Hacker News Reader

Comment by dude123456 | Hacker News Reader

some of crapware can be avoided by using custom ROMs, but not all of it. For example: Qualcomm IZat location services and other location-based trustzone applets remain running even on custom ROMs.

View on HN

You seem to be quite familiar with Qualcomm, but do you know if there's anything similar in Mediatek SoCs? They do have assisted GPS ("A-GPS"/"EPO") but from the info I can find (including leaked very thorough datasheets and programming manuals), it does nothing more than downloading already-public ephemeris data from an FTP server periodically. I've also inspected the firmware, and there doesn't appear to be any traces of the TrustZone/Trustonic stuff that you mention is present for Qualcomm; AFAICS the only thing running on the main CPU cores is Android itself, the modem runs its own baseband firmware, and the GPS/WiFi/BT/FM combo chip (which is a physically separate part, accessed over a serial interface with no direct DMA capabilities) runs a third firmware. Any "secure boot" features in MTK SoCs are (fortunately?) not very secure, so it's all quite easy to inspect.

There's some bits of interesting info here:

https://github.com/cyrozap/mediatek-lte-baseband-re

https://postmarketos.org/blog/2018/04/14/lowlevel/

How is it sending the data though? if it's using mobile plans, wouldn't it be noticeable on the data usage plan? (or is it that manufacturers have agreements with carriers to not charge for it?)

This is my question too... nobody has explained this part.

> IZat location technologies use a network of cloud-based assistance servers that provide industry-leading location performance for any mobile device, on any network, in any environment.

https://www.qualcomm.com/products/izat

Location data is what, maybe 1kB per sample, including lots of overhead? 100 samples/day is 3MB/month. It's not going to affect your mobile data budget.

Some people do not have a mobile data plan. Using mobile data in such case would typically be rather expensive. Unexplained mobile data charges, however small, would raise questions.

Can confirm. Chinaphone used mobile internet every day sending bytes. Tried using firewall, then butchered settings altogether.

>Qualcomm IZat location services

did a quick check, it's not on my phone (SD 820 SoC).

>other location-based trustzone applets remain running even on custom ROMs.

I have no doubt some proprietary blobs still remain on custom ROMs, but do those actually send back location data to the OEM?

> did a quick check

How? Thanks.

searched up the package name, and according to https://forum.xda-developers.com/android/software-hacking/ar..., it's installed at /system/priv-app/xtra_t_app, which was not on my phone.

Also noticed that most posts had mentions of IZat in their location settings, which my phone did not have (in lineageos or stock)

You're looking in the wrong place.

TrustZone OS is started during SBL2 (secureboot level 2), running in hypervisor mode, while you're looking at the Android OS started during SBL3 (secureboot level 3). You cannot see hypervisor processes & apps from your vantage point (the android kernel).

The trustzone OS is usually located in TZ partition, and it uses some additional partitions for custom TZ apps and data persistence.

The hypervisor has independent access to the internet, the wifi card (for indoor location), and more.

Qualcom boot process, showing SBL1, SBL2 and SBL3 stages:

https://forum.xda-developers.com/showthread.php?t=1769411&pa...

It goes without saying that without TrustZone OS, the phone won't boot to Android OS (won't proceed to SBL3).

You don't seem to appreciate the fact that the OS you interact with on a modern smartphone is essentially a guest.

There's a world of proprietary complexity you have zero visibility into, and much of it is running with direct access to hardware the application OS you interact with can only partially make use of.

You have a Qualcomm Snapdragon 820? Oh yes, IZat is definitively there, along with other interesting trustzone applets :)

It is running under QSEE (Qualcomm) and/or MobiCore (Trustonic) OS, which is separate from your Android OS. It is left untouched by custom ROMs.

While most of the terms there aren't Google-able (QSEE, MobiCore, trustzone applets, etc) the IZat page seems to almost boast about the core argument:

https://www.qualcomm.com/products/izat

Scroll down to "Cloud-Based Assistance" and "Built Right In."

Are you sure? According to https://forum.xda-developers.com/android/software-hacking/ar..., they have corresponding apps running in the main OS as well.

I do not understand.

Even if there was a separate OS running in parallel with Android, how could it access the wireless-networks-based and satellite-based location data? I thought that access to these things is controlled by Android.

In other words, when I turn off e.g. satellite location data in Android, can IZat (which, according to your post, runs outside of Android) or other similar spyware keep secretly using it anyway? That would be quite worrying.

I suppose that the location data can be collected by sniffing the low-level communication between the radio device and Android kernel, provided that it has been enabled in Android first. But even then, how could this location data be transferred out of the device? Are these "parallel-running" OSs also able to somehow "tap into" Android's network layer and send the collected data out?

