I found out about AOSP variants such as Calyx, Graphene, etc. They promise increased security. I want to know if hardware backdoors can allow access to the camera, microphone, etc. and subsequently allow shipping of that data over the network without the OS being able to prevent it.

If this is possible, why don't mobile phones come with hardware kill switches? They should be the standard.

1 Answer 1


Could mobile hardware have backdoor access to other hardware?

Yes, of course. The OS only knows what the firmware and CPU tell it. If the firmware doesn't tell it something and the CPU is either not exposing part of the RAM or is cut out of the loop entirely, then there is nothing the OS can do about it. This is a universal truth of computing hardware, not limited to mobile phones or any other class of device. If you don't trust the hardware vendor to not have backdoored the hardware - or have in-device firmware so shoddy that an attacker can break in directly1 - then you shouldn't buy the device or at least shouldn't use it for anything sensitive. It's as simple as that.

why don't mobile phones come with hardware kill switches?

Well, the obvious answer is "because that would cost money, consume space, interfere with the aesthetics and durability of the device, and result in people accidentally "breaking" their device by permanently disconnecting the microphone2... none of which customers (or vendors / operators) are willing to pay for to gain a little bit more privacy control.

Think about it: where would you put the switches? How would you know they are working? Some laptops come with physical lens covers for their webcams, but that would be a tight squeeze into a mobile device's already packed-to-the-gills camera modules. Even then, while you can see the webcam lens cover deployed, you can't actually be sure that the cover is fully opaque in the relevant frequencies; maybe it's like looking through thin, partially-transparent plastic, and the view beyond isn't totally obscured even though it looks opaque from the outside?

And for purely internal devices... ha, good luck. Supposing against all probability some mobile phone vendor decides to make a device that has a hardware killswitch for, oh, the GPS... how do you determine the difference between an actual hardware killswitch vs. a switch that tells the firmware "pretend to the OS that the GPS is gone, but also track everything the user does, this must be important"? Or indeed one that actually disconnects the GPS from the board (not always practical, with modern SoC mobile devices) but leaves it with access to power and a direct link to the cellular radio? (Or, of course, one that actually fully disconnects the GPS but tracks your location anyhow, using cellular and wifi triangulation, which works just fine in most urban environments...)

There is a nearly 40-year-old speech/paper that is considered a foundational work in computer security: Ken Thompson's "Reflections on Trusting Trust" (another direct link). While the exact merits of the paper have been discussed many times over the years, the fundamental truth of it is undeniable: at every level of a system, the degree to which you can trust it depends upon the degree to which you trust the one(s) below it. You can't trust an app without trusting where you got it from and the OS it runs on. Even if you review the source code, you need to trust that the compiler isn't inserting back doors and that the OS and editor is showing you the true version of the source. You can't trust the OS for the same reason; even if you somehow are sure of the source and the compiler, what about the firmware and hardware? Even if you built the machine and compiler for the firmware by hand, who supplied your chips and other devices? It is a rabbit hole that only ends once you've independently re-derived silicon doping and are crafting your transistors by hand in a lab you've entirely built from scratch, and that's assuming you consider your mind and senses sacrosanct and reliable.

Or, to bring this back to the question at hand: Why, if you don't trust the hardware vendor to not have backdoors in the hardware they sell you, would you trust them to have implemented hardware killswitches that do what you expect? Even in a desktop - much easier to examine directly, much less space-constrained - this wouldn't be reliable; you can disconnect the network devices, but how do you know there isn't a cellular radio embedded in your motherboard? You can disconnect the storage to build a completely clean stateless machine, but how do you know your RAM modules don't secretly also contain a chip with 32GB of flash storage + a microcontroller that saves to it everything that passes through the RAM module and looks interesting (like a password or private key), to be collected when the computer (or at least its RAM) is thrown away or recycled?

1 Some 11 years ago, when concern in the US over Chinese-made network equipment was rising, some security researchers got a hold of a Huawei-made network switch - commercial/enterprise-grade equipment, the sort that has a custom management interface and handles seriously sensitive traffic - and thoroughly reviewed it. The findings: no back doors per se, but the network-exposed management interface's security was so incredibly bad that there was really no need for one; anybody with network access to the switch could take it over, completely and invisibly, using the sort of simple exploits that are were even then used as practice for students, with a "this will never work in the real world, this is just for learning the concepts" type of caveat. Oops. Maybe they've gotten better since? Or for an older example, the infamous Sony music CD rootkits weren't supposed to allow arbitrary users to take over your computer - they were only supposed to prevent ripping the CDs - but Sony's code was so bad that the rootkits could in fact be used by total strangers to seize full control.

2 Seriously, if you give users an easy way to break important functionality, they will use it - either accidentally or on purpose but then forget about it - and then post terrible reviews of the product and take up expensive support time and product return channels with complaints about how they missed their mother's funeral because "this <REDACTED> piece of hardware that I've only had for two days can't even perform basic functions like letting the other end of the call hear me".


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .