Hacker News Reader

Comment by jsiepkes | Hacker News Reader

> That's why you install a firewall on your phone and disallow all outgoing traffic by default

If it's being done by the firmware on the Qualcomm SOC then a firewall in Android is not going to save you.

The firmware on the SOC does not connect directly to the 'net, it interfaces with Android to do so. Android uses the Linux kernel and the Linux IP stack. That IP stack uses Netfilter [1] for filtering and packet mangling. The firewall uses iptables to define Netfilter rulesets which control which data gets sent where, which application is allowed to send data - this includes the kernel (and modules) itself. Block all outgoing traffic - which I do by default - and no data goes out. Try it if you don't believe this, you'll find out it is how things work.

So yes, Android - or rather the Linux kernel on which Android is built - is going to "save me" in that I am in control over which application (including whatever Qualcomm uses) gets to send data. Apple users are out of luck since iOS does not allow this type of filtering but Android does.

[1] https://www.netfilter.org/

> The firmware on the SOC does not connect directly to the 'net, it interfaces with Android to do so.

Do you have any documentation on this? Even firmware such as Intel ME or UEFI implementations connect directly to the Internet itself. So I have a hard time believing the firmware on a Qualcomm SOC does not directly connect to the Internet itself.

No, I do not have any documentation on this nor do I expect any documentation from the likes of Qualcomm where they claim not to exfiltrate data without prior agreement to be all that convincing. What I do have is experience in using firewalls on Android devices for as long as I've used those (about 12 years). I regularly use packet sniffers to see what these devices send to the 'net both to check whether my own stuff is working OK and to check for unwanted traffic. Setting the firewall to block outgoing traffic before enabling network connectivity has always been effective, this includes devices using Qualcomm modems. I use WiFi for these tests just like described in the article as testing for unwanted traffic going over the 3/4/5G connection is only possible if you have a private 4/5G network which I do not (yet) have. I tend not to use 3/4/5G data though - I only have a single device on which I have data enabled and paid for, the rest goes through life using only WiFi. If Qualcomm has made a deal with all mobile operators to push their telemetry through 3/4/5G even on accounts which have data disabled (as in 'not paid for' as well as 'function disabled in Android') they're in for a world of hurt when that news is brought to the light. I assume they have no such agreements as it would not make any sense seeing how easy it is to just use Android and iOS to push that data back to the mothership - which seems to be what they are doing. They are far from the only ones doing this, it is actually the main reason why I block outgoing traffic by default. Just give it a try sometimes, take a device and hook it up to the network through WiFi. Use a packet sniffer on the router to intercept everything coming from that device and feed the result to something like Wireshark. Do the same with that device with a firewall filtering all outgoing traffic and compare the results.

Reply on news.ycombinator.com