2

Baseband Processors have very weak overall security(closed-source firmware, no audits etc.)

It also gives the telecom operator very high privileges on a mobile device.

So, now I use 2 phones. First one being a 'relay' which has a SIM card, and connects to the internet normally. I turn this phone into a Wi-Fi hotspot and then connect the second phone to the Wi-Fi network of the first phone.

And this second phone is actually the personal device which I will use for open-source E2E encrypted communications, web-surfing and other normal mobile phone usage.

This second phone is not going to have a SIM card, have a custom ROM, and all other radio-communications(except for Wi-Fi) switched off always.

Will this method strip the telecom provider of the first phone(which was my main SIM card) off of any 'super-powers' they have on my phone(the second phone) through the baseband processor?

Note:

  1. I know the risk of an unlocked bootloader, so please do not mention that.
  2. I cannot trust my telecom provider at all.
  3. I change the first phone's hotspot's SSID and Password every 24 hours.
6
  • "gives the telecom operator very high privileges on a mobile device" -- what kind of access? – schroeder Nov 6 '20 at 8:03
  • What you propose will not remove powers, and that's not what your actions would do. You are proposing removing access to those powers. And that depends entirely on that one little line you used: "all other radio-communications ... switched off". And that will depend on the phone. – schroeder Nov 6 '20 at 8:06
  • @schroeder 'access': I might have used the world wrongly(may be), but here's what access I was talking about: osnews.com/story/27416/… It says: "master/slave processor, trusts whatever data it receives from a base station, allowing the attacker to remotely execute code,u can remotely turn on microphones, cameras, place rootkits, place calls/send SMS, you can even brick phones permanently." – user Nov 6 '20 at 9:14
  • I am talking about these powers on the second phone. Telco can do anything with the first phone, untill it doesn't compromise the second and I won't be worried. – user Nov 6 '20 at 9:16
  • I don't think you understood my comment. The point I'm making is the one made by the author of the article: "over the air". You cannot remove these permissions because it is firmware. What you can do is to block access to the firmware from the telco so that commands cannot be run. You do that by blocking the cellphone signals. But whether or not the firmware will give you full access to blocking cellphone signals is, well, up to the firmware ... – schroeder Nov 6 '20 at 9:35
0

Baseband processors (modem) are not vulnerable by design. They can be as secure as the operating system. Network operator doesn't have any special privileges over them unless your device is a carrier locked device whose firmware was installed by the carrier in factory.

OS updates for carrier locked device are delivered by carriers themselves. They don't have to compromise modem to remotely execute some code. If that device is connected to internet, that is enough for them to compromise it. Carrier locked devices may already have a vulnerability that is only known to the carrier.

If both of your devices are retail devices then there's nothing carrier can do to compromise either of them unless there's a critical vulnerability present either in the driver or in the firmware of the modem, that is known to the carrier.

Your setup is not providing any more security than using a single custom ROM device directly. If your network operator is a threat to you, you need to be wary of OS updates that were last rolled out for your device and known unpatched vulnerabilities in modem. Chipmakers do roll out patches for critical vulnerabilities in modem but old devices that are no longer supported by OEMs are left unattended.

In carrier locked devices, carriers also add further delay in delivering OS updates once OEMs deliver them to carriers. This is where the gap between security holes and security patches start rising.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.