8 ms·

The second operating system hiding in every mobile phone

1036 points by thomholwerda 13y ago

informatimago 13y ago
Waiting for the next Snowden. In the meantime, you can use your smartphone inside a Faraday cage. Wrapping it in aluminium should help.
- na85 13y ago
  Not sure what you're implying with this comment. Is it that people concerned about security of their phones are wearing Tin-Foil Hats?
  - bulatb 13y ago
    That if governments have privileged access to the hardware, it's not safe to use a phone until a whistleblower tells us what exactly they can do.
    - krapp 13y ago
      It's not necessarily safe to trust the whistleblowers either you know. They can lie, or be lied to, and even they can't know everything. The only really safe assumption to work from is that all Turing-capable devices are evil.
- jlgreco 13y ago
  > you can use your smartphone inside a Faraday cage. Or, more accurately stated, "you can't".
  - informatimago 13y ago
    You can't phone, but you can use the smart, the computer inside the smartphone :-)
- noigretics 13y ago
  The FBI has been tapping mobile phones as "roving bugs" for a decade: http://news.cnet.com/2100-1029-6140191.html http://news.cnet.com/2100-1029-6140191.html
  - diydsp 13y ago
    Heck, I'm sure it's been longer than a decade. Previous generations of mobile phones used FM unencrypted. You could eavesdrop on them with just a television that has a UHF dial on channels 70 to 83! (Audio carrier 811-889 MHz)
- astrodust 13y ago
  You can't use it inside any sort of Faraday cage, that's pointless. It's to prevent people from accessing it while it's inside one. Pro tip: Refrigerator doesn't work, but cocktail shaker apparently does. (http://makezine.com/2013/06/26/edward-snowden-can-a-refrigerator-function-as-a-faraday-cage/ http://makezine.com/2013/06/26/edward-snowden-can-a-refriger...)
  - jlgreco 13y ago
    I thought that the refrigerator was more about soundproofing (that way it wouldn't matter if it was listening or not.) Maybe if you are really in that sort of situation you should just do both, just in case.
    - Amadou 13y ago
      I thought that the refrigerator was more about soundproofing (that way it wouldn't matter if it was listening or not.) I think it depends on the model. I tested a couple of phones, including a blackberry, inside my fridge a few years before Snowden did his thing. We put them in and then tried to call them and none of them rang. But the fridge was one of those trendy stainless steel models. Perhaps a more ordinary fridge would have less effect on signal strength.
      - fnordfnordfnord 13y ago
        I've only seen fridges that are made with steel or aluminum. They would still leak RF around the door gaskets, but probably such a small amount that you'd have to be very close to a base station to be vulnerable, and it'd still be mostly soundproof.
- saraid216 13y ago
  > Waiting for the next Snowden. The pinnacle of democracy: waiting for someone else to do it.
  - mindslight 13y ago
    Naw, the pinnacle of democracy is the entitled whining after the longstanding obvious truth has been laid bare. Who needs objective forethought?
- Zoomla 13y ago
  You can keep it in a Faraday cage whenever you don't need to use it or aren't expecting a call... since it should block all radio signals.
_stephan 13y ago
"Lastly, the baseband processor is usually the master processor, whereas the application processor (which runs the mobile operating system) is the slave." Can maybe somebody explain what this means exactly? Could the baseband processor/OS be used as an attack vector to exploit the main mobile OS? Could the OS protect itself from this?
- andyzweb 13y ago
  The baseband processor may have unrestricted access to the entire address space of the device or to address space which the application processor (and the operating system it's running) implicitly trusts.
  - deleted 13y ago
    [deleted]
  - _ak 13y ago
    AFAIK, access to the baseband and vice versa is through a network inside the phone. Physically, these two computers are separated, and communicate only through a well-defined network interface. No poking in other computer's memory.
- A1kmm 13y ago
  Most modern phones don't really have a physically separate baseband processor and application processor, they run a real-time microvisor (usually an L4 based system, and frequently OKL4 - see http://wiki.ok-labs.com/#OKL4Microvisor4.0 http://wiki.ok-labs.com/#OKL4Microvisor4.0). The microvisor runs multiple virtual 'cells' (which are ARM operating systems that think they are running as supervisor), and ensures that the hard realtime requirements of the radio driver are met even if the kernel in the application cell is stuck in a loop. Because the application processor is actually running in a virtual cell and not on bare metal, it doesn't have full access to the hardware and can't interfere with the radio cell - but the radio cell might still have access to everything.
InTheSwiss 13y ago
I am assuming that the RTOS has direct and full unrestricted access to the hardware such as the camera and microphone? If so then I would also assume that an over the air attack to silently suck data from the camera and microphone would be pretty easy for those with access to the RTOS (such as governments)? I know there has been software to do just this in the past on some Nokia devices but I would assume (I am doing that a lot in this post!) it is just as possible in pretty much every mobile phone? Anyone with knowledge of this care to comment on my assumptions?
- _stephan 13y ago
  Why would the baseband processor need access to anything but the RF and maybe the GPS hardware?
  - sliverstorm 13y ago
    It wouldn't. Though you could build it that way, I guess, if you felt so compelled. http://en.wikipedia.org/wiki/Baseband_processor http://en.wikipedia.org/wiki/Baseband_processor
  - rst 13y ago
    For one thing, putting the voice signal processing in the baseband means that it's not vulnerable to timing glitches from "noisy neighbor" apps running on the application processor. For another, as a practical matter, a lot of the baseband software started out as the entire software stack for the single processor in a dumb-phone/feature-phone, which necessarily included the voice processing. Simply leaving it there avoids the technical effort of doing a port.
  - Zigurd 13y ago
    Quite often the baseband has the only direct access to the handset mic and speaker, including things like the agc and speakerphone. That's why a room bug can be implemented this way. The article hints at a way to democratize access to this capability by using the RIL commands to turn on auto-answer and turn off any indication it's happening.
buo 13y ago
For an example of an open-source GSM implementation that would allow one to build a base station, see http://en.wikipedia.org/wiki/OpenBTS http://en.wikipedia.org/wiki/OpenBTS . There are lots of videos about it on youtube where you can see it in action.
devx 13y ago
No wonder not only NSA, but also FBI and probably other agencies exploit these like crazy by using fake towers or other methods.
- Guvante 13y ago
  Who says they need fake towers? I would bet that they can get direct access with the right court order.
  - cdash 13y ago
    Why bother?
  - devx 13y ago
    http://www.tomsguide.com/us/FBI-wiretap-stingray-cell-phone-towers,news-13124.html http://www.tomsguide.com/us/FBI-wiretap-stingray-cell-phone-...
jared314 13y ago
There is also a second OS hiding in your computer right now! (There might even be a third, or forth, depending on your hardware configuration and manufacturer.) Proprietary BIOS software has suffered the same issues for the last twenty+ years.
- foobarian 13y ago
  Good thing all these embedded computers in my computer don't have antennas attached with buggy baseband that blindly decodes and trusts messages coming thereon. :-)
  - rst 13y ago
    Right, it's not like wifi adapters have independent processors of their own with closed-source, potentially buggy firmware that does DMA into main processor memory. :-) It's also worth thinking about netboot (which comes in several flavors), in which the main processor's potentially buggy BIOS may be independently decoding and processing packets coming over physical wires.
    - yuhong 13y ago
      And on USB, don't forget SMM code emulating PS/2 input devices by parsing USB HID packets. I think part of the reason why real mode exploits was never very common was that the address DOS allocated memory depended on for example what TSRs you were running.
      - rst 13y ago
