Hacker News Reader

Comment by ricw | Hacker News Reader

This is all a bit over the top. Yes, the baseband may be compromisable, that doesn't mean that the operating system is. Your photos, data etc should be safe as long as there aren't further exploits (which of course exist).

Furthermore, i have yet to hear of a slave high level operating system to the baseband. iOS or android being initialised and commanded by a secondary baseband OS would just be a bizarre setup. That of course does not mean that the baseband doesn't pass commands to the high level OS. Though if the interface is well shielded, exploiting it could be tough (correct me if I'm wrong, but I don't think baseband exploits exist for iPhone 5/5s).

Now, I'm sure the NSA however have some interesting possibilities that Angela Merkel would be all to keen to know about ;).

View on HN

This is all a bit over the top. Yes, the baseband may be compromisable, that doesn't mean that the operating system is.

Incorrect. In most cases the baseband processor has complete, unfettered access the application processor, which means it has complete, unfettered access to the OS.

.. and by unfettered, we mean it has DMA access to the application processor. It's not a hook or an API call or some functions it can call - it has low level bit for bit access to manipulate the CPU that your OS (like android) runs on.

Further, your carrier (verizon, att, whatever) can push OTA updates and commands straight to baseband via the radio, bypassing the CPU and OS (like android) and manipulating the phone on a low level bit by bit basis.

Even the most well secured, rooted, reloaded phone has every piece of it totally owned by the carrier, via the baseband processor.

Yes, that includes your photos.

DMA has security modes, implemented by pretty much every standard baseband chip in use today (Qualcomm, Infineon, you name it). In the oldern days baseband exploits were used to crack iPhones. As far as I'm aware of, this hasn't happened in the last two generations of iPhones. So no, you do not have unfettered access to all the data, only the "baseband" segment, unless you manage to hack your security setting for the baseband. For which you first have to hack the Primary OS. I hope you get the theme..

It's not unusual for the baseband to control the application processor's boot sequence. Quite a lot of phone unlocking/rooting/jailbreak exploits go via the baseband.

I don't think baseband exploits exist for iPhone 5/5s

True, but that just means that people haven't broken into the baseband yet, not that if the had done that it would be impossible to break into the application processor.

Reply on news.ycombinator.com