there are about zero places in Europe where you have Wifi but do not have cheap almost-unlimited 4G/LTE. In fact it's wifi that's dying out here, the only thing that keeps it alive is that in a cafe setting it's still somewhat faster, and it eats a bit less battery.

That's not quite true. There are older buildings with brick walls that have bad cellular reception. Conversely, some high rises have a too _good_ reception and the radio spectrum can get congested.

Where it does matter they put a femtocell which is about as complicated as a wifi AP.

Re: Hardening cellular basebands in Android

#62

Post by lstodd »

sib wrote: post #58
lstodd wrote: post #49

Earlier quoted context omitted.

Well, this sort of reinforces the point - there are about zero places in Europe where you have Wifi but do not have cheap almost-unlimited 4G/LTE. In fact it's wifi that's dying out here, the only thing that keeps it alive is that in a cafe setting it's still somewhat faster, and it eats a bit less battery.

Europe is approximately 7% of the land surface area of the world. We don't all live in small, densely populated places :)

And US is 6.1% Your point?

Re: Hardening cellular basebands in Android

#63

Post by lstodd »

eightysixfour wrote: post #57
lstodd wrote: post #49

Earlier quoted context omitted.

Well, this sort of reinforces the point - there are about zero places in Europe where you have Wifi but do not have cheap almost-unlimited 4G/LTE. In fact it's wifi that's dying out here, the only thing that keeps it alive is that in a cafe setting it's still somewhat faster, and it eats a bit less battery.

I’m not sure we are talking about the same thing - just because you have cheap unlimited 4G doesn’t mean you get that 4G signal in a basement. VoWifi lets you still call someone with your phone number when the signal is bad but you have wifi access…

I was never into insisting to only talk on the phone from the basement of my medieval castle. The view from the battlements is much better.

We're not all jamesbondesque supervillains here.

Like I said above, for like $8/mo you have in fact unlimited 4G at decent speeds here. Or for idk maybe $15 you can get a gpon, unlimited traffic, 30+Mbit to the house, depending on local laziness of course. And that is for a rural place in Balkans, not something in more civilized places.

Re: Hardening cellular basebands in Android

#64

Post by tripdout »

mschuster91 wrote: post #28
avidiax wrote: post #17

Earlier quoted context omitted.

I doubt there's publicly available evidence. Assuming incompetence before malice, I'd say that Qualcomm and the other 5G baseband manufacturers have such a moat around cellular modems that it doesn't need to be secure. It's not a competitive advantage. A security critical application simply assumes that the network and the 5G baseband are compromised.

> Assuming incompetence before malice You may be on the right track here. It's just one anonymous HN comment [1], but it fits other pieces (e.g. BSP code dump quality). The sad thing is, there is no competition where one could go to - it's either Mediatek who have serious issues of their own, or Samsung who mostly stick to themselves. [1] https://news.ycombinator.com/item?id=38607205

> BSP code dump quality

I know they're proprietary, but got any more info on this? Would be super interesting.

Re: Hardening cellular basebands in Android

#65

Post by chislobog »

galangalalgol wrote: post #19
csdvrx wrote: post #13

Earlier quoted context omitted.

> Until basebands are mandated to be FOSS for security and safety reasons, Google is just moving the chairs around on the deck of a sinking ship. I agree. I couldn't see much of a point in the techniques discussed when there's a huge elephant in the room, and you can't fix it, so I thought I was missing something obvious. I wasn't: it's just security theater, doing something for the sake of doing something, while the…

Graphene recommends a modern pixel. If they can properly restrict memory access on those phones and the baseband doesn't have any direct access to the mic via analog signal or similar, then it probably can't listen in on either incoming or outgoing communication, that should all be encrypted before it hits the memory right? You could still be located and identified, but they don't need to compromise your baseband for…

This could be old info but I believe the Baseband chipset has its own microphone in addition to access to the user mics for the purposes of signal processing.