        Remember that story a few months ago about how some government agency had replaced all its keyboards and mice in response to a malware infestation? A lot of folks (including some here) took this as Yet Another Show of Government Cluelessness. I found myself wondering instead if there was a world in which folks advised by government security experts (i.e., you-know-who) would have a good reason to do something like this and not say why. There is. It's a world in which their opponents had a zero-day against the Windows USB driver, and a way into the government's supply chain. And in which you-know-who wants to play the same game themselves against opponents elsewhere.
Jagat 13y ago
Even BIOS can be considered as a second OS hiding in your PC.
sehugg 13y ago
While we can sort-of assume that the base stations in cell towers operated by large carriers are "safe" Um.
noyesno 13y ago
The link to the ETSI 3GPP specs is a bit silly: it shows not only all the related specs but also all the versions of those docs.
ricw 13y ago
This is all a bit over the top. Yes, the baseband may be compromisable, that doesn't mean that the operating system is. Your photos, data etc should be safe as long as there aren't further exploits (which of course exist). Furthermore, i have yet to hear of a slave high level operating system to the baseband. iOS or android being initialised and commanded by a secondary baseband OS would just be a bizarre setup. That of course does not mean that the baseband doesn't pass commands to the high level OS. Though if the interface is well shielded, exploiting it could be tough (correct me if I'm wrong, but I don't think baseband exploits exist for iPhone 5/5s). Now, I'm sure the NSA however have some interesting possibilities that Angela Merkel would be all to keen to know about ;).
- kelnos 13y ago
  This is all a bit over the top. Yes, the baseband may be compromisable, that doesn't mean that the operating system is. Incorrect. In most cases the baseband processor has complete, unfettered access the application processor, which means it has complete, unfettered access to the OS.
  - rsync 13y ago
    .. and by unfettered, we mean it has DMA access to the application processor. It's not a hook or an API call or some functions it can call - it has low level bit for bit access to manipulate the CPU that your OS (like android) runs on. Further, your carrier (verizon, att, whatever) can push OTA updates and commands straight to baseband via the radio, bypassing the CPU and OS (like android) and manipulating the phone on a low level bit by bit basis. Even the most well secured, rooted, reloaded phone has every piece of it totally owned by the carrier, via the baseband processor. Yes, that includes your photos.
    - ricw 13y ago
      DMA has security modes, implemented by pretty much every standard baseband chip in use today (Qualcomm, Infineon, you name it). In the oldern days baseband exploits were used to crack iPhones. As far as I'm aware of, this hasn't happened in the last two generations of iPhones. So no, you do not have unfettered access to all the data, only the "baseband" segment, unless you manage to hack your security setting for the baseband. For which you first have to hack the Primary OS. I hope you get the theme..
Procrastes 13y ago
"That complexity is exactly one of the reasons why it's not easy to write your own baseband implementation. The list of standards that describe just GSM is unimaginably long - and that's only GSM. Now you need to add UMTS, HSDPA, and so on, and so forth. And, of course, everything is covered by a ridiculously complex set of patents. To top it all off, communication authorities require baseband software to be certified." This is HN. I don't think implementing a replacement is all that daunting given enough time and money. I wonder if there's a business model that will pay for it?
- JoshTriplett 13y ago
  People are already working on Open Source implementations, both on the phone side and on the tower side. See http://osmocom.org/ http://osmocom.org/ .
- Zigurd 13y ago
  A 2G baseband implementation is probably not too hard. Making 3G and all the mobile data protocol variants and LTE inter-operate reliably is probably harder. The irony is that LTE invites a look at a minimal "layer 2 only" baseband and doing everything else in the higher-level OS, but, instead, baseband code just gets hairier.
- toyg 13y ago
  It's not a technological problem as much as a political one. Baseband processors implement umpteen standards (politics) and have to be certified by communication authorities (_big_ politics). And what is the point of building a more secure implementation, if all these tools must (by law and by standard) have backdoors for local authorities anyway?
- gonzo 13y ago
  I got a chance to look inside Fabrice Bellard's LTE eNodeb code. http://www.bellard.org/lte/ http://www.bellard.org/lte/ It runs on an i7.
  - nly 13y ago
    FFS, does that guy ever sleep?
britta 13y ago
Baseband hacking is how people made software-based carrier unlocks for iPhone 2G, 3G, 3GS, and 4 (GSM). Those exploits are somewhat documented here: http://theiphonewiki.com/wiki/Baseband_Device#Exploits http://theiphonewiki.com/wiki/Baseband_Device#Exploits
- mmastrac 13y ago
  This is also how we did it for some of the unrEVOked roots for HTC devices back in the day as well (mainly the "forever" tool).
maxk42 13y ago
> By design Of course -- all the telecoms have been in bed with the NSA for decades. That's how you play ball in the US.
headgasket 13y ago
... The voice came from an oblong metal plaque like a dulled mirror ... The instrument (the telescreen, it was called) could be dimmed, but there was no way of shutting it off completely. (1.1.3) Oceanians live in a constant state of being monitored by the Party, through the use of advanced, invasive technology. It was terribly dangerous to let your thoughts wander when you were in any public place or within range of a telescreen. The smallest thing could give you away. A nervous tic, an unconscious look of anxiety, a habit of muttering to yourself – anything that carried with it the suggestion of abnormality, of having something to hide. In any case, to wear an improper expression on your face (to look incredulous when a victory was announced, for example) was itself a punishable offense. There was even a word for it in Newspeak: facecrime, it was called. (1.5.65) Is the the google input box a door to the world or a window into your mind? How many fingers do you see?
- bigiain 13y ago
  But we've _always_ been at war with Eastasia…
  - JetSpiegel 13y ago
    Eurasia has been bombing us since we were little boys!
dola 13y ago
And then there is also the one on the SIM doing all the encryption and authentication stuff...
general_failure 13y ago
I was expecting this OS to be the browser. The browser really is another OS these days especially with all the new HTML5 specs (firefox OS being the proponent of such things). The way HTML5 is progressing it might even beat the API of the OS it seems! For example, the OS itself might have no contacts API but the browser has HTML5 API to access them!
- dokem 13y ago
  I don't think you understand what an operating system is.
  - reubenmorais 13y ago
    While the reasons stated by the gp might not be the best ones to justify his assertion, browsers are an environment for running arbitrary untrusted code, and have a lot of similarities with operating systems (like job control, memory management, hardware access, etc).
est 13y ago
Cant wait Tegra 4i hacking allows unrestricted i500 SDR platform access :D
- rsync 13y ago
  Would you please elaborate ?
- wmf 13y ago
  Aren't all modern basebands SDR?
mindslight 13y ago
I think we'd all be better off and get to a user-centric mobile experience a lot sooner by isolating the network communication in a dedicated device. I'm toying with the idea that next time I have to upgrade my mobile (hopefully not soon), a better way to go is something like mifi + netbook + smart watch (+ maybe some compact chorded keyboard).
- rsync 13y ago
  Exactly. If you want a mobile phone that you control, you need to buy something like a samsung galaxy player (contains no baseband processor, contains no mobile phone infrastructure) and then attach a USB modem to it (or carry a MIFI or whatever). There's one problem, however, and that is all of the fancy noise cancellation and voice smoothing are actually done on the baseband proc, and userland implementations of this for VOIP apps are typically pretty crummy. Me, I am sticking with my MOTO FONE / F3 for now.
  - alexwright 13y ago
    I'd be (pleasantly) surprised if devices like the Galaxy Player didn't still have binary blobs for the Wifi/BT and video hardware. Even NICs for otherwise fairly open PC/ATX machines all still have the proprietary blob firmware drivers.
- tmzt 13y ago
  The Mifi is the same thing as the baseband in your cell phone, and can even do SMS. Many of them are running Linux on the AP side now to support more advanced Wifi routing features. If you were really paranoid, you might consider the possibility that it has a microphone or a speaker that can be treated like a microphone. (Though I don't know of any that actually have a beeping, vibrator or piezo output.) Also, they may have some form of e911-compliant GPS receiver, though whether the RF is hooked up for it I wouldn't know.
