Hacker News Reader

Comment by Tepix | Hacker News Reader

I'd like to know details regarding the protection of the baseband that both Sikur and SilentCircle have taken. As far as I know, the baseband is still a closed source black box. If it has a security hole, the baseband processor can access the microphone and the GPS function because these functions are handled by the baseband CPU on many recent phones.

On older phones such as the Galaxy Nexus, the baseband has to ask the OS for this data, which is detectable (and can be prevented). The Replicant project has an interesting page on the topic of modem isolation at http://www.replicant.us/freedom-privacy-security-issues.php

View on HN

First thing I look for in any announcement or news story about supposedly 'secure' smart-phones is a mention of the baseband issue. Failing to mention it indicates to me that they are unaware (and so insecure by default) or just don't care.

You'll see it mentioned occasionally in reviews but generally it's just ignored. I don't know if this is down to a lack of comprehension of the reviewer, or if the prevailing attitude is that this is 'too big a problem' to solve, and so nobody likes to talk about it. I do see it raised in nearly every HN thread about secure phones, so that's good.

I think it will take a big non-US based manufacturer with approval from their government to totally re-do baseband and fix this issue. It won't be certified any time soon in the US market but that's fine with me so long as it plays well with GSM.

It's not that they are unaware. I talked to Jon Callas of SilentCircle at MWC back in 2014 and he was totally aware of the isuue. Back then he argued that the BlackPhone 1 was a first generation product and they would solve the issue later on. It's disappointing that they haven't managed to do so by now, but it's not completely surprising. The market for baseband chips (and their software) only has a few big players and it takes considerable resources to implement an LTE stack.

Reply on news.ycombinator.com