undefined | Better HN

0 pointstptacek6y ago0 comments

Your "cellular phone" does not in fact have "full root memory access 24/7". In modern phone designs, the baseband is a USB peripheral. The notion that the closed, secret baseband is a DMA backdoor into AP memory is a message board meme, not engineering reality.

0 comments

hjkgfdfgh6y ago

That may be true of Apple, and is true of the PinePhone and Librem, but for the majority of Android devices, that's blatantly false.

On Qualcomm chipsets in particular heavily utilize shared memory for baseband to application processor communication.

tptacekOP6y ago

"The majority of Android devices" is a very wide net to cast.

hjkgfdfgh6y ago

Qualcomm alone covers 40%, and they're arguably the most likely to correctly implement their MMU (nevermind they've seen quite a few vulnerabilities in their MMU implementations over the years..)

Meditek uses a similar architecture, and I sure as hell don't trust their MMU.

Outside of Apple, Librem and Pine are just about the only way you're getting a USB attached baseband.

edit - Here's a Mediatek Baseband->AP PoC even: https://comsecuris.com/blog/posts/path_of_least_resistance/

3 more replies

j / k navigate · click thread line to collapse

0 pointstptacek6y ago0 comments

0 comments

hjkgfdfgh6y ago

That may be true of Apple, and is true of the PinePhone and Librem, but for the majority of Android devices, that's blatantly false.

On Qualcomm chipsets in particular heavily utilize shared memory for baseband to application processor communication.

tptacekOP6y ago

"The majority of Android devices" is a very wide net to cast.

hjkgfdfgh6y ago

Qualcomm alone covers 40%, and they're arguably the most likely to correctly implement their MMU (nevermind they've seen quite a few vulnerabilities in their MMU implementations over the years..)

Meditek uses a similar architecture, and I sure as hell don't trust their MMU.

Outside of Apple, Librem and Pine are just about the only way you're getting a USB attached baseband.

edit - Here's a Mediatek Baseband->AP PoC even: https://comsecuris.com/blog/posts/path_of_least_resistance/

3 more replies

j / k navigate · click thread line to collapse