Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smartphones with Qualcomm chip secretly send personal data to Qualcomm

nitrokey.com

Post reply on HN
Print view View original

141–150 of 346 posts

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#141

Post by trustingtrust »

Bud wrote: post #64
trustingtrust wrote: post #7

Earlier quoted context omitted.

iPhone involves a lot of telemetry which Apple sends it to itself. We don’t know what kind of contract Apple has with Qualcomm but if it involves Apple anonymising and sending the data to Qualcomm for using its chips then it’s likely going to be the same just in a different form. I’m pretty sure Qualcomm would like some kind of telemetry from its partners it sells chips to.

That's actually not likely at all. There's no reason for Apple to trash its reputation by doing something stupid like this for Qualcomm's benefit.

Telemetry is something like : this is the history of modem signals etc. Something Qualcomm might have in its contract.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#142

Post by dragonelite »

finikytou wrote: post #73

this news was a direct ban of chinese made phones but because it is qualcomm it is fine. we can safely assume there are backdoors into every american-made electronics

Pretty much it just pick your poison and want to keep a secret keep it in your head unless you let them chip up that place too.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#143

Post by lovelearning »

gabereiser wrote: post #41

This is all assumptions. Just because izatcloud.net is owned by Qualcomm = they must be exfiltrating personal data? c'mon! Then you go and peddle your own NitroPhone as a "Qualcomm free" alternative? You're just gaslighting your customers to buy. This is a very short-sighted article based on lax assumptions and NO WIRESHARK to back it up. Just because a firmware makes a call home doesn't mean it's sending your person…

I fail to see why, in the absence of rigorous technical evidence, my benefit of the doubt should be with QualComm by default.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#144

Post by bgun »

wlesieutre wrote: post #84
callmeal wrote: post #83

Earlier quoted context omitted.

>Imagine if you bought a car from somebody, and they secretly kept a spare key and periodically used your car to run their personal errand. It's worse than that. It's like you bought a house from somebody and they secretly left cameras all over the living room, bedroom, bathroom, and kitchen so they can get 'telemetry' ostensibly to improve the next house they build, for 'safety' in case there's an accident, and to '…

So it's like buying a Tesla https://www.reuters.com/technology/tesla-workers-shared-sens...

But worse, it's like being required to own a Tesla because it's the only car available.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#145

Post by jruohonen »

tgtweak wrote: post #109

I think it would be meaningful to introspect that data since clearly it's not encrypted using https - this would be trivial with a MITM proxy on the gateway. All of this to push your own platform without any data backing it up aside from an http connection and privacy policy. Pretty alarmist. Not that anyone is advocating for unauthorized connections to the manufacturer of your hardware, but the author should at mini…

I agree; it was quite a bad article promoting their own "secure" phone. As for your last paragraph, it is hardly a secret that smartphones cannot be trusted in general. It is already a common practice to leave phones out when attending some meetings. I am not sure whether even diplomats and such truly trust the hardened phones their governments give them when located in certain countries. Fortunately, I do not have to worry about such things myself.

A good read on these matters:

https://www.direkt36.hu/en/putyin-hekkerei-is-latjak-a-magya...

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#146

Post by captainmuon »

As the article mentions, this is for assisted GPS. I've worked quite a bit with this system on android and implemented (or rather fixed) it for a custom android device. I've also worked with separate Qualcomm modems in the past. They are basically a whole small Linux computer in a package. You supply voltage, antennas, and connect via serial or USB, and then you can send AT commands to control it.

On the one hand it wouldn't surprise me if the Qualcomm modem accesses the network on it's own - it very much wants to be a black box - on the other hand I doubt this story for two reasons:

- WiFi is implemented on the Android side. In all Android implementations I've seen, the WiFi module is part of the SoC or a separate chip, and Android runs the regular wpa_supplicant and so on. The chip cannot see the contents of packages, it only passes the bytes to the MAC (not sure if it is called that with WiFi).

(Now, of course in the case of a SoC the chip could, with driver support, peel back the encryption and inject it's own traffic, just like some IPMIs can share an ethernet connection with the OS. I just have not seen this yet.)

- In Android, it is usually the responsibility of the OS to fetch the AGPS data / almanach. You have a HAL consisting of a proprietary library (.so) that you get from the GPS vendor, some glue code, and a gps.conf. The gps.conf file lists the URLs to get the AGPS data. I'm not sure if the download is performed in the .so or in Java code, but anyway it is totally in the OS and not in the modem, at least in the cases I know. When a custom ROM, even a "degoogled" one, is made, you include a customized kernel and custom drivers, and the AGPS URLs are part of this "driver".

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#147

Post by dcow »

JohnFen wrote: post #125
russell_h wrote: post #119

Earlier quoted context omitted.

I think every major car manufacturer has some kind of remote unlock capability these days - people want an app. You could design one of those apps to end-to-end encrypt all comms with the car, but I don't think most people would appreciate the usability hit.

> I think every major car manufacturer has some kind of remote unlock capability these days - people want an app. Correct. And that (along with everything else related to it) is why I won't own a car that was made too recently.

Replying to both of you, first off which manufacturers let you choose the 3rd party remote access authorized agent? And which won’t machine new keys if you send them a request and your vin or key code. Second, Tesla comms are encrypted.

Anyway, if you don't want to use vehicles which communicate with a server then good for you. Really. But if you’re taking such a stance I hope it’s based on informed data and consistent principles and not cringy FUD.

There is nothing that leads me to believe that a Tesla is a “surveillance platform” despite it being a machine that is capable of becoming one. It’s a car. It gets me from A to B. Thats the agreement I have with the manufacturer. I primarily use my app/phone instead of physical keys. I opt in to sharing diagnostic info with Tesla to improve the experience. It’s all pretty above board.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#148

Post by seretogis »

dcow wrote: post #113
JohnFen wrote: post #96

Earlier quoted context omitted.

What a strange point. The ability to break into a car is rather different than having a constant data connection to the car.

I’m trying to discern your point. If it’s about cars having a data connection then my point makes no sense, obviously. But your comment was in response to someone complaining about “remote control” which is just “remote unlock” (that’s all Tesla does remotely in the context of GGP). So that’s how I interpreted your response.

It seems you're being deliberately obtuse. There is a clear and obvious difference between "well someone can break that" and "someone has built a backdoor into this thing you purchased, for their own use".

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#149

Post by amelius »

freedomben wrote: post #21

This seems like much bigger news than it's being received as. Sure, other chip makers do sketchy things, but is that really where we're at in 2023? We're so beaten down by proprietary user-disrespecting hardware/software that we just shrug it off? This makes me mad. I'm so sick of this type of thing. It's a horrible time too because the embedded 5G chips are about to be part of everything , sending telemetry back abo…

Just imagine what would happen if Qualcomm had a Chinese owner.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#150

Post by fifteen1506 »

LobsterJohnson wrote: post #55

Question about people in the industry: Is this like "yeah it was a team of 50 programers and then 200 testers involved in making the chip that new about this". Or is it like "fucking brown-nose Dylan who got a bonus to stfu and implement it".

Probably the second, but I don't work in the industry.
Post reply on HN