  - mindslight 13y ago
    Well even a completely trustable cell radio is tracked with tower triangulation. The only way I see to fix this is to completely rearchitect the mobile network by getting rid of subscriber IDs, using anonymous payments for tower access, and then a mix network for transit privacy. That is to say, location data is a wash for the foreseeable future.. Surreptitious microphones and other sensors are indeed still a problem, but they seem easy to audit/remove in the short term, and if this model catches on and they become a real threat, the physical audits just have to go deeper. What you do gain is a processor that can be trusted by the user (in the same way we all trust Intel CPUs), with the Mifi only seeing encrypted communications. Also we've moved the demarc point solidly between two separate physical devices - upgrade your pocket computer without involving your cell provider, and replace your communications ability without affecting your user environment.
mey 13y ago
There is actually a 3rd inside the SIM as well http://en.wikipedia.org/wiki/Subscriber_identity_module#Design http://en.wikipedia.org/wiki/Subscriber_identity_module#Desi... This is what Java Card was developed to run on. If you are interested in getting lower level access to your radio, you could look at the defunct http://openmoko.com/freerunner.html http://openmoko.com/freerunner.html project or the resurrection of the Freeruner, http://www.openphoenux.org/ http://www.openphoenux.org/
- airencracken 13y ago
  Or the neo900 http://neo900.org/ http://neo900.org/
  - rsync 13y ago
    AFAICT, the neo900 has a plain old closed baseband processor. So you can "root" it and control the OS all you want, your carrier still owns you and your phone, what with (potentially) DMA level access to your CPU. neo900 is interesting, but it is not any more open in this regard than any other handset.
    - airencracken 13y ago
      Ah, my mistake!
- ketralnis 13y ago
  There was a great Defcon talk about this called The Secret Life of SIM Cards that I can recommend watching (they release the video for these some time after the conference). The talk itself was about a group that had an enormous camping trip (I hope that phrasing doesn't diminunise it) called Toorcamp of a few thousand people that thought it would be fun to also put together their own cell network for just them. They bought and programmed SIM cards and hid puzzles in the programs on them. But the amount of programming that can be done on the SIM card alone without involving the main processor at all was really quite fascinating and there's a lot of detail in the talk if you can track it down. Here are the slides at least https://speakerdeck.com/codebutler/the-secret-life-of-sim-cards https://speakerdeck.com/codebutler/the-secret-life-of-sim-ca...
pslam 13y ago
The second operating system hiding in every mobile phone? Really? There's a ridiculous number of operating systems hiding in every mobile phone. What do you think runs on the GPU? What about bluetooth, wifi and GPS? What about all those sensors? The camera interface? The video acceleration? The SIM card? The NAND flash? Try harder.
- slashclee 13y ago
  The GPU, bluetooth, wifi, and GPS chips are not running their own operating system kernels. They have firmware microcode that gets loaded when their drivers are loaded, but they aren't running a completely separate dedicated realtime OS.
  - rsync 13y ago
    The SIM card, however, is indeed running it's own little OS.
  - pslam 13y ago
    What do you think is in that "microcode"? Most of what I mentioned is usually running on an ARM of some sort. I count that code as an OS, because it's a pretty narrow definition otherwise.
    - slashclee 13y ago
      Default register initialization values and functions to encode/decode and transmit/receive packets of data do not equal an operating system in my book. Maybe you draw the line at a different level of the stack than I do. I'm totally willing to be admit that I might be wrong about this, but I wasn't under the impression that Broadcom and Atheros and Intel were using ARM CPUs in their wifi/bluetooth/GPS chipsets.
      - pslam 13y ago
        The missing piece here is that WiFi/Bluetooth/GPS chipsets ARE usually using ARM CPUs internally. GPUs generally run a funky DSP-like core but there's still some kind of OS scheduling tasks and running code to interact with the main CPUs. The cost of laying down a fully-fledged CPU has reduced to the point where it's simpler and less risky to use an off-the-shelf ARM core (or similar), instead of a big bunch of hard logic combined with coefficient. And most of those CPUs have some sort of runtime, which is an OS, depending on where you draw the line on that.
jjoe 13y ago
It shouldn't come as a surprise that you're not "offline" unless you take the battery out of your phone and wait a good minute or so. And there's no wireless power source "force feeding" your phone... This is well known to anyone who's done DSP optimization work for any of the wireless carriers.
- im3w1l 13y ago
  Wait, are you saying it is possible to force feed a phone in theory, or in practice right now?
melvinmt 13y ago
> This is such low-level, complex software that I would guess very few people in the world actually understand everything that's going on here. I would not be surprised if the NSA would employ quite a few of them.
chris_mahan 13y ago
After reading all the comments, I'm beginning to think the Butlerian Jihad may not be such a bad thing after all...
- igravious 13y ago
  I had to Google this. Here's a Wiki P link: https://en.wikipedia.org/wiki/Butlerian_Jihad https://en.wikipedia.org/wiki/Butlerian_Jihad It's from Frank Herbert's Dune :( Sad because I read this series (all six, I kid you not!! 1,2,6 are good 3,4,5 not so good) 25 years ago nearly and I had forgotten this specific detail. Time is indeed a cruel mistress and thanks for making me feel old :)
  - chris_mahan 13y ago
    Perhaps I remember thisparticular detail because I've read the six books six times... And, hum, I feel old right along with you...
meson2k 13y ago
MSM6280 is 7 years old. The author has no clue how advanced these RTOS have become now and the kind of effort that goes into security at a system level e.g. xpu, smmu etc.
spc476 13y ago
Quite possibly a third or fourth OS as well ... http://boston.conman.org/2013/01/22.2 http://boston.conman.org/2013/01/22.2
dreamfactory 13y ago
So maybe a relevant question as we move away from desktop computing is whether your mobile device can be identified through online activity, such as commenting, searching, email etc. This would be useful for locating dissidents.
deleted 13y ago
[deleted]
niels_olson 13y ago
For all the "NSA's probably in on this", remember this also leaves openings for China, Russia, and possibly others to get in on this.
- alandarev 13y ago
  Making it moreove fair.
rcfox 13y ago
Coming from a background of developing audio hardware drivers for the Blackberry (I worked on the last generation and current generation before getting bored and leaving a year ago), I can tell you that even if the baseband were able to turn on auto-answering, (I have no idea if that's possible, by the way) it wouldn't know how to configure the microphone and speakers to allow for recording or playback unless it convinced the application processor to help. If you are concerned about your Blackberry spying on you, there's a special "security plug" that you can insert into the headphone jack which will short all of the pins to ground, disabling the microphone. I assume other phones support this as well.
- doubt_me 13y ago
  Have never heard of a security plug before. where can I get one?
  - antsar 13y ago
    I don't know where, but it sounds fairly simple to make: cut the connector off from an old headset, and solder all of the wires in it together. One of the wires (the uninsulated one) in there is ground, the other three are signal.
    - rcfox 13y ago
      Yeah, I'm not sure either. I don't see it in the official accessories store. antsar's correct though. It's simple to make one yourself. The nice thing about the security plug is that it's small; it doesn't look like your headphones' cable snapped off. :)
      - corin_ 13y ago
        If you don't trust the manufacturer who put the code into your handset, how can you trust that the security plug will always work (other than checking the internal wiring yourself)?
        13y ago
hngiszmo 13y ago
