You obviously know vastly more about security than I do, but I don't understand how a black box with DMA doesn't implicitly compromise the rest of the device, for people whose threat models might include state-level actors — and particularly their shadier bits.

EDIT: Is it just a matter of there being easier/cheaper vectors?

Also, phrasing.

Could you help dispel the myth by providing sources? Info regarding Android phones would be appreciated.

I certainly was still under the impression that phones were a crapshoot of vulnerabilities especially outside the iphone.

Fine, that myth refuses to do, but can we get some common-sensical security best-practices for intelligent but non-technical folks?

This is a real problem, that smart people don't know how to keep their stuff secure.

Do the known ss7 vulnerabilities not count?

Why not explain away the myth?

I'd like to know why it isn't. A rootkit doesn't necessarily need access to every ring of a system, just enough to compromise it .

Is there some reason that you seem to be purposely vague when speaking about basebands in these kind of threads? ( https://news.ycombinator.com/item?id=10906188 )

The baseband may not have as much authority as some purport, but it's still a subsystem with it's own code and purpose -- and (like any other subsystem), a villain could theoretically use this to their advantage in all sorts of imaginable ways.

(tl;dr : DMA isn't needed to be evil. It's just nice.)