Most cellular devices have a Baseband processor with RTOS or run a hypervisor that runs a RTOS and your phone's operating system.

These OS images are untouched by your custom ROM because they're black box.

https://en.wikipedia.org/wiki/Baseband_processor

Oh, sweet summer child ...

"Even if there was a separate OS running in parallel with Android, how could it access the wireless-networks-based and satellite-based location data? I thought that access to these things is controlled by Android."

There is a separate OS running in parallel with Android and it is running on the very hardware that makes the network connections to the cellular network that you are speaking of.

In fact there are two - the OS and software stack that run on the baseband processor and the OS and software (java apps) that run on your SIM card, which is a full blown computer with its own memory and processor, etc. In fact, your carrier can upload new java programs to your SIM card without your knowledge at any time.

Your final question is a good one - many (most ?) implementations give the baseband processor DMA to the main, application processor. So you are hopelessly owned. Deeply, profoundly, hopelessly owned.

True++ there are at least 4-5 OSes on Qualcomm with direct access to the Internet:

1. Linux Kernel / Android OS, running on main ARM CPU in "normal mode"

2. QSEE or Trustonic OS, running on main ARM CPU in "trusted execution environment" mode, in parallel with "normal mode"

3. OKL4 / REX Kernel + AMSS OS, running on the baseband CPU (modem)

4. SIM card processor, although it is very limited (typically 32k RAM) and acts only as a MITM for SMS's, not cellular data

5. The OS running on the Wi-Fi card

Do you happen to know if Apple phones are any better with regards to privacy?

Does anyone know of any smartphone projects where the circuits are designed to give the user's OS (usually GNU/Linux, but could be anything the user fancies if the bootloader's free) control over power to the baseband CPU, SIM card processor, and OS on the Wifi card? As far as I know, the Neo900 project is the only one attempting to allow the user's OS to control power to all those other ones.

It doesn't exist. And in the current market, it can't exist.

All the core silicon is wrapped up in huge quantities of NDAs and licensing agreements. You buy a baseband, and the mfg gives you a blob you can either use, or not use the baseband.

Remember back when people got upset over Intel CPUs having a unique ID in them? Remember when people got upset over tracking pixels?

Since then, things went really bad, really fast, just no one noticed.

We noticed, but wailing and gnashing teeth doesn't achieve much. Unfortunately, without widespread education and outrage, nothing achieves much.

That's why I don't mind being "that guy" in social situations when these issues are brought up.

You seem flabbergasted so I wanted to directly answer your questions.

> how could it access the wireless-networks-based and satellite-based location data?

The OS is either running on the same hardware as Android or has the same direct hardware connections.

> I thought that access to these things is controlled by Android.

Only for things executing within Android. This is just a fancy UI - Android doesn't actually control the hardware.

> In other words, when I turn off e.g. satellite location data in Android, can IZat (which, according to your post, runs outside of Android) or other similar spyware keep secretly using it anyway?

Yes.

> I suppose that the location data can be collected by sniffing the low-level communication between the radio device and Android kernel, provided that it has been enabled in Android first.

You shouldn't think of it as between the radio device and Android but rather between the radio device and the CPU. A CPU that another OS can and is running on. Android is not special here.

> But even then, how could this location data be transferred out of the device?

The same way Android sends data out of the device. The OS asks the CPU asks the radio to transmit some data. Bog standard.

> Are these "parallel-running" OSs also able to somehow "tap into" Android's network layer and send the collected data out?

Yeah but like I said its not Android's network layer. Android is a guest on top of the system just like any other OS running.

The SIM card is a separate OS that gets underneath the SOC's OS. It can run its own applets without the knowledge or permission of the SOC OS.

https://www.youtube.com/watch?v=31D94QOo2gY

The baseband is a completely different RTOS as well. And then there's also TrustZone running in the SOC as well.

what about exynos chips?

It uses these domains:

http://xtrapath1.izatcloud.net

http://xtrapath2.izatcloud.net

http://xtrapath3.izatcloud.net

I'm not sure what part of the OS is sending it, but it's definitely happening (and is block-able!)

Hopefully this shows people how deep it is.

If all that is claim in here isn't conspiracy, how can it stay a secret? Isn't it the reason wikileaks was created in the first place?

How is it a secret? We're talking about it right now.

https://www.youtube.com/watch?v=hf5FRPfGiC8

I think the issue is that most people end up just thinking "so what? What can they do with it?" and only think "I'm not doing anything wrong" (hate that phrase and origin). The consequences of this type of thing may be apparent to tech people, but not most of the public.

It isn't a conspiracy, it is just unnoticed, I'd argue due to news fatigue.

Heck, it has a hompage. https://www.trustonic.com/solutions/trustonic-secured-platfo...

Reply on news.ycombinator.com