I would donate for somebody setting up a server that streams audio (and video, …) from all phones in reach. With bitcoin this could even be pulled off anonymously. I would hope for such a server streaming data from financial districts, one at a time would finally lead to something to change about this. Donations would help buy antennas and rent space in financial districts.
deleted 13y ago
[deleted]
ChuckMcM 13y ago
One of the side effects of software eating the world is that the world becomes more exploitable. I expect that over time we may see the emergence of general 'software building codes' much like there are physical building codes, and more importantly liability associated with failing to provably meet such codes. The current 'random person implements firmware that controls the this chip' practice and the 'no warranty etc etc' disclaimers will, I predict, be replaced by manufacturers who are willing to warrant their code.
- fjk 13y ago
  Extending that metaphor, a profession could evolve around zoning for permissible uses of code based on types of software and intended audience, much like urban planners do with zoning codes and city master plans.
  - eurleif 13y ago
    I can't tell if you're pointing out the problems with regulating software, or seriously suggesting this idea. That's scary.
- im3w1l 13y ago
  I think it is a consequence of the fast improvements in functionality made. People would rather be on a feature rich beta branch, than a safe stable branch. I also expect this to change as the industry matures.
  - csmuk 13y ago
    Actually I find its broken down into two camps: Consumers want the latest. Companies want the most stable. After some particularly huge disasters I've had to deal with coming onto new projects and with general consumer electronics, I'd go for the latter every time both as a consumer and company these days. Time is valuable and losing it to a feature packed unreliable mess is a big risk to that time.
    - blowski 13y ago
Maven911 13y ago
St microelectronics is a firm who provides radio chipsets for apparently 80% of all phones out there
memracom 13y ago
Does anyone know if the Firefox OS replaces these proprietary RTOSes?
- ollybee 13y ago
  No it does not, nor does replicant or any other alternate phone OS.
itazula 13y ago
What about TRON? http://www.t-engine.org/ http://www.t-engine.org/
coldskull 13y ago
as someone who closely works on qualcomm baseband processors, i can say that security is one of the top priorities of qualcomm. There are whole bunches of teams dedicated to sec/vuln analysis. Not saying that the issues mentioned in the article did not occur...but I believe that those probably occured in older chips (a few generations older) standard disclaimer Views above are personal and do not reflect views of Qualcomm
hiley 13y ago
Who makes the baseband software? Those who make it I guess are more inclined to fix the bugs (because there are paying customers), at least in areas that they can fix...
fayyazkl 13y ago
Often the RTOS is not exactly free, but not entirely closed either. A while back, i used to work on Nucleus RTOS by Mentor Graphics with a pretty impressive global foot print http://en.wikipedia.org/wiki/Nucleus_RTOS http://en.wikipedia.org/wiki/Nucleus_RTOS. It used to be sold as an api (with source code given to customers) who developed applications based upon it. I have written portions (IPsec/IKE, SNMP, Ipv6) of its networking stack and at least all of its customers have access to source code. It is pretty well written with very decent coding conventions and can be compared to any good well known open source project (VLC, even Linux kernel). Then there are others such as Wind River's VxWorks among the more popular ones. Though i am not very sure of its licensing model, but it is pretty well recognized and established in the embedded world. Just that these are not as well known in the over all software community but rather more restricted towards those in the embedded industry.
- girvo 13y ago
  I always wanted to play with Nucleos! What's it like? I'm a fan of QNX personally though I only got to play with it a tiny bit. Some awesome ideas in it.
  - fayyazkl 13y ago
    Nucleus pretty much comprises of a very small foot print. With Architecture specific assembly isolated from like 95% of the code neatly. Rest is Ansi C. It contains tasks which are sort of equivalent of kernel level threads in POSIX but implementation logic is quite different i.e. RTOS constraints are handled by classifying interrupts at two levels. In terms of constraints, there is no dynamic loading i.e. you have to build a single binary. But at the same time it was pretty fascinating with os, networking stack, drivers all contained in a separate folder building up one project. Lately they have added power management, Android like UI and even some hyper-visor support. Most importantly, it is small and consistent enough for a programmer willing to learn through the entire stack. Helps with much better visualization from hardware to application. A couple of former colleagues (one of which incidentally now works with QNX and hence compared both) highlights both i.e. strengths vs weaknesses of each. But it didn't feel like one was superior to another. However, Nucleus severely lacks any certifications (and ability) to get into HARD real time industry such as aviation.
diminish 13y ago
Ohh every phone of mine crashes in a 20 min subway travel since 10 years no matter Android, Symbian.. It must be this RTOS.
wfunction 13y ago
The NSA has probably already figured this out.
ivanhoe 13y ago
It's one of those rare cases (like BIOS too) where obscurity actually means more security...
- annnnd 13y ago
  The problem is that ONLY obscurity shields users from exploits - and it's not much of a shield (it never is). So yes, it is "more" security. And no, it doesn't help much. Arguably it makes matters worse because the code can't be checked by independent security researchers (whitebox testing).
  - ivanhoe 13y ago
    I agree, I was just ironic...
agumonkey 13y ago
Nowadays processors are so tiny and cheap, they're everywhere. # batteries IIRC most battery charging circuits also have a dedicated real time ~OS running. http://www.youtube.com/watch?v=dlSBQ5b6Pdw‎ http://www.youtube.com/watch?v=dlSBQ5b6Pdw‎ # hard drives Also recently someone did run linux in its hard drive controller (which is a set of arm cores, ~v9 and m3) HaD intro : http://hackaday.com/2013/08/02/sprite_tm-ohm2013-talk-hacking-hard-drive-controller-chips/ http://hackaday.com/2013/08/02/sprite_tm-ohm2013-talk-hackin... Direct link : http://spritesmods.com/?art=hddhack http://spritesmods.com/?art=hddhack
atlantic 13y ago
I wonder if there is any relation between this set of vulnerabilities and the Datong system used by the UK authorities to mimic/replace mobile phone base stations. http://www.wired.com/threatlevel/2011/10/datong-surveillance/ http://www.wired.com/threatlevel/2011/10/datong-surveillance...
_ak 13y ago
I talked to a friend of mine who is an engineer at Qualcomm, and he said the article is exaggerated and out-dated. Current basebands don't use REX OS anymore, and they put mitigation mechanisms in place, so this piece seems like FUD.
- pjc50 13y ago
  I happened to be reverse engineering some firmware the other day, which has "AMSS" all over it; this was in new Sierra Wireless devices built on Qualcomm ARM926EJS baseband. It might not be in the latest and greatest, but it's still out there all over the place.
- dons 13y ago
  I thought a lot of this stuff was already running on OKL4. E.g. https://code.google.com/p/docl4amss/wiki/OkL4 https://code.google.com/p/docl4amss/wiki/OkL4
lgeek 13y ago
And then there's also TrustZone[0] so don't be surprised if there's an additional hypervisor or RTOS running on the main application processor. [0] http://www.arm.com/products/processors/technologies/trustzone/index.php http://www.arm.com/products/processors/technologies/trustzon...
gwu78 13y ago
Maybe the future is in making calls over the Internet, not a private cellular network? Or maybe the future is in open source software defined radio? I never tried it, but I heard OpenMoko could run BSD. In any event, I hope the future is one where I can read, modify and compile the source for my handheld's bootloader and operating system, as I currently can do with my laptop's bootloader and operating system.
noselasd 13y ago
Though about GSM, if you want to learn more: * http://osmocom.org http://osmocom.org * http://www.youtube.com/watch?v=xOp_wtsHAe8 http://www.youtube.com/watch?v=xOp_wtsHAe8 * http://www.youtube.com/watch?v=_0LCgxe24Po http://www.youtube.com/watch?v=_0LCgxe24Po * http://www.youtube.com/watch?v=9cBJV3yTaQo http://www.youtube.com/watch?v=9cBJV3yTaQo * http://www.youtube.com/watch?v=9cBJV3yTaQo http://www.youtube.com/watch?v=9cBJV3yTaQo Your phone has GSM, even if you're only on 3G or 4G networks though (unless it's a pure CDMA phone) - and the concepts are anyway quite similar in 3G/4G networks an phones.

