Hardening cellular basebands in Android • Hacker News Board

Re: Hardening cellular basebands in Android

#71

Post by macNchz » Wed, Dec 13, 2023, 2:36 AM UTC

lstodd wrote: post #63

eightysixfour wrote: post #57

Earlier quoted context omitted.

I’m not sure we are talking about the same thing - just because you have cheap unlimited 4G doesn’t mean you get that 4G signal in a basement. VoWifi lets you still call someone with your phone number when the signal is bad but you have wifi access…

I was never into insisting to only talk on the phone from the basement of my medieval castle. The view from the battlements is much better. We're not all jamesbondesque supervillains here. Like I said above, for like $8/mo you have in fact unlimited 4G at decent speeds here. Or for idk maybe $15 you can get a gpon, unlimited traffic, 30+Mbit to the house, depending on local laziness of course. And that is for a rural…

I just got back from a week in Paris where I frequently had limited cell service indoors on a major provider. Even with antennas all over there’s just a lot of masonry for signals to get through.

I’ve been really happy on many occasions to have Wifi calling, both where I live in NYC (where service sometimes behaves similarly to Paris) and the rural places I visit frequently (where having the cellular modem off while at home saves tons of battery vs constantly having no service).

Re: Hardening cellular basebands in Android

#72

Post by kelnos » Wed, Dec 13, 2023, 2:42 AM UTC

lstodd wrote: post #63

eightysixfour wrote: post #57

Earlier quoted context omitted.

I’m not sure we are talking about the same thing - just because you have cheap unlimited 4G doesn’t mean you get that 4G signal in a basement. VoWifi lets you still call someone with your phone number when the signal is bad but you have wifi access…

I was never into insisting to only talk on the phone from the basement of my medieval castle. The view from the battlements is much better. We're not all jamesbondesque supervillains here. Like I said above, for like $8/mo you have in fact unlimited 4G at decent speeds here. Or for idk maybe $15 you can get a gpon, unlimited traffic, 30+Mbit to the house, depending on local laziness of course. And that is for a rural…

I do love how, seemingly to counteract the US-centric nature of many discussions, some Europeans act as though Europe is this one homogeneous block where everything works the same everywhere.

I guarantee you there are quite a few people in various countries in Europe where they don't have great cellular coverage, whether because of their location, or because of the building materials used in whatever house or office building they spend a lot of time in.

Regardless, I don't really get the hate toward VoWifi. Like... it's an added option. In some cases it might be redundant (or worse than the normal VoLTE option), but... it's an added option, that you don't have to use, that can be a great fallback in some cases.

Re: Hardening cellular basebands in Android

#73

Post by voxelghost » Wed, Dec 13, 2023, 2:42 AM UTC

uncertainrhymes wrote: post #37

acaloiar wrote: post #16

For those who don't eat and breathe this stuff, "basebands" are the processors that do all the cellular radio stuff on your smartphone. They're separate from device CPUs (referred to as the Application Processor), and are loaded with firmware. This post is about securing the firmware that runs on these little processors. When baseband firmware is compromised, it can lead to complete device compromise.

This particular comment became the first Google search result (or 'featured snippet') for me for "What is Android Baseband" -- weirdly claiming to be posted four hours ago when this comment was two hours old. That is mindblowing to me. Full credit to the poster for becoming the canonical answer, but I'm not sure how I feel about Google picking comments without even some kind of page-rank-weighted attempt at deciding…

For me, googles 'featured snippet' for 'What is Android Baseband' is extracted from the almost unreadable https://www.mi.com/global/support/faq/details/KA-11986/

I think the parent comment is almost more informative.

Re: Hardening cellular basebands in Android

#74

Post by jchw » Wed, Dec 13, 2023, 2:43 AM UTC

phh wrote: post #26

I'd rather say the issue is NOT that basebands need hardening (ok they do need it), but that we should stop putting things there. The article mentions parsing XML, doing DNS, IMS, TCP and IP stacks. As far as I know, all of those are down for one single purpose which is VoLTE (And VoWifi, and other related features which all go under the umbrella of "IMS"). On top of that, they also need to do IPSec (should be pretty…

Hey, that looks really cool. I've been wanting to mess around with this stuff on PinePhone, which is in a unique position here since there are third-party images for the baseband which are mostly open source[1].

