Smartphones with Qualcomm chip secretly send personal data to Qualcomm • Hacker News Board

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#291

Post by the_third_wave » Tue, Apr 25, 2023, 10:52 PM UTC

codetiger wrote: post #16

the_third_wave wrote: post #13

That's why you install a firewall on your phone and disallow all outgoing traffic by default - possible with Android, impossible with iOS as far as I know - and keep those drivers away from the 'net. Yes, the device works, you just see loads of 'connection errors' in logcat but those just tell me things work as intended by me by not working as intended by the likes of Qualcomm. As to aGPS being necessary this depends…

The article is about the hardware chip directly sending these information, not through drivers. It is not about iOS or Android or any other OS.

Pray tell, how does the hardware chip send data to Qualcomm? That data goes over the 'net, right? How does that hardware chip interface with the 'net? The answer here is 'through the OS' since that is how network connections are made on these devices. Even if the hardware chip contained an IP stack it would still need a network connection to get the data back to Qualcomm. That network connection goes either over the wireless interface (3/4/5G), via WiFi, Bluetooth, NFC or any of the other interfaces the device has - all of which are controlled through the OS.

Android, being built on top of Linux which contains Netfilter as I explained elsewhere [1] which allows you to block network access no matter whether the data originates from some hardware chip or somewhere else. The only way data could make its way off the device is if the radio firmware made a covert connection to Qualcomm which could be used to totally bypass the Linux kernel. That connection would not use the system IP stack and it could work even if the user does not have data active. It would need cooperation from network operators (all over the world) to get the data out of the carrier's network to Qualcomm. This is not what this article is about, it is quite possible that the likes of the NSA are up to this type of shenanigans since they may be able to force carriers to do their bidding [2] but Qualcomm is just another corporation looking to 'get to know their customers'. Read the article and you'll see that the data is exfiltrated through Android. A default block for outgoing data - like I use - blocks this just as well as it blocks other similar attempts.

[1] https://news.ycombinator.com/item?id=35707645

[2] https://www.pbs.org/wgbh/frontline/article/how-att-helped-th...

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#292

Post by palata » Tue, Apr 25, 2023, 11:02 PM UTC

captainmuon wrote: post #146

As the article mentions, this is for assisted GPS. I've worked quite a bit with this system on android and implemented (or rather fixed) it for a custom android device. I've also worked with separate Qualcomm modems in the past. They are basically a whole small Linux computer in a package. You supply voltage, antennas, and connect via serial or USB, and then you can send AT commands to control it. On the one hand it…

This comment alone is worth 100x the blog post (which IMO is not worth reading, and is actually confusing).

Thanks for the insights!

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#293

Post by JohnFen » Tue, Apr 25, 2023, 11:05 PM UTC

dcow wrote: post #265

JohnFen wrote: post #212

Earlier quoted context omitted.

> If you’re not comfortable with that feature then don’t buy the car. This was the only point I was actually making, yes. > But don’t go spewing certifiable nonsense about how Tesla backdoors your car and steals your personal data for profit. Aside from niggles about what constitutes a "back door", I was not doing that. > There is nothing in their terms or privacy policy that indicates this is happening, and data col…

> I'm uncomfortable with their data collection Again, I have no idea what you mean by "their data collection". What data are they collecting and how specifically is it being used in an untrustworthy, and harmful way? Our interests are aligned to get to the bottom of how Tesla handles data, because I don't want to own a car that is spying on me and you want a world where the internet doesn't exist (only half tongue in…

> What data are they collecting

As I understand it, they are collecting data about the operation of the cars.

> and how specifically is it being used in an untrustworthy, and harmful way?

I didn't claim that it was. I was expressing my objection at it being collected. I have the same objection to similar data collection by software, electronics, etc.

Allowing data collection is an act of trust. Tesla (like most companies) has not earned that trust, and speaking generally, this trust has been so commonly abused that I give nobody the benefit of the doubt.

> you want a world where the internet doesn't exist

Your tongue may only be half in your cheek, but this statement literally could not be more wrong.

> did you know the car part of a Tesla works entirely offline at 100% capacity?

I would certainly hope so! If it didn't, I'd be saying that Tesla's design was inherently broken. I'm not saying that.

Since you are claiming I have opinions that I do not have, I clearly have done a terrible job explaining what my opinion is. It's pretty simple: the collection of usage data has been widely abused for a long time. Because of that, I have zero trust in almost any company that they won't abuse any data they get about me or my use of my machines. I think that's been well-earned. Teslas (as well as other cars) collect a great deal of data. I object to that.

It isn't because "Tesla sucks" or anything specific to Tesla. It's because Tesla (and not only Tesla) is engaging in a practice that historically has been abused.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#294

Post by JohnFen » Tue, Apr 25, 2023, 11:09 PM UTC

ranger_danger wrote: post #278

JohnFen wrote: post #96

Earlier quoted context omitted.