1036 points by thomholwerda 13y ago

Waiting for the next Snowden. In the meantime, you can use your smartphone inside a Faraday cage. Wrapping it in aluminium should help.

na85 13y ago
Not sure what you're implying with this comment. Is it that people concerned about security of their phones are wearing Tin-Foil Hats?
- bulatb 13y ago
  That if governments have privileged access to the hardware, it's not safe to use a phone until a whistleblower tells us what exactly they can do.
  - krapp 13y ago
    It's not necessarily safe to trust the whistleblowers either you know. They can lie, or be lied to, and even they can't know everything. The only really safe assumption to work from is that all Turing-capable devices are evil.
jlgreco 13y ago
> you can use your smartphone inside a Faraday cage. Or, more accurately stated, "you can't".
- informatimago 13y ago
  You can't phone, but you can use the smart, the computer inside the smartphone :-)
noigretics 13y ago
The FBI has been tapping mobile phones as "roving bugs" for a decade: http://news.cnet.com/2100-1029-6140191.html http://news.cnet.com/2100-1029-6140191.html
- diydsp 13y ago
  Heck, I'm sure it's been longer than a decade. Previous generations of mobile phones used FM unencrypted. You could eavesdrop on them with just a television that has a UHF dial on channels 70 to 83! (Audio carrier 811-889 MHz)
astrodust 13y ago
You can't use it inside any sort of Faraday cage, that's pointless. It's to prevent people from accessing it while it's inside one. Pro tip: Refrigerator doesn't work, but cocktail shaker apparently does. (http://makezine.com/2013/06/26/edward-snowden-can-a-refrigerator-function-as-a-faraday-cage/ http://makezine.com/2013/06/26/edward-snowden-can-a-refriger...)
- jlgreco 13y ago
  I thought that the refrigerator was more about soundproofing (that way it wouldn't matter if it was listening or not.) Maybe if you are really in that sort of situation you should just do both, just in case.
  - Amadou 13y ago
    I thought that the refrigerator was more about soundproofing (that way it wouldn't matter if it was listening or not.) I think it depends on the model. I tested a couple of phones, including a blackberry, inside my fridge a few years before Snowden did his thing. We put them in and then tried to call them and none of them rang. But the fridge was one of those trendy stainless steel models. Perhaps a more ordinary fridge would have less effect on signal strength.
    - fnordfnordfnord 13y ago
      I've only seen fridges that are made with steel or aluminum. They would still leak RF around the door gaskets, but probably such a small amount that you'd have to be very close to a base station to be vulnerable, and it'd still be mostly soundproof.
saraid216 13y ago
> Waiting for the next Snowden. The pinnacle of democracy: waiting for someone else to do it.
- mindslight 13y ago
  Naw, the pinnacle of democracy is the entitled whining after the longstanding obvious truth has been laid bare. Who needs objective forethought?
Zoomla 13y ago
You can keep it in a Faraday cage whenever you don't need to use it or aren't expecting a call... since it should block all radio signals.

_stephan 13y ago

"Lastly, the baseband processor is usually the master processor, whereas the application processor (which runs the mobile operating system) is the slave." Can maybe somebody explain what this means exactly? Could the baseband processor/OS be used as an attack vector to exploit the main mobile OS? Could the OS protect itself from this?

andyzweb 13y ago
The baseband processor may have unrestricted access to the entire address space of the device or to address space which the application processor (and the operating system it's running) implicitly trusts.
- deleted 13y ago
  [deleted]
- _ak 13y ago
  AFAIK, access to the baseband and vice versa is through a network inside the phone. Physically, these two computers are separated, and communicate only through a well-defined network interface. No poking in other computer's memory.
A1kmm 13y ago
Most modern phones don't really have a physically separate baseband processor and application processor, they run a real-time microvisor (usually an L4 based system, and frequently OKL4 - see http://wiki.ok-labs.com/#OKL4Microvisor4.0 http://wiki.ok-labs.com/#OKL4Microvisor4.0). The microvisor runs multiple virtual 'cells' (which are ARM operating systems that think they are running as supervisor), and ensures that the hard realtime requirements of the radio driver are met even if the kernel in the application cell is stuck in a loop. Because the application processor is actually running in a virtual cell and not on bare metal, it doesn't have full access to the hardware and can't interfere with the radio cell - but the radio cell might still have access to everything.

InTheSwiss 13y ago

I am assuming that the RTOS has direct and full unrestricted access to the hardware such as the camera and microphone? If so then I would also assume that an over the air attack to silently suck data from the camera and microphone would be pretty easy for those with access to the RTOS (such as governments)? I know there has been software to do just this in the past on some Nokia devices but I would assume (I am doing that a lot in this post!) it is just as possible in pretty much every mobile phone? Anyone with knowledge of this care to comment on my assumptions?

_stephan 13y ago
Why would the baseband processor need access to anything but the RF and maybe the GPS hardware?
- sliverstorm 13y ago
  It wouldn't. Though you could build it that way, I guess, if you felt so compelled. http://en.wikipedia.org/wiki/Baseband_processor http://en.wikipedia.org/wiki/Baseband_processor
- rst 13y ago
  For one thing, putting the voice signal processing in the baseband means that it's not vulnerable to timing glitches from "noisy neighbor" apps running on the application processor. For another, as a practical matter, a lot of the baseband software started out as the entire software stack for the single processor in a dumb-phone/feature-phone, which necessarily included the voice processing. Simply leaving it there avoids the technical effort of doing a port.
- Zigurd 13y ago
  Quite often the baseband has the only direct access to the handset mic and speaker, including things like the agc and speakerphone. That's why a room bug can be implemented this way. The article hints at a way to democratize access to this capability by using the RIL commands to turn on auto-answer and turn off any indication it's happening.

buo 13y ago

For an example of an open-source GSM implementation that would allow one to build a base station, see http://en.wikipedia.org/wiki/OpenBTS http://en.wikipedia.org/wiki/OpenBTS . There are lots of videos about it on youtube where you can see it in action.

devx 13y ago

No wonder not only NSA, but also FBI and probably other agencies exploit these like crazy by using fake towers or other methods.

Guvante 13y ago
Who says they need fake towers? I would bet that they can get direct access with the right court order.
- cdash 13y ago
  Why bother?
- devx 13y ago
  http://www.tomsguide.com/us/FBI-wiretap-stingray-cell-phone-towers,news-13124.html http://www.tomsguide.com/us/FBI-wiretap-stingray-cell-phone-...

jared314 13y ago

There is also a second OS hiding in your computer right now! (There might even be a third, or forth, depending on your hardware configuration and manufacturer.) Proprietary BIOS software has suffered the same issues for the last twenty+ years.

foobarian 13y ago
Good thing all these embedded computers in my computer don't have antennas attached with buggy baseband that blindly decodes and trusts messages coming thereon. :-)
- rst 13y ago
  Right, it's not like wifi adapters have independent processors of their own with closed-source, potentially buggy firmware that does DMA into main processor memory. :-) It's also worth thinking about netboot (which comes in several flavors), in which the main processor's potentially buggy BIOS may be independently decoding and processing packets coming over physical wires.
  - yuhong 13y ago
    And on USB, don't forget SMM code emulating PS/2 input devices by parsing USB HID packets. I think part of the reason why real mode exploits was never very common was that the address DOS allocated memory depended on for example what TSRs you were running.
    - rst 13y ago
      Remember that story a few months ago about how some government agency had replaced all its keyboards and mice in response to a malware infestation? A lot of folks (including some here) took this as Yet Another Show of Government Cluelessness. I found myself wondering instead if there was a world in which folks advised by government security experts (i.e., you-know-who) would have a good reason to do something like this and not say why. There is. It's a world in which their opponents had a zero-day against the Windows USB driver, and a way into the government's supply chain. And in which you-know-who wants to play the same game themselves against opponents elsewhere.

