Seems a bit funny, that a device that is meant for privacy allows remote control by its masters.
Sounds like two critical flaws to me.
> In conclusion: the firm has no control over its supply chain and embeds remote control into its devices.
Dirty secret: Nobody has control of their supply chain anymore.
There have been Samsung and Apple phones being sold on the black market before the real ones.
If you assemble in China, you can be cloned tomorrow.
They build a secure phone. It gets ripped off by the manufacturer and resold by anonymous eBay people who can install whatever backdoors on the phone. Then the people using them are being snooped on - exactly what they don't want in the first place.
Bricking the phones is the right thing to do.
(It's also not Silent Circle's fault if the counterfeit devices were sold with a locked bootloader, precluding the installation of another Android distro.)
If someone was selling laptops with a pirated copy of Windows on it and a Windows update recognized the unlicensed install, causing the laptop to be non-functional, would that be any different?
Remember, the maker of these dodgy laptops has locked the bios so that you can't reinstall a genuine operating system...
To complete your laptop analogy, this "new" laptop from Best Buy turned out to be goods ripped off the assembly line at the Dell factory before the unit had its Windows OEM license assigned or paid for. The software is unlicensed and therefore not genuine. It is not for Microsoft to offer sympathy and a blind eye, they are well within their rights to identify counterfeit installations of Windows and disable them. The remedy is for Best Buy to offer the customer a full refund.
Silent Circle doesn't owe these consumers anything and are well within their rights to have all of their software completely self-destruct. They don't owe these consumers a robust mechanism to install an AOSP distro. They don't owe these consumers a bootable device. They don't owe these consumers a discount on a genuine device.
The only correct resolution is for the scam victims to receive a refund from the seller.
I could see stopping service on those apps, but bricking the baseband is a step too far, as you lose 911 access and Silent Circle almost certainly had no part in the baseband firmware development and is not a rightsholder to it.
I should also point out the claim that the baseband was intentionally bricked is unsubstantiated. We don't know if that's actually happening. Or if it's happening, we don't know if it's intentional.
The percentage of proprietary software on the phone — be it five percent or fifty — is orthogonal to the point.
This type of attack is just a test case that any truly secure device has to defend against. I'm not advocating a specific mechanism of avoiding this behavior, because there's obviously work to be done here to come up with a better mechanism than "every user audits every line of source before installing". It's just that this design work has to be done - "security" based on trusting a company is easy, and doesn't differ appreciably from what say Apple already provides.
^ with the debatable exception of software distributed in source code form in a language you're able to audit and compile yourself, though you'd still be vulnerable to cleverly concealed exploits
So, I don't think it is accurate to say that it 'allows remote control by its masters,' as it appears that they just added some sort of check in the latest version of their OS that can tell if the hardware is legit. There isn't any evidence, at least not in the article, that indicates they have some sort of remote control/phone home service running on the phone that allows them to control it arbitrarily.