1

So I have been working on some ideas for securing cell phones from baseband level exploits and I was wondering if there are any potential complications with these solutions such as practicality or functionality.

First idea I had in mind was simply removing the Baseband OS from the processor itself or at least putting hardware level restrictions on what it is allowed to access. (Such as only allowing it to access the modems and phone antenna and such. Everything else would only be controlled by the application processor.)

The other idea was to place a Secure Cryptographic Module on the IO paths that transport data to and from application processor to the baseband. Or into the baseband processor itself. So that any and all data, voice, SMS, regardless of what cellular protocol is used be it 2G, 3G, 4G etc is enforced to be encrypted before it even leaves the device and is sent over the airwaves. This way there would be no way for an interceptor to be able to read anything that is captured regardless of how they exploit the device. There would of course be no way to turn this encryption off. It is always on.

The encryption would be done with a stream cipher that uses 256 bit keystreams and IVs.

So the question is, would there be any possible complications with implmenting these solutions that would interfere with the functionality or practicality of the phone?

  • 2
    First, the baseband already can't access anything besides the radio hardware and antenna; any baseband malware would first need to compromise the application processor before it can take full control over the device. Now, about the encryption... so any data sent by the phone to the baseband is encrypted, including the contents of any text messages or calls. How do you decrypt that on the receiver's side (let it be a phone or the base station) ? – André Borie Nov 26 '15 at 15:35
  • Ideally the device itself would hold the information to decrypt the data streams. However the base stations could also hold the same decryption system provided that there are measures in place that render it impossible to be compromised or subverted by any malicious party – WAR10CK Nov 26 '15 at 16:29
  • Actually, I'd like to correct my previous comment. Some basebands share their RAM with the main CPU, which means an evil baseband could compromise the main CPU and the entire system. – André Borie Jul 18 '16 at 14:03
1

4G LTE is already encrypted: https://security.stackexchange.com/a/21400

Doing additional application layer encryption to cut out baseband malware would involve additional layers of key exchange and transport encryption management on the phone and the tower. This would create additional expense.

The problem is better solved by using end-to-end encrypted application protocols for communication rather than trying to add additional encryption to the largely already sufficient link layer encryption.

  • @WAR10CK that's a problem 5G should be pushed to fix. Is it a fundamental flaw in LTE? – Alain O'Dea Dec 1 '15 at 17:45
  • Well I learned that those phony cell towers and stingray devices can disable or turn off the standard cellular encryption. So I figured the best way to render this a moot point would be to embed a module that cannot be subverted or disabled and that ensures end-to-end encryption is enforced at the hardware level and that nothing that is possibly intercepted can be used. I could set it up so that the crypto chip only activates when the phone is switched to the unencrypted 2G protocol. But then how would I prevent this switch from being exploited and used to subvert it? – WAR10CK Dec 1 '15 at 17:47
  • @WAR10CK interesting idea, but how does the 2G infrastructure support what you describe. You'd still need infrastructure commitments. Would it be better to allow handset users to disable 2G fallback? – Alain O'Dea Dec 1 '15 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.