Hacker News Reader

Comment by cm2187 | Hacker News Reader

I am confused. Are they mandating a backdoor, or is there already a backdoor, or are they allowing the police to exploit zero days? If it is the latter, it is sad that the authorities assume weak security as a given.

View on HN

They may have access to backdoors in the baseband firmwares.

The baseband is an opaque binary blob that operates outside of the phone's main OS, and its contents are usually considered a trade secret by the manufacturer since it handles low-level hardware interactions with the main radios/etc.

Personally, I would be surprised if those systems weren't compromised by agreement. It's already common to see criminals and dissidents get busted because they think that turning a phone off stops it from reporting location data.

Do the cameras/microphones need to be controlled by the baseband? Naively they seem like they should be at a slightly higher level than the main radios, and should be controlled exclusively by the OS. I'm guessing from your comment there's some reason that's not the case though?

Tough to say, information about the systems is restricted and hard to come by.

I'm pretty sure they have hooks into audio systems for wireless emergency alerts, but could be wrong.

The microphone does need to be connected to the phone. Not so much the camera.

Does it? The OS must be able to send audio to the phone modem (bluetooth, homepod, etc), so it seems reasonable to me that it wouldn't have direct access to the microphone and that would go via OS also.

Not in theory, but certainly historically. Last I read, there was still an AT command channel present. Some of that IP is super old.

There is this [0] thread from a few years ago. According to the linked article, "unless an IOMMU is used, the baseband has full access to main memory, and can compromise it arbitrarily." No idea how true this statement is.

0: https://news.ycombinator.com/item?id=10905643

In addition to the basebandy RF stuff that you expect the baseband to do, it also does real-time voice modulation and call quality things like echo and noise cancellation… things that high level OS would do too slowly.

In 2023 I suspect this is less and less necessary- apple silicon is very fast and a lot of voice comms goes through an app (FaceTime?) anyway but … I’m sure those capabilities are still in the baseband processor …

> It's already common to see criminals and dissidents get busted because they think that turning a phone off stops it from reporting location data.

That’s an incredible claim to make with no source. It seems unreasonable to suspect Apple and google would allow some chips they don’t access to battery even when powered off.

Why would you have a source if the tech is "secret"?

Because signals can be measured?

Well if you can make claims without a source and say the tech is secret..you can claim literally anything? I have a startup that builds a machine that can complete medical tests from a single drop of blood. The tech is a secret though.

I wonder if the microwave tip works.

They are already doing via exploits, or via carrier injection, but this might have been illegal given the various anti-hacking laws around. So the legislature is granting explicit permission for the police to do this.

Governments regularly have a steady flow of zero days to use, but once it's used it's "burned" so it's not something they throw around willy nilly. I would guess they are going to force manufacturers to play ball, and I would gues that the manufacturers will.

Or the manufacturers will just not sell their phones in France. Ultimately it’s the French citizens that will miss out.

My guess is that France will soon have followers in form of other EU states.

Both left and right are contesting who can be more authoritarian these days.

The only left wing governments in the western world are Portugal and Spain. And PSOE is barely left-wing imho (I won't fall into the 'no true scottman' here, but I really wanted to).

Manufacturers already throw their principles out of the window to sell in China, Russia and UAE so I don't think they'll have a problem selling in France after this either.

What would stop manufacturers from selling their products in France with whatever customizations are required by law?

They don't have any backdoor and they don't mandate ones. This is meant for using zero days legally

Oh. We've been doing that for decades in the US.

The US can force Google & Apple to share private information and has a unique position, France just cannot do any of that.

Reply on news.ycombinator.com