Jagat 13y ago

Even BIOS can be considered as a second OS hiding in your PC.

sehugg 13y ago

While we can sort-of assume that the base stations in cell towers operated by large carriers are "safe" Um.

noyesno 13y ago

The link to the ETSI 3GPP specs is a bit silly: it shows not only all the related specs but also all the versions of those docs.

ricw 13y ago

This is all a bit over the top. Yes, the baseband may be compromisable, that doesn't mean that the operating system is. Your photos, data etc should be safe as long as there aren't further exploits (which of course exist). Furthermore, i have yet to hear of a slave high level operating system to the baseband. iOS or android being initialised and commanded by a secondary baseband OS would just be a bizarre setup. That of course does not mean that the baseband doesn't pass commands to the high level OS. Though if the interface is well shielded, exploiting it could be tough (correct me if I'm wrong, but I don't think baseband exploits exist for iPhone 5/5s). Now, I'm sure the NSA however have some interesting possibilities that Angela Merkel would be all to keen to know about ;).

kelnos 13y ago
This is all a bit over the top. Yes, the baseband may be compromisable, that doesn't mean that the operating system is. Incorrect. In most cases the baseband processor has complete, unfettered access the application processor, which means it has complete, unfettered access to the OS.
- rsync 13y ago
  .. and by unfettered, we mean it has DMA access to the application processor. It's not a hook or an API call or some functions it can call - it has low level bit for bit access to manipulate the CPU that your OS (like android) runs on. Further, your carrier (verizon, att, whatever) can push OTA updates and commands straight to baseband via the radio, bypassing the CPU and OS (like android) and manipulating the phone on a low level bit by bit basis. Even the most well secured, rooted, reloaded phone has every piece of it totally owned by the carrier, via the baseband processor. Yes, that includes your photos.
  - ricw 13y ago
    DMA has security modes, implemented by pretty much every standard baseband chip in use today (Qualcomm, Infineon, you name it). In the oldern days baseband exploits were used to crack iPhones. As far as I'm aware of, this hasn't happened in the last two generations of iPhones. So no, you do not have unfettered access to all the data, only the "baseband" segment, unless you manage to hack your security setting for the baseband. For which you first have to hack the Primary OS. I hope you get the theme..

Procrastes 13y ago

"That complexity is exactly one of the reasons why it's not easy to write your own baseband implementation. The list of standards that describe just GSM is unimaginably long - and that's only GSM. Now you need to add UMTS, HSDPA, and so on, and so forth. And, of course, everything is covered by a ridiculously complex set of patents. To top it all off, communication authorities require baseband software to be certified." This is HN. I don't think implementing a replacement is all that daunting given enough time and money. I wonder if there's a business model that will pay for it?

JoshTriplett 13y ago
People are already working on Open Source implementations, both on the phone side and on the tower side. See http://osmocom.org/ http://osmocom.org/ .
Zigurd 13y ago
A 2G baseband implementation is probably not too hard. Making 3G and all the mobile data protocol variants and LTE inter-operate reliably is probably harder. The irony is that LTE invites a look at a minimal "layer 2 only" baseband and doing everything else in the higher-level OS, but, instead, baseband code just gets hairier.
toyg 13y ago
It's not a technological problem as much as a political one. Baseband processors implement umpteen standards (politics) and have to be certified by communication authorities (_big_ politics). And what is the point of building a more secure implementation, if all these tools must (by law and by standard) have backdoors for local authorities anyway?
gonzo 13y ago
I got a chance to look inside Fabrice Bellard's LTE eNodeb code. http://www.bellard.org/lte/ http://www.bellard.org/lte/ It runs on an i7.
- nly 13y ago
  FFS, does that guy ever sleep?

britta 13y ago

Baseband hacking is how people made software-based carrier unlocks for iPhone 2G, 3G, 3GS, and 4 (GSM). Those exploits are somewhat documented here: http://theiphonewiki.com/wiki/Baseband_Device#Exploits http://theiphonewiki.com/wiki/Baseband_Device#Exploits

mmastrac 13y ago
This is also how we did it for some of the unrEVOked roots for HTC devices back in the day as well (mainly the "forever" tool).

maxk42 13y ago

> By design Of course -- all the telecoms have been in bed with the NSA for decades. That's how you play ball in the US.

headgasket 13y ago

... The voice came from an oblong metal plaque like a dulled mirror ... The instrument (the telescreen, it was called) could be dimmed, but there was no way of shutting it off completely. (1.1.3) Oceanians live in a constant state of being monitored by the Party, through the use of advanced, invasive technology. It was terribly dangerous to let your thoughts wander when you were in any public place or within range of a telescreen. The smallest thing could give you away. A nervous tic, an unconscious look of anxiety, a habit of muttering to yourself – anything that carried with it the suggestion of abnormality, of having something to hide. In any case, to wear an improper expression on your face (to look incredulous when a victory was announced, for example) was itself a punishable offense. There was even a word for it in Newspeak: facecrime, it was called. (1.5.65) Is the the google input box a door to the world or a window into your mind? How many fingers do you see?

bigiain 13y ago
But we've _always_ been at war with Eastasia…
- JetSpiegel 13y ago
  Eurasia has been bombing us since we were little boys!

dola 13y ago

And then there is also the one on the SIM doing all the encryption and authentication stuff...

general_failure 13y ago

I was expecting this OS to be the browser. The browser really is another OS these days especially with all the new HTML5 specs (firefox OS being the proponent of such things). The way HTML5 is progressing it might even beat the API of the OS it seems! For example, the OS itself might have no contacts API but the browser has HTML5 API to access them!

dokem 13y ago
I don't think you understand what an operating system is.
- reubenmorais 13y ago
  While the reasons stated by the gp might not be the best ones to justify his assertion, browsers are an environment for running arbitrary untrusted code, and have a lot of similarities with operating systems (like job control, memory management, hardware access, etc).

est 13y ago

Cant wait Tegra 4i hacking allows unrestricted i500 SDR platform access :D

rsync 13y ago
Would you please elaborate ?
wmf 13y ago
Aren't all modern basebands SDR?

mindslight 13y ago

I think we'd all be better off and get to a user-centric mobile experience a lot sooner by isolating the network communication in a dedicated device. I'm toying with the idea that next time I have to upgrade my mobile (hopefully not soon), a better way to go is something like mifi + netbook + smart watch (+ maybe some compact chorded keyboard).

rsync 13y ago
Exactly. If you want a mobile phone that you control, you need to buy something like a samsung galaxy player (contains no baseband processor, contains no mobile phone infrastructure) and then attach a USB modem to it (or carry a MIFI or whatever). There's one problem, however, and that is all of the fancy noise cancellation and voice smoothing are actually done on the baseband proc, and userland implementations of this for VOIP apps are typically pretty crummy. Me, I am sticking with my MOTO FONE / F3 for now.
- alexwright 13y ago
  I'd be (pleasantly) surprised if devices like the Galaxy Player didn't still have binary blobs for the Wifi/BT and video hardware. Even NICs for otherwise fairly open PC/ATX machines all still have the proprietary blob firmware drivers.
tmzt 13y ago
The Mifi is the same thing as the baseband in your cell phone, and can even do SMS. Many of them are running Linux on the AP side now to support more advanced Wifi routing features. If you were really paranoid, you might consider the possibility that it has a microphone or a speaker that can be treated like a microphone. (Though I don't know of any that actually have a beeping, vibrator or piezo output.) Also, they may have some form of e911-compliant GPS receiver, though whether the RF is hooked up for it I wouldn't know.
- mindslight 13y ago
  Well even a completely trustable cell radio is tracked with tower triangulation. The only way I see to fix this is to completely rearchitect the mobile network by getting rid of subscriber IDs, using anonymous payments for tower access, and then a mix network for transit privacy. That is to say, location data is a wash for the foreseeable future.. Surreptitious microphones and other sensors are indeed still a problem, but they seem easy to audit/remove in the short term, and if this model catches on and they become a real threat, the physical audits just have to go deeper. What you do gain is a processor that can be trusted by the user (in the same way we all trust Intel CPUs), with the Mifi only seeing encrypted communications. Also we've moved the demarc point solidly between two separate physical devices - upgrade your pocket computer without involving your cell provider, and replace your communications ability without affecting your user environment.