This was a stink years ago and part of the GSMK product development. AFAIK GSMK is the only commercially available product to have a baseband firewall and their own stuff running to deal with this

Re: Hardening cellular basebands in Android

#66

Post by [deleted] »

BobbyTables2 wrote: post #52

I feel like this article was surely written by someone who has never actually looked at cellular baseband firmware, listened to researcher’s talks, or even stayed at a Holiday Inn. Cellular hardware companies have to care first… As in NOT using crappy 32bit processors without virtual memory. Things like non-executable stacks have merit… ASLR has merit… Then, we can start yapping about compiler flags…

[deleted]

Re: Hardening cellular basebands in Android

#67

Post by [deleted] »

acaloiar wrote: post #16

For those who don't eat and breathe this stuff, "basebands" are the processors that do all the cellular radio stuff on your smartphone. They're separate from device CPUs (referred to as the Application Processor), and are loaded with firmware. This post is about securing the firmware that runs on these little processors. When baseband firmware is compromised, it can lead to complete device compromise.

[deleted]

Re: Hardening cellular basebands in Android

#68

Post by eightysixfour »

lstodd wrote: post #63
eightysixfour wrote: post #57

Earlier quoted context omitted.

I’m not sure we are talking about the same thing - just because you have cheap unlimited 4G doesn’t mean you get that 4G signal in a basement. VoWifi lets you still call someone with your phone number when the signal is bad but you have wifi access…

I was never into insisting to only talk on the phone from the basement of my medieval castle. The view from the battlements is much better. We're not all jamesbondesque supervillains here. Like I said above, for like $8/mo you have in fact unlimited 4G at decent speeds here. Or for idk maybe $15 you can get a gpon, unlimited traffic, 30+Mbit to the house, depending on local laziness of course. And that is for a rural…

Yes, and VoWifi lets your cell phone make a call over that fiber when your wireless coverage isn’t great. Not really sure where castles and battlements come to play here - there are plenty of completely normal places people visit with connectivity issues.

Maybe it is your experience in the rural balkans, where cellular congestion and significant building density aren’t factors, and your assumption it must be better in “civilized” places that is confusing the issue…

Re: Hardening cellular basebands in Android

#69

Post by twothreeone »

JoshTriplett wrote: post #25
twothreeone wrote: post #23

Earlier quoted context omitted.

It's actually strictly worse: even if they had an IOMMU and the drivers were implemented correctly, phone vendors provide remote access tools as part of their firmware stack (e.g., see https://www.fsf.org/blogs/community/replicant-developers-fin... ). To reiterate one of the other commenters, as long as users don't control what code runs on the baseband, they do not in fact have ownership of the device. The same hold…

That's true, but as long as the baseband doesn't have access to the rest of the device, there is at least a limit to how much damage it can do, which is a good incremental step. If it can't exploit the OS, then worst case, it has access to network traffic (just like the next router in the chain, which is why all the traffic should be encrypted), and it has the ability to help locate the device against the user's wish…

It looks like https://osmocom.org/projects/baseband is still somewhat active.. they mainly develop for the TI Calypso (Motorola C123 and some others). My understanding is that all "modern" (meaning 3G and up) modems are basically sealed black boxes.

Re: Hardening cellular basebands in Android

#70

Post by MadnessASAP »

csdvrx wrote: post #22
tptacek wrote: post #18

Earlier quoted context omitted.

It can but doesn't necessarily, right? There's a variety of interconnect and IOMMU architectures here, so it's not a given that a baseband processor has or is one step away from unrestricted access to the whole platform.

it can't and it shouldn't IF IOMMUs were properly used

If I can put my paranoia cap on for a moment. The baseband processor having privileged access to the main processor may be a "feature" not a bug. It's a powerful processor, that is running constantly, has unlimited and continuous inscrutable communication with the network, is the gatekeeper for the main processors communication with the network, and it's firmware is practically required by regulations to be an opaque blob. Seems to be pretty much the ideal place for nefarious deeds.
Post reply on HN