Hacker News Reader

Comment by graderjs | Hacker News Reader

I don't always find it odd, but when I do I find it odd that we worry so much about applications when the entire cell telephony networking layer is completely and unpatchably hacked.

View on HN

Because you can work around that pretty easily with authenticating encryption. Even if the networking layer weren’t hacked, you should assume it was.

I have a feeling that you mean "easily" in the same sense the infamous Dropbox demo comment did.

EDIT: I wasn't thinking, OP is completely right. Sorry for the snark.

You can just use whatsapp or whatever. The phone network with SIP/SS7 etc. is hopeless, but you don't have to use it, and most people I know prefer other forms of communication anyway.

Ah right, sorry understood. You're completely right...I wasn't thinking in terms of IP-based services.

I mean more like not just the data transfer layer, but the whole cell telephony baseband firmware enables privileged access to your phone. This can be the entry vector for multiple exploits that go way below the application layer. E2E encrypt is meaningless at this level.

>but the whole cell telephony baseband firmware enables privileged access to your phone

This is very outdated, at least for a significant number of smartphones (including all iPhones, but not limited just to those). Apple and IIRC other manufacturers long since isolated the baseband, treating it simply as a standard USB or PCIe peripheral (and in the latter case using an IOMMU with it amongst other things). It has zero special access to anything on the rest of the phone which in the smart phone era is where everything of interest actually lives and happens.

^ This. Prior to Apple, the phone OEMs and carriers had hooks all into your baseband firmware for all kinds of things; firmware updates, CALEA hooks, automatic provisioning, etc...

Source - used to certify these things in a lab environment.

That's great to know. I'd like to feel reassured but I'm sure there's new exploits somewhere, the carrier level i think is just so attractive to large scale actors. Any internet links to read up on this, and on the next generation of possible carrier level exploit vectors?

It’s always been known that your carrier has access to your unencrypted cell traffic (including voice and text) and that carriers are slimy. You’re also protected by using secure services over IP. I think that the set of people for whom this will cause a threat model change is really small.

Reply on news.ycombinator.com