What a strange point. The ability to break into a car is rather different than having a constant data connection to the car.

Most new cars do have a constant data connection though, including directly to the main CAN bus, where it has been proven that people can steal your car without a key or even disable it remotely. You shouldn't buy any of those cars either...

Indeed so. And I've said clearly several times that I wouldn't. I'm not actually singling Tesla out (especially not commenting on a story that is about Qualcomm, not Tesla). But Tesla's also not some sort of special exception.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#295

Post by [deleted] » Tue, Apr 25, 2023, 11:09 PM UTC

mk89 wrote: post #182

rickdeckard wrote: post #48

A quite overblown article from a company pitching their own "secure phone". They installed a custom OS which apparently includes Qualcomm's indoor positioning service iZat, but is missing the EULA item to allow the user to enable/disable the service. iZat exists for at least 6 years, and the vendors who implemented it usually have a separate checkbox in their startup wizard to allow it to work. Example screenshot aft…

why do you shoot the messenger? yeah they did a bit of advertisement to their phone, who cares. what matters is that now even freaking basic hardware pushes your data wherever they want without asking you. I really wonder if this had been a Chinese company the kind of comments we would have seen here.

[deleted]

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#296

Post by JohnFen » Tue, Apr 25, 2023, 11:11 PM UTC

dcow wrote: post #283

JohnFen wrote: post #165

Earlier quoted context omitted.

Perhaps, but by the time this happens, I'll probably have died of old age. And if it happens sooner, then I expect that there will be electric cars that, either as designed or through aftermarket modifications, won't phone home. And if that doesn't happen, then I guess I won't be using a car. Which is probably the best idea in terms of environmental impact, anyway.

Just snip the LTE antenna in a Tesla and you have an offline car. I can't claim to know if Tesla has built in any actively hostile features like the car going into a maintenance required mode if it's been too long since a ping home, but I do know that the car is fully operational without connectivity (not including features that required connectivity, like navigation data, of course). There are even physical RFID key…

That would count as the "aftermarket modification" I mentioned.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#297

Post by wrs » Tue, Apr 25, 2023, 11:11 PM UTC

captainmuon wrote: post #146

As the article mentions, this is for assisted GPS. I've worked quite a bit with this system on android and implemented (or rather fixed) it for a custom android device. I've also worked with separate Qualcomm modems in the past. They are basically a whole small Linux computer in a package. You supply voltage, antennas, and connect via serial or USB, and then you can send AT commands to control it. On the one hand it…

They make the source of these requests sound like some nefarious mystery, but in two minutes I found the code right there on master: https://cs.android.com/android/platform/superproject/+/maste... (and vicinity)

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#298

Post by [deleted] » Tue, Apr 25, 2023, 11:12 PM UTC

jandrese wrote: post #262

amelius wrote: post #163

Earlier quoted context omitted.

Yes but at some point combustion engine cars will probably be banned.

Not banned, but gas will become too expensive to operate them except in special circumstances. Once we start factoring in the cost to recapture the carbon emitted from combustion engines they will be instantly uneconomical.

[deleted]

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#299

Post by palata » Tue, Apr 25, 2023, 11:12 PM UTC

rcxdude wrote: post #192

dagmx wrote: post #3

This seems like a really shallow dive into what’s going on, and seems to exist largely to plug their own hardware? For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculatio…

Yeah, it manages to subvert its own message by transparently trying to be as scary as possible by being vague and jumping to its own conclusions, in what is clearly a sales pitch. It would be enough to say "hey, did you know that most phones send tracking data to the manufacturer when you download AGPS information? Our phone doesn't do that", instead of saying "oh, this phone makes a connection to a Qualcomm, server…

Agreed. I'm a bit disappointed by Nitrokey, because I would expect a security/privacy-oriented company to be experts. This all seems very shallow (even the explanation of what A-GPS is seems to show that they don't really understand it).

A company that sells trust should know better than posting ads disguised as an approximate technical blog.

Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm

#300

Post by tpmx » Tue, Apr 25, 2023, 11:34 PM UTC

rcxdude wrote: post #192

dagmx wrote: post #3

This seems like a really shallow dive into what’s going on, and seems to exist largely to plug their own hardware? For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculatio…

Yeah, it manages to subvert its own message by transparently trying to be as scary as possible by being vague and jumping to its own conclusions, in what is clearly a sales pitch. It would be enough to say "hey, did you know that most phones send tracking data to the manufacturer when you download AGPS information? Our phone doesn't do that", instead of saying "oh, this phone makes a connection to a Qualcomm, server…

> It would be enough to say "hey, did you know that most phones send tracking data to the manufacturer when you download AGPS information?

Someone credible: please write and submit such a blog post to HN so that we can have the discussion from that perspective instead. The current perspective is broken; discussion-wise.