I've been especially interested in trying to reverse engineer what's going on with Google Fi on Android, but it is definitely a bit over my head, given that until recently I didn't even really know what an AT command was :) I'm guessing since it's Google the carrier stuff is mostly for fallback and all of the actually interesting stuff is done using protobufs over a data connection. (Fi is also interesting because you can make phone calls on the web over WebRTC. I wonder if that's some kind of gateway to SIP, or what.)

[1]: https://github.com/the-modem-distro/pinephone_modem_sdk

(Note: I didn't dig deep enough, so it wouldn't surprise me if the blobs in this are actually where the interesting stuff happens, but it's still probably a great base for experimentation nonetheless.)

Re: Hardening cellular basebands in Android

#75

Post by rubatuga » Wed, Dec 13, 2023, 2:47 AM UTC

Or you could just use a USB cellular modem.

Re: Hardening cellular basebands in Android

#76

Post by SushiHippie » Wed, Dec 13, 2023, 3:00 AM UTC

uncertainrhymes wrote: post #37

acaloiar wrote: post #16

For those who don't eat and breathe this stuff, "basebands" are the processors that do all the cellular radio stuff on your smartphone. They're separate from device CPUs (referred to as the Application Processor), and are loaded with firmware. This post is about securing the firmware that runs on these little processors. When baseband firmware is compromised, it can lead to complete device compromise.

This particular comment became the first Google search result (or 'featured snippet') for me for "What is Android Baseband" -- weirdly claiming to be posted four hours ago when this comment was two hours old. That is mindblowing to me. Full credit to the poster for becoming the canonical answer, but I'm not sure how I feel about Google picking comments without even some kind of page-rank-weighted attempt at deciding…

FastGPT from Kagi answers to this question:

"Baseband is the firmware that controls the cellular radio functions of an Android device. It is responsible for things like connecting to mobile networks, making phone calls, and sending/receiving SMS messages. [1][2]

The baseband firmware resides on the same storage (eMMC) as the Android operating system but runs independently on a separate baseband processor. It communicates with the Android OS through shared memory and AT commands. [3][4]

Baseband versions are different from Android build numbers. The baseband version refers specifically to the firmware running the cellular radio hardware. [5]

Baseband firmware has been found to contain vulnerabilities that could allow remote command execution if exploited. However, Android devices from reputable manufacturers like Google/Pixel generally receive frequent baseband updates to address such issues. [6][7][8]"

[1] https://www.quora.com/What-do-baseband-version-and-kernel-ve...

[2] https://www.reddit.com/r/AndroidQuestions/comments/1wzmp7/wh...

[3] https://android.stackexchange.com/questions/219230/where-is-...

[4] https://stackoverflow.com/questions/24569075/how-mobile-os-t...

[5] https://forums.androidcentral.com/threads/difference-between...

[6] https://techcrunch.com/2019/11/08/android-baseband-flaws/

[7] https://www.reddit.com/r/GrapheneOS/comments/11op7yz/remote_...

[8] https://news.ycombinator.com/item?id=38616922

And the last link is this hackernews post!

Re: Hardening cellular basebands in Android

#77

Post by pomian » Wed, Dec 13, 2023, 3:24 AM UTC

phh wrote: post #26

I'd rather say the issue is NOT that basebands need hardening (ok they do need it), but that we should stop putting things there. The article mentions parsing XML, doing DNS, IMS, TCP and IP stacks. As far as I know, all of those are down for one single purpose which is VoLTE (And VoWifi, and other related features which all go under the umbrella of "IMS"). On top of that, they also need to do IPSec (should be pretty…

That looks great! I have a pixel 4xl that will not allow enabling VoWifi. (Maybe old sim card, maybe Graphene.) As you mentioned, great for other builds. PinePhone, etc. Going to try...

Re: Hardening cellular basebands in Android

#78

Post by wyldfire » Wed, Dec 13, 2023, 3:24 AM UTC

DiabloD3 wrote: post #47

abdullahkhalids wrote: post #40

Earlier quoted context omitted.