mey 13y ago

There is actually a 3rd inside the SIM as well http://en.wikipedia.org/wiki/Subscriber_identity_module#Design http://en.wikipedia.org/wiki/Subscriber_identity_module#Desi... This is what Java Card was developed to run on. If you are interested in getting lower level access to your radio, you could look at the defunct http://openmoko.com/freerunner.html http://openmoko.com/freerunner.html project or the resurrection of the Freeruner, http://www.openphoenux.org/ http://www.openphoenux.org/

airencracken 13y ago
Or the neo900 http://neo900.org/ http://neo900.org/
- rsync 13y ago
  AFAICT, the neo900 has a plain old closed baseband processor. So you can "root" it and control the OS all you want, your carrier still owns you and your phone, what with (potentially) DMA level access to your CPU. neo900 is interesting, but it is not any more open in this regard than any other handset.
  - airencracken 13y ago
    Ah, my mistake!
ketralnis 13y ago
There was a great Defcon talk about this called The Secret Life of SIM Cards that I can recommend watching (they release the video for these some time after the conference). The talk itself was about a group that had an enormous camping trip (I hope that phrasing doesn't diminunise it) called Toorcamp of a few thousand people that thought it would be fun to also put together their own cell network for just them. They bought and programmed SIM cards and hid puzzles in the programs on them. But the amount of programming that can be done on the SIM card alone without involving the main processor at all was really quite fascinating and there's a lot of detail in the talk if you can track it down. Here are the slides at least https://speakerdeck.com/codebutler/the-secret-life-of-sim-cards https://speakerdeck.com/codebutler/the-secret-life-of-sim-ca...

pslam 13y ago

The second operating system hiding in every mobile phone? Really? There's a ridiculous number of operating systems hiding in every mobile phone. What do you think runs on the GPU? What about bluetooth, wifi and GPS? What about all those sensors? The camera interface? The video acceleration? The SIM card? The NAND flash? Try harder.

slashclee 13y ago
The GPU, bluetooth, wifi, and GPS chips are not running their own operating system kernels. They have firmware microcode that gets loaded when their drivers are loaded, but they aren't running a completely separate dedicated realtime OS.
- rsync 13y ago
  The SIM card, however, is indeed running it's own little OS.
- pslam 13y ago
  What do you think is in that "microcode"? Most of what I mentioned is usually running on an ARM of some sort. I count that code as an OS, because it's a pretty narrow definition otherwise.
  - slashclee 13y ago
    Default register initialization values and functions to encode/decode and transmit/receive packets of data do not equal an operating system in my book. Maybe you draw the line at a different level of the stack than I do. I'm totally willing to be admit that I might be wrong about this, but I wasn't under the impression that Broadcom and Atheros and Intel were using ARM CPUs in their wifi/bluetooth/GPS chipsets.
    - pslam 13y ago
      The missing piece here is that WiFi/Bluetooth/GPS chipsets ARE usually using ARM CPUs internally. GPUs generally run a funky DSP-like core but there's still some kind of OS scheduling tasks and running code to interact with the main CPUs. The cost of laying down a fully-fledged CPU has reduced to the point where it's simpler and less risky to use an off-the-shelf ARM core (or similar), instead of a big bunch of hard logic combined with coefficient. And most of those CPUs have some sort of runtime, which is an OS, depending on where you draw the line on that.

jjoe 13y ago

It shouldn't come as a surprise that you're not "offline" unless you take the battery out of your phone and wait a good minute or so. And there's no wireless power source "force feeding" your phone... This is well known to anyone who's done DSP optimization work for any of the wireless carriers.

im3w1l 13y ago
Wait, are you saying it is possible to force feed a phone in theory, or in practice right now?

melvinmt 13y ago

> This is such low-level, complex software that I would guess very few people in the world actually understand everything that's going on here. I would not be surprised if the NSA would employ quite a few of them.

chris_mahan 13y ago

After reading all the comments, I'm beginning to think the Butlerian Jihad may not be such a bad thing after all...

igravious 13y ago
I had to Google this. Here's a Wiki P link: https://en.wikipedia.org/wiki/Butlerian_Jihad https://en.wikipedia.org/wiki/Butlerian_Jihad It's from Frank Herbert's Dune :( Sad because I read this series (all six, I kid you not!! 1,2,6 are good 3,4,5 not so good) 25 years ago nearly and I had forgotten this specific detail. Time is indeed a cruel mistress and thanks for making me feel old :)
- chris_mahan 13y ago
  Perhaps I remember thisparticular detail because I've read the six books six times... And, hum, I feel old right along with you...

meson2k 13y ago

MSM6280 is 7 years old. The author has no clue how advanced these RTOS have become now and the kind of effort that goes into security at a system level e.g. xpu, smmu etc.

spc476 13y ago

Quite possibly a third or fourth OS as well ... http://boston.conman.org/2013/01/22.2 http://boston.conman.org/2013/01/22.2

dreamfactory 13y ago

So maybe a relevant question as we move away from desktop computing is whether your mobile device can be identified through online activity, such as commenting, searching, email etc. This would be useful for locating dissidents.

deleted 13y ago

[deleted]

niels_olson 13y ago

For all the "NSA's probably in on this", remember this also leaves openings for China, Russia, and possibly others to get in on this.

alandarev 13y ago
Making it moreove fair.

rcfox 13y ago

Coming from a background of developing audio hardware drivers for the Blackberry (I worked on the last generation and current generation before getting bored and leaving a year ago), I can tell you that even if the baseband were able to turn on auto-answering, (I have no idea if that's possible, by the way) it wouldn't know how to configure the microphone and speakers to allow for recording or playback unless it convinced the application processor to help. If you are concerned about your Blackberry spying on you, there's a special "security plug" that you can insert into the headphone jack which will short all of the pins to ground, disabling the microphone. I assume other phones support this as well.

doubt_me 13y ago
Have never heard of a security plug before. where can I get one?
- antsar 13y ago
  I don't know where, but it sounds fairly simple to make: cut the connector off from an old headset, and solder all of the wires in it together. One of the wires (the uninsulated one) in there is ground, the other three are signal.
  - rcfox 13y ago
    Yeah, I'm not sure either. I don't see it in the official accessories store. antsar's correct though. It's simple to make one yourself. The nice thing about the security plug is that it's small; it doesn't look like your headphones' cable snapped off. :)
    - corin_ 13y ago
      If you don't trust the manufacturer who put the code into your handset, how can you trust that the security plug will always work (other than checking the internal wiring yourself)?
      - 13y ago

hngiszmo 13y ago

I would donate for somebody setting up a server that streams audio (and video, …) from all phones in reach. With bitcoin this could even be pulled off anonymously. I would hope for such a server streaming data from financial districts, one at a time would finally lead to something to change about this. Donations would help buy antennas and rent space in financial districts.

deleted 13y ago

[deleted]

