undefined | Better HN

0 pointsdroopybuns11y ago0 comments

Can you provide some technical documentation that supports your assertion that the baseband and the application processor are sharing memory space? I thought they use different processors that are supporting essentially independent operating systems.

0 comments

mindslight11y ago

They're independent operating environments, but that doesn't mean their memories are isolated.

It's commonly accepted that most mobile SoCs operate this way. See the diagram/text on page 2 of https://www.usenix.org/system/files/conference/woot12/woot12... . To the extent that a specific Qualcomm processor might avoid such a design, it's impossible to know due to their longstanding culture of security through obscurity.

AFAIK, the Raspberry Pi is setup the same way, with the black box GPU being the master of the CPU that is commonly used to run Linux. This setup is only less problematic because the GPU lacks an unobservable network link.

Even the i9100, with an independent modem, was found to be setup with shared memory for communication - http://redmine.replicant.us/projects/replicant/wiki/GalaxySI...

Models like the Samsung i9300 have the modem chipset as an independent unit, although I've seen a block diagram indicating that the eMMC flash and modem RAM are in the same package, which is worrying.

mike_hearn11y ago

Your information is out of date.

Modern Qualcomm basebands are restricted by an MMU and isolated from the main OS. Carriers wanted this because baseband exploits were such a common way for phones to get rooted. Additionally they have been hardened considerably in recent times, apparently modern Qualcomm basebands are much, much harder to hack than they once were. And they run now on a proprietary CPU design called, I think, Hexagon, which makes even just disassembling the thing a bit tricky.

mindslight11y ago

I can believe this, because they do have an interest in preventing any random party from taking over a phone. Unfortunately, there is a large gap between being resistant to exploits, and convincing the world that you're resistant to exploits through open review.

BTW do you mean "rooting" in the longstanding sense of general exploitation, or in the recent narrow sense of the owner of a device obtaining control of it? There's of course an overlap between these two, but insight into the specific business motivation would be interesting.

j / k navigate · click thread line to collapse

0 comments

mindslight11y ago

They're independent operating environments, but that doesn't mean their memories are isolated.

Even the i9100, with an independent modem, was found to be setup with shared memory for communication - http://redmine.replicant.us/projects/replicant/wiki/GalaxySI...

mike_hearn11y ago

Your information is out of date.

mindslight11y ago

j / k navigate · click thread line to collapse