Earlier quoted context omitted.
This is why Snowden removes the microphone from his phones.
Wait a minute: how does it function as a good ol' phone?
He attaches a USB microphone.
Smartphones with Qualcomm chip secretly send personal data to Qualcomm
311–320 of 346 posts
Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm
#312Earlier quoted context omitted.
Because we all dream of sub-$1 Linux processors that boot freely without blobs and have loads of wonderful usable documentation. I kind of want to modify that old adage to now read "cheap, open, documented. You can pick two."
If you picked cheap and documented, chances are it's documented primarily in Chinese also.
And it's already discontinued.
Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm
#313This seems like a really shallow dive into what’s going on, and seems to exist largely to plug their own hardware? For example, how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? They don’t actually do any packet data analysis to see what it includes as far as I can tell, so other than seeing some packets go through, the rest feels like idle speculatio…
> how is the chipset getting “List of the software on the device” unless the chipset is aware of the operating system? The chipset is aware of the operating system, or rather the other way around. Manufacturers use kernel modifications and user space libraries provided by Qualcomm for their chipsets.
Yeah I just mean they blame the chipset, but in reality it’s something in the OS stack.
Qualcomm drivers are blobs, and they’re basically the main game in town for android, so the drivers would be shared by even their own device.
They stopped short of investigating what was causing the pull of the A-GPS data. It could have been something in the distro they used, that the other distro didn’t.
It’s such a hand waivy piece overall
Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm
#314A quite overblown article from a company pitching their own "secure phone". They installed a custom OS which apparently includes Qualcomm's indoor positioning service iZat, but is missing the EULA item to allow the user to enable/disable the service. iZat exists for at least 6 years, and the vendors who implemented it usually have a separate checkbox in their startup wizard to allow it to work. Example screenshot aft…
Do you also trust the Intel Management Engine and AMD Secure Processor? Because I see no reason to. It's almost like all these companies were compelled to implement these features by a caring government. Maybe it's for the children
IME’s a poor analogy for what’s happening here. the article ends with
> Affected users could try blocking the Qualcomm XTRA Service using a DNS-over-TLS cloud-based block service, or re-route this traffic yourself to the proxy server from GrapheneOS […]
if these requests were being made below the OS, akin to IME, you wouldn’t be able to substitute the DNS like that.
unless they mean that you could reroute things upstream of the phone — but most users don’t deploy their own fleet of LTE towers, so i doubt that’s what they meant.
Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm
#315Earlier quoted context omitted.
Yeah, it manages to subvert its own message by transparently trying to be as scary as possible by being vague and jumping to its own conclusions, in what is clearly a sales pitch. It would be enough to say "hey, did you know that most phones send tracking data to the manufacturer when you download AGPS information? Our phone doesn't do that", instead of saying "oh, this phone makes a connection to a Qualcomm, server…
> It would be enough to say "hey, did you know that most phones send tracking data to the manufacturer when you download AGPS information? Someone credible: please write and submit such a blog post to HN so that we can have the discussion from that perspective instead. The current perspective is broken; discussion-wise.
That assumes there’s really anything to discuss here.
This is just A-GPS to work and has been like that for over a decade.
The Wikipedia page has about as much information as a blog post would https://en.wikipedia.org/wiki/Assisted_GNSS?wprov=sfti1
Or better yet, from the GrapheneOS devs themselves https://reddit.com/r/privacy/comments/12yii9u/_/jhojlr7/?con...
Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm
#316Earlier quoted context omitted.
> Apparently Apple is doing the same. Just curious, where did you find this?
I might be wrong; it was merely speculated in the article due to the fact that Qualcomm chips are used also in Apple smartphones. An audit would be needed.
The article authors continuously conflate the SoC with the OS distro.
it’s almost certainly part of the distro since they claim you can block it. If it was the chipset, you wouldn’t be able to.
Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm
#317Well, Qualcomm just fell off the map. I'll never knowingly use one of their products again.
Good luck though. Even the PinePhone has a Qualcomm, and it is probably one of the most promising devices for privacy. (that said, I'm not sure this particular service is used, especially if you use a custom firmware which provides an open source replacement to many of the original firmware components. GPS does not work very well until the userspace itself sends an xtra A-GPS file to the modem)
The pine phone is absolute trash, if you want the ultimate in privacy peep the ObeliskOne.
www.obeliskone.com
Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm
#318The initial HTTP request that they mention to Google is not related to Qualcomm at all but rather a part of the Google Play Services implementation in microG which /e/OS uses [1]. MicroG, as many might be aware, is an open-source implementation of Google Play Services that tries to avoid leaking sensitive user data amongst other things.
The request to android.clients.google.com though is required in order to checkin the device and receive a device ID and security token [2], which is needed for Firebase Cloud Messaging and push notifications [3]. The checkin include hardware details such as available features (GPS, WIFI, Microphone, EGL version) [4] but sensitive details such as HW MAC address, serial numbers and SIM operator ID are spoofed. [5, 6]
Basically if you're running deGoogled and still rely on Google Services, there _will_ be a few calls to Google owned servers. MicroG avoids sending sensitive HW and user data though, more can be read in this thread: https://github.com/microg/GmsCore/issues/1508
[1] https://doc.e.foundation/support-topics/micro-g [2] https://github.com/microg/GmsCore/blob/master/play-services-... [3] https://github.com/microg/GmsCore/blob/master/play-services-... [4] https://github.com/microg/GmsCore/blob/master/play-services-... [5] https://github.com/microg/GmsCore/blob/master/play-services-... [6] https://github.com/microg/GmsCore/blob/master/play-services-...
Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm
#319Earlier quoted context omitted.
why do you shoot the messenger? yeah they did a bit of advertisement to their phone, who cares. what matters is that now even freaking basic hardware pushes your data wherever they want without asking you. I really wonder if this had been a Chinese company the kind of comments we would have seen here.
Because the part about is being the hardware is false. This behaviour is entirely part of the OS. It's still bad, especially if the OSS ROM is not making users aware of it (though neither really are the manufacturers: burying this shit in a pages-long policy which the user cannot freely decline does not qualify for GDPR consent either). It's very easy to make android look bad from a privacy point of view, you don't n…
Worth to note that on a manufacturer implementation the consent is not buried in some pages-long policy. It's an explicit, separate item, which contains "sends your location data" and "may operate even when no apps are running" in the first paragraph.
Example: https://lgk20.com/wp-content/uploads/2021/09/57-60.jpg
Re: Smartphones with Qualcomm chip secretly send personal data to Qualcomm
#320Earlier quoted context omitted.
> That's why you install a firewall on your phone and disallow all outgoing traffic by default If it's being done by the firmware on the Qualcomm SOC then a firewall in Android is not going to save you.
The firmware on the SOC does not connect directly to the 'net, it interfaces with Android to do so. Android uses the Linux kernel and the Linux IP stack. That IP stack uses Netfilter [1] for filtering and packet mangling. The firewall uses iptables to define Netfilter rulesets which control which data gets sent where, which application is allowed to send data - this includes the kernel (and modules) itself. Block all…
> The firmware on the SOC does not connect directly to the 'net, it interfaces with Android to do so.
Do you have any documentation on this? Even firmware such as Intel ME or UEFI implementations connect directly to the Internet itself. So I have a hard time believing the firmware on a Qualcomm SOC does not directly connect to the Internet itself.