10

In a recent question (can't seem to find now), someone asked:

Is it possible to track a phone which is off?

and received a response of

Who's to say that it's really off? Your phone has both a CPU and a baseband processor, which may keep running after you've "powered off" the phone. Details of baseband processors are trade secrets and are proprietary.

Are there any cell phones available (preferably running Android) which do have an open-source baseband processor and code? If they're all proprietary, how can anyone be sure that they don't have a backdoor built right in by Qualcomm?

7

From a security perspective, you can achieve the same security either through a review of the component (which you want to achieve with an open-source baseband through the many-eyes-principle), or proper isolation.

Open source

The first appproach is very hard, as regulatory authorities need to certify your baseband firmware. Because of this certification requirement, even if you had an open-source baseband, it would need to be tivoized. You would perhaps see there is a backdoor, but you couldn't remove it.

Open sourcing generally does not imply anything over the security of the product. There are chilling effects from the easy possibility for a security review, which make backdoors harder to create. Of course, security patches can be provided by anyone and not just the vendor, which decreases the time between the discovery of a 0day and its fix. But that doesn't remove the need for a security review.

Isolation

Isolation removes the need for a security review of the isolated component, because the isolating component is reviewed instead. In that review, the isolated component may not be trusted at all. Google did this on the adobe pdf reader and flash player in chrome, and mozilla plans to do this on the adobe DRM plugin, to name two examples. In our case the baseband chip for example needs to be cut off the microphone line when its not having a call.

This approach is done by the Neo900 project. They state on their website:

On Neo900 one can be sure that the modem is actually turned off when requested, not just pretending to be. User will be notified in case of modem wanting to do something without his consent.

Isolation perhaps renders backdoors in the baseband chip useless, but when there is a 0day in the isolating component, it can be used to gain control over the phone.

If you want to be sure the phone is off when it tells you so, you should remove its battery. This can be inconvenient, but with that you can be sure, as the other smaller batteries in the phone are not capable of sustaining the phone for a long time. However, sending a few weak beacons "Hello, this is me!" may be possible, but that is pure speculation.

5

No, doesn't seem to be anything. Understandable: there is almost zero consumer demand for such a product and it would be very expensive to develop (because of the expensive certification you need from Telecom regulatory authorities).

By the way, you're probably worrying about the wrong thing. The main concern with baseband processors is not that the manufacturers have back doored them, but that the things are riddled with bugs and security vulnerabilites. See this presentation from the University of Luxemborg, for example. http://www.youtube.com/watch?v=fQqv0v14KKY

3

It's not Android[1] but I'm really excited about the Neo900. I loved my old Nokia N900 and thought it was years ahead of it's time. The Neo900 upgrades the internals with fully open source software and hardware. They don't have open source base band firmware but they do specifically address that in their FAQs.

I suspect that's as close as you can get.


[1] Personally I like Maemo more than Android anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.