DeepSec 2010: All your baseband are belong to us by Ralf Philipp Weinmann

What people said

Recommends andr · 2013-12 · Hacker News · on “The NSA Reportedly Has Total Access To The Apple iPhone”

I really see this working remotely, as long as you have control over a cell phone tower or you use a phony portable base station, both of which are within the NSA's reach. The thing is phone baseband software (which is reused on different phone models and controls the phone's I/O including GSM, USB, etc.) has hardly ever been under attack. When the iPhone arrived with its new security model, baseband bugs became one of the major ways to jailbreak a phone. Those bugs have been fixed one by one, but they were mostly on the USB side - the GSM side has been impractical to attack. A carefully crafted GSM packet could in 2008 and probably could now cause a buffer overflow in the baseband and gain

Recommends Cristian Dobre · 2015-08 · Information Security Stack Exchange · on “How safe are data you dial to a call center?”

Your sensitive information travels through different mediums and systems to get to the bank, and yes, there are vulnerabilities along this path. First, it is transmitted from your finger tips to your dialler application. It can be intercepted by malware running on your phone. There is a new vulnerability in Android called Stagefright [LINK] that can get full access to an Android phone. Before exiting the phone, the data is sent to a different part of the phone which does the actual communication called the baseband processor that runs a realtime OS. There were some vulnerabilities [LINK] in this OS, some of the most interesting were presented here [this video] . Then the audio tones (DTMF) are en

Recommends Graham Hill · 2016-03 · Information Security Stack Exchange · on “What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware?”

Firmware is typically lumped in with the hardware, and in most situations you are forced to trust the hardware (for lack of a better alternative). So you end up trusting the firmware. Not that this is a good thing - trust never is in InfoSec! But if you're trusting the hardware, you don't gain too much by not trusting the firmware. If you want to scare yourself on this subject, watch Ralf Weinmann talk about the baseband software that every phone has but no-one ever thinks about: [this video]

Cites ge0rg · 2013-12 · Hacker News · on “Telegram - secure, free messaging”

Only open-source apps on open-source operating systems [..] ...running on Open Source hardware. Many modern smartphones employ a baseband processor and an application processor with shared memory. While the app processor might be running an open-source compiled Android, the baseband processor is usually on a closed, not externally verified (and very buggy) RTOS provided by the manufacturer (Qualcomm, MediaTek, TI, ...)[0]. Owning the baseband is sufficient to gain access to the raw RAM of the application processor, to read any IM messages and keys, to manipulate data, code and whatever else you like. And all this is completely undetectable by any "antivirus" software running on the app proce

Cites brianmwaters_hn · 2014-03 · Hacker News · on “Samsung Galaxy Back-door”

Yes. Some further research I did since this thread started has shown that in some phones, even the microphone and camera are under the direct control of the baseband processor. In others, it's not. But in most phones, the CPU and BB share memory, which opens the door for the BB to do all sorts of nasty things to the OS on the CPU. [this video]

Cites Graham Hill · 2014-07 · Information Security Stack Exchange · on “Do cell-phones exist with open source baseband processors?”

No, doesn't seem to be anything. Understandable: there is almost zero consumer demand for such a product and it would be very expensive to develop (because of the expensive certification you need from Telecom regulatory authorities). By the way, you're probably worrying about the wrong thing. The main concern with baseband processors is not that the manufacturers have back doored them, but that the things are riddled with bugs and security vulnerabilites. See this presentation from the University of Luxemborg, for example. [this video]

Cites PeteChro · 2014-10 · Information Security Stack Exchange · on “Communication between SIM, baseband and application processor”

I currently examine the hidden components of a smartphone, inspired by the research of Weinmann All your baseband belong to us [this video] and Karsten Nohl Rooting Sim Cards [LINK] . According to Weinmann , the application processor (with Android e.g.) and the baseband processor can share memory, so that an attack and takeover of the baseband stack offers the possibility to attack Android. According to Nohl , it is possible to crack a SIM Card and install an own virus or application. This app could send premium SMS or something else. Thus, the SIM is connected to the baseband and the baseband is connected to the application processor. So which attack surface does this connection offer? The A3, A

Cites rgbrenner · 2014-12 · Hacker News · on “German researchers discover flaw that could let anyone listen to cell calls”

> Do you know in which part of the phones this is supposed to be in? The baseband chip.. it runs its own RTOS (separate from Android/ios/etc): [LINK] Rather than explaining, I think this link is a pretty good example: a chip from qualcomm that was sold at least through 2012: [LINK] It was demonstrated at BlackHat in 2011 on an iPhone 4 and HTC Dream (android): [LINK] [LINK] Edit: Slides from a talk at DeepSec: [LINK] Edit: video: [this video] edit: I think this is the paper: [LINK]

Cites user53693 · 2016-07 · Information Security Stack Exchange · on “Can an iPhone be hacked during a phone call?”

Well, whilst iOS and others are getting hardened, everyone is ignoring the GSM baseband processors. This second operating system was written years ago, and is proprietary to Qualcomm (and others) and is riddled with bugs and security vulnerabilities. As IMSI catchers are getting cheaper (e.g. Stingray), it is getting easier to execute malicious code on your device without you even knowing about it. See here: [LINK] [LINK] [LINK] and a good YT vid from DeepSec 2010 talk 'All your baseband are belong to us': [this video] The so-called secure phone 'Blackphone 2' is largely pointless.