Hacker News Reader

Comment by walterbell | Hacker News Reader

A wi-fi only device has no baseband processor. In lieu of an IOMMU, the baseband is delegated to a separate physical device, i.e. mobile hotspot.

A wi-fi only device is not a mobile phone, but can provide most of the functionality of a mobile phone via OTT services and VPN to a separate mobile hotspot.

View on HN

That's not necessarily true. Always remember that the hardware industry likes to consolidate multiple products into one for cost reduction where possible. This happens especially with embedded or mobile SOC's where a chip might have features usable in many applications at various price points. So, they make them pretend to be chips without the extra features via factory switches.

As an example, a SOC for feature phones having both GSM and WiFi might be reused in a cheaper "wifi adapter" that still has GSM circuitry but not visibly. Whether if can be used against you depends on whether it's a hard or soft switch they used to disable/hide it plus whether it's reversible or one-time (eg antifuse).

Wonderful. Now we need a teardown with chip identification before buying a device.

The proprietary companies already do this looking for hidden stuff. Mostly patent violations, though, so they can scheme some licensing revenue out of the product they're inspecting. Here's the company that does much of it:

http://www.chipworks.com/about-chipworks/overview/blog/apple...

In that one, you'll see the other end of the process where many mobile chips will get extremely specialized. Notice this one has several RF chips instead of an integrated one to attempt to hit some size/price/energy/performance tradeoff. Plus Apple sells premium stuff whether they can put in more, nicer parts. Notice there's 10 different chips involved in just the RF front-end part. :)

Here's a nice PDF with illustrations of the RE processes themselves plus what things look like:

https://www.iacr.org/archive/ches2009/57470361/57470361.pdf

I like Fig 3 especially as a lot of people forget there's circuitry inside their PCB's rather than just on top or bottom. That cell phone has 9 layers of wiring. :)

Amazing RE paper, thanks.

OK, I admit: for WiFi it is not called "baseband", but something like "WiFi chip", but the functionality is the same (just for WiFi instead of, say, UMTS or LTE) - it also runs a hidden, probably bugged, firmware.

Thanks. Do you recommend any references on the relative difficulty of attacking WiFi radios vs. cellular radios? E.g could any local wifi access point (including a compromised mobile hotspot) attack the wifi device with some kind of magic "packet"?

Are there consumer ARM mobile devices with an IOMMU?

> Do you recommend any references on the relative difficulty of attacking WiFi radios vs. cellular radios?

Unluckily I can't give any recommendations, since I myself still have to read up a lot on the whole topic. :-(

There was a 2014 thread on the Tor blog about Android security, where a commenter claimed that one of the Nexus phones had a baseband that was isolaed by a serial link, https://blog.torproject.org/blog/mission-impossible-hardenin...

"Even isolated basebands often have a USB bridge (which can be exploited by pretending to be another type of device with a vulnerable USB driver) and direct access to the microphone ... iirc it's using a high-speed serial link, not USB. The microphone is connected to the audio codec, which is connected to the application processor. Uplink audio is sent from there to the baseband."

Reply on news.ycombinator.com