Does Google not have sufficient contact with key decision makers at Qualcomm, MediaTek, Samsung, etc. to encourage them to improve the the security of their baseband firmware? Those are the people who really need to be convinced.
Qualcomm actively botches the security of their products as per request of many governments.
The purpose of the letter is to openly shame these companies without directly accusing them of foul play, instead of gently painting them with the brush of mere incompetence, mere lack of knowledge how modern tooling works.
Interesting, I was not aware that's what they're doing. Is there evidence of this?
Assuming incompetence before malice, I'd say that Qualcomm and the other 5G baseband manufacturers have such a moat around cellular modems that it doesn't need to be secure. It's not a competitive advantage. A security critical application simply assumes that the network and the 5G baseband are compromised.
You may be on the right track here. It's just one anonymous HN comment [1], but it fits other pieces (e.g. BSP code dump quality).
The sad thing is, there is no competition where one could go to - it's either Mediatek who have serious issues of their own, or Samsung who mostly stick to themselves.
I know they're proprietary, but got any more info on this? Would be super interesting.
So, security itself is driven by third party organization(s) that consists of engineers from mobile technology companies. If Qualcomm wants their cell modems to be 3GPP certified, they _must_ comply to the 5G standard in it's fullest, including all security features (the same will be true for future revisions, 6G, etc)
There's also groups attempting to make mobile protocols and provisioning entirely open source (O-RAN) which, ironically, will likely improve mobile protocol implementation security practices as they can be audited by anyone with an internet connection.
I remember a pretty egregious mis-implementation in a qualcomm rsa encryption module many startups ago when I was using that, I never heard back about the bug report.
That was over a decade ago so surely it's fixed by now I guess. I guess?
They sued Apple and arguably won, although they settled out of court.
Apple had bought Intel's LTE unit and the patents that came with it, and Qualcomm and Intel both licensed patents into a common pool (and as such, any member of that pool did not owe any other member royalties); Apple inherited Intel's position in the pool and continued licensing patents to the pool with no change. Apple stopped paying Qualcomm the LTE blood money.
_Qualcomm still sued and made money_.
If Apple can't secure a win against Qualcomm, how the hell can Google?
Also, Qualcomm will _never_ license patents (under FRAND or otherwise) to competing vendors; the only way to be allowed to make LTE modems for the west is to be part of that pool.
Oh, and btw? Apple was making their (Intel-based) modem in-house for like two generations while that whole thing happened. They're back to buying Qualcomm modems again.
It seems two essential patents will expire in 2029 and 2030 [1]. So we are basically stuck in this mess till then.
[1] http://www.fosspatents.com/2022/06/lessons-from-rejection-of...
"blood money"? Why so many tears for the most valuable business on Earth? When they picked Qualcomm for their 4G modem, the terms were clear. And then they decided to renegotiate the terms afterwards by telling their manufacturer to withhold the payments to Qualcomm.
> _Qualcomm still sued and made money_.
They negotiated a settlement, Qualcomm got less than they were owed and Apple paid less than the royalties due. Why did Apple settle? Because they had to make design decisions about their new phone - like which modem vendor to use. If you decide not to pay your supplier you could imagine they'd want to work that out before agreeing to give you samples of their new design. If Apple felt that they'd win the case on the merits and that the Qualcomm modem design didn't perform well, they would have just picked a competitor like Samsung. But they didn't do that. They even dual-sourced modems for iphone 7 in order to preserve their negotiating position. But that didn't work because the iphones with Intel modem performed worse than iphones with Qualcomm modems.
> If Apple can't secure a win against Qualcomm, how the hell can Google?
Google "did" secure a win, didn't they? They took their ball and went home. They decided to take the Samsung Exynos SoC and modem for their flagship phone.
> They're back to buying Qualcomm modems again.
... because they're better than the competition - including their acquisition? Is it your contention that Qualcomm somehow forced Apple to pick them over their own?
Software patents are math patents, and math patents are not legal under US law, yet the USPTO continues to issue them. Many standards organizations require you to open the patents to anyone implementing the specifications managed by that organization if you wish to be part of the committee and introduce your technology to it, and the relevant policy here is a joint ITU-T/ITU-R/ISO/IEC governing agreement to do so.
3GPP was developed as a way to sidestep such mandatory agreements, while still being an ITU-managed spec. The company that is gaining the most advantage from this loophole is Qualcomm.
> Google "did" secure a win, didn't they? They took their ball and went home. They decided to take the Samsung Exynos SoC and modem for their flagship phone.
Yes and no. Google and Samsung are jointly putting pressure on Qualcomm that Apple couldn't. Both of them have patents that are part of the LTE patent pool as well, and key ones that would cripple Qualcomm if either of them pulled out.
Apple, through their Intel LTE acquisition, did not have as much leverage, even though Intel was the only other company was ready to compete in the 5G space and had patents relevant to 5G.
I believe Qualcomm, if they wished to push the issue, could also force both companies to settle. They may do so in the future.
> ... because they're better than the competition - including their acquisition? Is it your contention that Qualcomm somehow forced Apple to pick them over their own?
I do not believe so. Most of what was wrong with the first post-acquisition gen modems was Intel mismanagement of the product line (the same way they do to every other product of theirs). LTE benchmarks of the iPhone generation that contained both modems (and it was a random chance on which was in your phone) were mixed. Sometimes the Qualcomm modem was better, sometimes it was Intel.
It would be a shame if Apple abandoned the product entirely, and I don't think they did. I think this is part of the settlement. So, yes, to answer your question, I believe the settlement requires purchase of Qualcomm modems for x generations. The details of the settlement are not entirely public, other than there is a 2 year supply agreement.
You don't drop $1B on an acquisition just to get their patent portfolio and then settle and give up forever. You double down and continue working on polishing up that acquisition while the conditions of the settlement expire. I think in 2-3 generations we will see the return of the Intel modem; if we don't, I think Apple should go find themselves a new CEO.