ChuckMcM 13y ago

One of the side effects of software eating the world is that the world becomes more exploitable. I expect that over time we may see the emergence of general 'software building codes' much like there are physical building codes, and more importantly liability associated with failing to provably meet such codes. The current 'random person implements firmware that controls the this chip' practice and the 'no warranty etc etc' disclaimers will, I predict, be replaced by manufacturers who are willing to warrant their code.

fjk 13y ago
Extending that metaphor, a profession could evolve around zoning for permissible uses of code based on types of software and intended audience, much like urban planners do with zoning codes and city master plans.
- eurleif 13y ago
  I can't tell if you're pointing out the problems with regulating software, or seriously suggesting this idea. That's scary.
im3w1l 13y ago
I think it is a consequence of the fast improvements in functionality made. People would rather be on a feature rich beta branch, than a safe stable branch. I also expect this to change as the industry matures.
- csmuk 13y ago
  Actually I find its broken down into two camps: Consumers want the latest. Companies want the most stable. After some particularly huge disasters I've had to deal with coming onto new projects and with general consumer electronics, I'd go for the latter every time both as a consumer and company these days. Time is valuable and losing it to a feature packed unreliable mess is a big risk to that time.
  - blowski 13y ago

Maven911 13y ago

St microelectronics is a firm who provides radio chipsets for apparently 80% of all phones out there

memracom 13y ago

Does anyone know if the Firefox OS replaces these proprietary RTOSes?

ollybee 13y ago
No it does not, nor does replicant or any other alternate phone OS.

itazula 13y ago

What about TRON? http://www.t-engine.org/ http://www.t-engine.org/

coldskull 13y ago

as someone who closely works on qualcomm baseband processors, i can say that security is one of the top priorities of qualcomm. There are whole bunches of teams dedicated to sec/vuln analysis. Not saying that the issues mentioned in the article did not occur...but I believe that those probably occured in older chips (a few generations older) standard disclaimer Views above are personal and do not reflect views of Qualcomm

hiley 13y ago

Who makes the baseband software? Those who make it I guess are more inclined to fix the bugs (because there are paying customers), at least in areas that they can fix...

fayyazkl 13y ago

Often the RTOS is not exactly free, but not entirely closed either. A while back, i used to work on Nucleus RTOS by Mentor Graphics with a pretty impressive global foot print http://en.wikipedia.org/wiki/Nucleus_RTOS http://en.wikipedia.org/wiki/Nucleus_RTOS. It used to be sold as an api (with source code given to customers) who developed applications based upon it. I have written portions (IPsec/IKE, SNMP, Ipv6) of its networking stack and at least all of its customers have access to source code. It is pretty well written with very decent coding conventions and can be compared to any good well known open source project (VLC, even Linux kernel). Then there are others such as Wind River's VxWorks among the more popular ones. Though i am not very sure of its licensing model, but it is pretty well recognized and established in the embedded world. Just that these are not as well known in the over all software community but rather more restricted towards those in the embedded industry.

girvo 13y ago
I always wanted to play with Nucleos! What's it like? I'm a fan of QNX personally though I only got to play with it a tiny bit. Some awesome ideas in it.
- fayyazkl 13y ago
  Nucleus pretty much comprises of a very small foot print. With Architecture specific assembly isolated from like 95% of the code neatly. Rest is Ansi C. It contains tasks which are sort of equivalent of kernel level threads in POSIX but implementation logic is quite different i.e. RTOS constraints are handled by classifying interrupts at two levels. In terms of constraints, there is no dynamic loading i.e. you have to build a single binary. But at the same time it was pretty fascinating with os, networking stack, drivers all contained in a separate folder building up one project. Lately they have added power management, Android like UI and even some hyper-visor support. Most importantly, it is small and consistent enough for a programmer willing to learn through the entire stack. Helps with much better visualization from hardware to application. A couple of former colleagues (one of which incidentally now works with QNX and hence compared both) highlights both i.e. strengths vs weaknesses of each. But it didn't feel like one was superior to another. However, Nucleus severely lacks any certifications (and ability) to get into HARD real time industry such as aviation.

diminish 13y ago

Ohh every phone of mine crashes in a 20 min subway travel since 10 years no matter Android, Symbian.. It must be this RTOS.

wfunction 13y ago

The NSA has probably already figured this out.

ivanhoe 13y ago

It's one of those rare cases (like BIOS too) where obscurity actually means more security...

annnnd 13y ago
The problem is that ONLY obscurity shields users from exploits - and it's not much of a shield (it never is). So yes, it is "more" security. And no, it doesn't help much. Arguably it makes matters worse because the code can't be checked by independent security researchers (whitebox testing).
- ivanhoe 13y ago
  I agree, I was just ironic...

agumonkey 13y ago

Nowadays processors are so tiny and cheap, they're everywhere. # batteries IIRC most battery charging circuits also have a dedicated real time ~OS running. http://www.youtube.com/watch?v=dlSBQ5b6Pdw‎ http://www.youtube.com/watch?v=dlSBQ5b6Pdw‎ # hard drives Also recently someone did run linux in its hard drive controller (which is a set of arm cores, ~v9 and m3) HaD intro : http://hackaday.com/2013/08/02/sprite_tm-ohm2013-talk-hacking-hard-drive-controller-chips/ http://hackaday.com/2013/08/02/sprite_tm-ohm2013-talk-hackin... Direct link : http://spritesmods.com/?art=hddhack http://spritesmods.com/?art=hddhack

atlantic 13y ago

I wonder if there is any relation between this set of vulnerabilities and the Datong system used by the UK authorities to mimic/replace mobile phone base stations. http://www.wired.com/threatlevel/2011/10/datong-surveillance/ http://www.wired.com/threatlevel/2011/10/datong-surveillance...

_ak 13y ago

I talked to a friend of mine who is an engineer at Qualcomm, and he said the article is exaggerated and out-dated. Current basebands don't use REX OS anymore, and they put mitigation mechanisms in place, so this piece seems like FUD.

pjc50 13y ago
I happened to be reverse engineering some firmware the other day, which has "AMSS" all over it; this was in new Sierra Wireless devices built on Qualcomm ARM926EJS baseband. It might not be in the latest and greatest, but it's still out there all over the place.
dons 13y ago
I thought a lot of this stuff was already running on OKL4. E.g. https://code.google.com/p/docl4amss/wiki/OkL4 https://code.google.com/p/docl4amss/wiki/OkL4

lgeek 13y ago

And then there's also TrustZone[0] so don't be surprised if there's an additional hypervisor or RTOS running on the main application processor. [0] http://www.arm.com/products/processors/technologies/trustzone/index.php http://www.arm.com/products/processors/technologies/trustzon...

gwu78 13y ago

Maybe the future is in making calls over the Internet, not a private cellular network? Or maybe the future is in open source software defined radio? I never tried it, but I heard OpenMoko could run BSD. In any event, I hope the future is one where I can read, modify and compile the source for my handheld's bootloader and operating system, as I currently can do with my laptop's bootloader and operating system.

noselasd 13y ago

Though about GSM, if you want to learn more: * http://osmocom.org http://osmocom.org * http://www.youtube.com/watch?v=xOp_wtsHAe8 http://www.youtube.com/watch?v=xOp_wtsHAe8 * http://www.youtube.com/watch?v=_0LCgxe24Po http://www.youtube.com/watch?v=_0LCgxe24Po * http://www.youtube.com/watch?v=9cBJV3yTaQo http://www.youtube.com/watch?v=9cBJV3yTaQo * http://www.youtube.com/watch?v=9cBJV3yTaQo http://www.youtube.com/watch?v=9cBJV3yTaQo Your phone has GSM, even if you're only on 3G or 4G networks though (unless it's a pure CDMA phone) - and the concepts are anyway quite similar in 3G/4G networks an phones.