Hacker News

points by abdullahkhalids 2 days ago | 0 comments

In modern phones, doesn't the main chip control the baseband chip rather than the other way? What is the threat model?

Obviously since phone calls and text messages are unencrypted the baseband chip could send them elsewhere. But your internet communication should already be encrypted before it hits the baseband chip. So is the threat model Motorola has intentionally introduced a backdoor to leak data from the main chip to the baseband chip?

[–] jrexilius 2 days ago

"control" is mostly a gentlemans agreement. It sends commands. The OS running in the baseband can decide how to handle the commands. Assuming a malicious vendor, motivated by its host nation, that would be where they could place the most effective backdoors.

[–] inkyoto 2 days ago

Vendors with nefarious intentions or operating on directives from a state agency are a real and valid concern, but the handset under consideration makes use of a Qualcomm baseband chipset, so the OS it runs on is supplied by Qualcomm, not the manufacturer.

If I understand it correctly (but please do correct me if I am wrong), Qualcomm supplies the baseband OS as a signed binary blob.

[–] jrexilius 2 days ago

My knowledge is third-hand as I haven't worked at Motorola for over 20 years (and back then I worked on "server" side, not device side), but I think you are correct. What I'm unclear on is how it differs from the chips (and associated blobs) sold for use in China, where the legal requirements differ, and how reliable the "signing" really is. I do know that some groups get special permission from Qualcomm to load other firmware and expose certain features to the user-land OS. My threat analysis is mostly theoretical and I can't really say that Qualcomms control is lacking or co-opted.