Hacker News Reader

Comment by flotzam | Hacker News Reader

Sprint is extra chatty - from page 57 of https://propertyofthepeople.org/document-detail/?doc-id=2108...:

> Ping: The network sends a message to the phones internal GPS receiver to report it's location (must see min. of 4 satellites. GPS coordinates of device and suspected radius from tower e-mailed(or through L-Site website) every 15 minutes for 30 days. Can be done manually every 5 minutes.

I wonder if this is facilitated by one of those infamous "carrier app" backdoors included in stock OS but not e.g. in GrapheneOS:

https://grapheneos.org/faq#cellular-tracking

https://gist.github.com/thestinger/171b5ffdc54a50ee44497028a...

https://github.com/dan-v/rattlesnakeos-stack/issues/69#issue...

View on HN

You don't even need a traditional app backdoor to do this. The carrier can just send the message to the baseband radio itself, which has a direct connection to your GPS receiver, among other things (usually) like the camera and microphone. That means these peripherals are accessible (in theory, Snowden says it has been done in the past) even if the main app OS is shut down.

I'm not sure this is still true (on modern devices): https://grapheneos.org/faq#baseband-isolation

There's Enhanced 9-1-1 but its GPS access should be mediated by the OS? Hopefully?

GPS in 3G or later is integral to Baseband Processor which is a separate ARM CPU that runs its own RTOS. If your adversary gets to push BP patch over SMS you're probably owned no matter what OS you run on Application Processor.

Graphene suggests that it uses iommu and similar hardware on supported devices to mitigate (some) attacks like this.

What’s the story Apple/Samsung etc tell for GPS to be this leaky? Shouldn’t the GPS be solely handled by the OS?

There's only so much you could without making your own modem... Current cellular modems are autonomous and integrated. It's architectural.

Could also be an app that runs on the sim. That would make the most sense.

Do SIM apps really have direct access to the GPS?

the baseband radio does, so, yes. also the camera and mic in many cases.

that works even if location is turned off in the OS itself?

this is most interesting piece of entire presentation.

They can query location remotely using GPS and likely turn on microphone too.

Reply on news.ycombinator.com