alt Hacker NewsIt concerns me as well as the user-land OS isn't really where control of the RF happens. The OS running in their baseband chip is where the backdoors would best be placed from their perspective. But I'm happy that there are some additional options to run Graphene on the market.
Replies
In modern phones, doesn't the main chip control the baseband chip rather than the other way? What is the threat model?
Obviously since phone calls and text messages are unencrypted the baseband chip could send them elsewhere. But your internet communication should already be encrypted before it hits the baseband chip. So is the threat model Motorola has intentionally introduced a backdoor to leak data from the main chip to the baseband chip?
Graphene doesn't expect to have control of the RF. It makes all the RF stuff happen on the other side of a firewall.
The userspace OS needs to be where control of any radio (bluetooth, wi-fi, cellular, nfc, uwb etc.) components happens, otherwise it would be difficult to be compliant in terms of regulatory requirements like a working Flight Mode.
Baseband firmware/processors are still making strides in terms of defending against attacks so I don't think we are at the point where backdoors are needed. More likely that undocumented AT commands, plausibly deniable bugdoors and existing memory corruption vulnerabilities are already convenient reality. However, part of that reality is also that once the cellular modem is exploited OTA it is still a massive task to traverse IOMMU restrictions and get device owner data/secrets from the userspace OS. It doesn't even grant visibility into application traffic which has been aggressively TLS encrypted since the mid 2010s.