Comment by mschuster91 | Hacker News Reader

Comment by mschuster91 | Hacker News Reader

Anyone surprised by basebands being vulnerable should know these things:

- there are only three big players in town: Qualcomm, Mediatek and Samsung, and the latter is pretty rare to find outside of Samsung's own devices and the Google Pixel lineup (where they also have been implicated in security [4] and battery performance [5] issues)

- Qualcomm is infamous for suing anyone including Apple for patents crap, which is how this oligopoly formed in the first place, and why there's barely any competition

- It's not the first time serious vulnerabilities have appeared in baseband chips [1]

- and finally, to a possible cause, Qualcomm's development practices [2] are even worse than what's reported about Oracle [3], if these (anonymous) HN comments are to be believed.

[1] https://www.bleepingcomputer.com/news/security/qualcomm-vuln...

[2] https://news.ycombinator.com/item?id=38607205

[3] https://news.ycombinator.com/item?id=18442941

[4] https://www.notebookcheck.com/Google-warnt-vor-massiven-Sich...

[5] https://www.nextpit.com/google-pixel-8-pro-5g-modem-battery-...

> - there are only three big players in town: Qualcomm, Mediatek and Samsung, and the latter is pretty rare to find outside of Samsung's own devices

For basebands yes. I'll complete this for a quick overview for IMS/VoLTE, which is often in baseband, but not always. (And VoLTE is at least partly what the article is about, and the last public Pixel remote flaw was caused by VoLTE)

Just to give a quick approximate overlook:

- If you're on a Verizon-branded device, Verizon probably made their own IMS implementation mandatory [1]

- If you're on a Samsung or LGE-branded device (no matter the SoC), they use their own IMS implementation [1]

- If you're using a non-Samsung-branded Samsung Silicon device (=SLSI: Pixels, Moto One Action and few others), they use a different IMS implementation than the IMS Samsung uses in their smartphones

- In other cases, you're indeed likely using the IMS/VoLTE implementation provided by the baseband/SoC vendor

As far as I know, the implementations I've marked with [1] are at least partially [2] done in userland in application processor rather than in modem, but it's hard understanding really. The ones that are not marked with [1] are in modem afaik.

[2] Partially meaning the annoying protocol stuff, but audio encoding/decoding + RTP encapsulation might remain in hardware

Reply on news.ycombinator.com