What's stopping two trillion dollar corporations who assemble/build their own phones and phone OSes from designing/manufacturing their own secure baseband chip and getting it certified?

Qualcomm owns patents on an international standard. They sued Apple and arguably won, although they settled out of court. Apple had bought Intel's LTE unit and the patents that came with it, and Qualcomm and Intel both licensed patents into a common pool (and as such, any member of that pool did not owe any other member royalties); Apple inherited Intel's position in the pool and continued licensing patents to the po…

> Apple stopped paying Qualcomm the LTE blood money.

"blood money"? Why so many tears for the most valuable business on Earth? When they picked Qualcomm for their 4G modem, the terms were clear. And then they decided to renegotiate the terms afterwards by telling their manufacturer to withhold the payments to Qualcomm.

> _Qualcomm still sued and made money_.

They negotiated a settlement, Qualcomm got less than they were owed and Apple paid less than the royalties due. Why did Apple settle? Because they had to make design decisions about their new phone - like which modem vendor to use. If you decide not to pay your supplier you could imagine they'd want to work that out before agreeing to give you samples of their new design. If Apple felt that they'd win the case on the merits and that the Qualcomm modem design didn't perform well, they would have just picked a competitor like Samsung. But they didn't do that. They even dual-sourced modems for iphone 7 in order to preserve their negotiating position. But that didn't work because the iphones with Intel modem performed worse than iphones with Qualcomm modems.

> If Apple can't secure a win against Qualcomm, how the hell can Google?

Google "did" secure a win, didn't they? They took their ball and went home. They decided to take the Samsung Exynos SoC and modem for their flagship phone.

> They're back to buying Qualcomm modems again.

... because they're better than the competition - including their acquisition? Is it your contention that Qualcomm somehow forced Apple to pick them over their own?

Re: Hardening cellular basebands in Android

#79

Post by csdvrx » Wed, Dec 13, 2023, 4:05 AM UTC

MadnessASAP wrote: post #70

csdvrx wrote: post #22

Earlier quoted context omitted.

it can't and it shouldn't IF IOMMUs were properly used

If I can put my paranoia cap on for a moment. The baseband processor having privileged access to the main processor may be a "feature" not a bug. It's a powerful processor, that is running constantly, has unlimited and continuous inscrutable communication with the network, is the gatekeeper for the main processors communication with the network, and it's firmware is practically required by regulations to be an opaque…

> The baseband processor having privileged access to the main processor may be a "feature" not a bug

yes but iff with the qualifier of "in old systems, where permissions were a tree-like state where root/uid0 could see what unpriviledged users would do - by design"

It's a dated design. More separation is needed, like what was achieved for virtualization or containers (namespaces)

> it's firmware is practically required by regulations to be an opaque blob

That's another problem, but I think it also comes from thinking in a tree-like state system.

Ideally, a device shouldn't be able to take down a well designed network: if you plug a bad appliance in your AC, it will not crash the power grub: it'll just trip a fuse.

Re: Hardening cellular basebands in Android

#80

Post by posguy » Wed, Dec 13, 2023, 4:45 AM UTC

jchw wrote: post #74

phh wrote: post #26

I'd rather say the issue is NOT that basebands need hardening (ok they do need it), but that we should stop putting things there. The article mentions parsing XML, doing DNS, IMS, TCP and IP stacks. As far as I know, all of those are down for one single purpose which is VoLTE (And VoWifi, and other related features which all go under the umbrella of "IMS"). On top of that, they also need to do IPSec (should be pretty…

Hey, that looks really cool. I've been wanting to mess around with this stuff on PinePhone, which is in a unique position here since there are third-party images for the baseband which are mostly open source[1]. I've been especially interested in trying to reverse engineer what's going on with Google Fi on Android, but it is definitely a bit over my head, given that until recently I didn't even really know what an AT…

The PinePhone uses a really old, slow modem (the Quectel EG25). Why not get a modern Snapdragon x62 like the RM520, drop it in a carrier board, root the modem and do all the shenanigans you want?

Useful links: https://github.com/natecarlson/quectel-rgmii-configuration-n...

https://github.com/carp4/qadbkey-unlock