{"id":33770,"date":"2013-11-17T20:27:49","date_gmt":"2013-11-17T20:27:49","guid":{"rendered":"http:\/\/rafaelfajardo.com\/portfolio\/the-second-operating-system-hiding-in-every-mobile\/"},"modified":"2013-11-17T20:27:49","modified_gmt":"2013-11-17T20:27:49","slug":"the-second-operating-system-hiding-in-every-mobile","status":"publish","type":"post","link":"https:\/\/rafaelfajardo.com\/portfolio\/the-second-operating-system-hiding-in-every-mobile\/","title":{"rendered":"The second operating system hiding in every mobile phone – Thom Holwerda"},"content":{"rendered":"

The second operating system hiding in every mobile phone – Thom Holwerda<\/a><\/p>\n

\n

stoweboyd<\/a>:<\/p>\n

\n

The baseband OS on mobile devices is a frightening mess: incompletely understood and very insecure:<\/p>\n

\n

excerpt<\/a><\/p>\n

Every smartphone or other device with mobile communications capability (e.g. 3G or LTE) actually runs not one, but\u00a0two<\/em>operating systems. Aside from the operating system that we as end-users see (Android, iOS,PalmOS<\/a>), it also runs a small operating system that manages everything related to radio. Since this functionality is highly timing-dependent, a real-time operating system is required.<\/p>\n

This operating system is stored in firmware, and runs on the baseband processor. As far as I know, this baseband RTOS is always entirely proprietary. For instance,the RTOS inside Qualcomm baseband processors<\/a>(in this specific case, the MSM6280) is called AMSS, built upon their own proprietary REX kernel, and is made up of 69 concurrent tasks, handling everything from USB to GPS. It runs on an ARMv5 processor.<\/p>\n

The problem here is clear: these baseband processors and the proprietary, closed software they run are poorly understood, as there\u2019s no proper peer review. This is actually kind of weird, considering just how important these little bits of software are to the functioning of a modern communication device. You may think these baseband RTOS\u2019 are safe and secure, butthat\u2019s not exactly the case<\/a>. You may have the most secure mobile operating system in the world, but you\u2019re still running a second operating system that is poorly understood, poorly documented, proprietary, and all you have to go on are Qualcomm\u2019s Infineon\u2019s, and others\u2019 blue eyes.<\/p>\n

The insecurity of baseband software is not by error; it\u2019s by design. The standards that govern how these baseband processors and radios work were designed in the \u201980s, ending up with a complicated codebase written in the \u201990s – complete with a \u201990s attitude towards security. For instance, there is barely any exploit mitigation, so exploits are free to run amok. What makes it even worse, is that every baseband processor inherently trusts whatever data it receives from a base station (e.g. in a cell tower). Nothing is checked, everything is automatically trusted. Lastly, the baseband processor is usually the master processor, whereas the application processor (which runs the mobile operating system) is the slave.<\/p>\n

So, we have a complete operating system, running on an ARM processor, without any exploit mitigation (or only very little of it), which automatically trusts every instruction, piece of code, or data it receives from the base station you\u2019re connected to. What could possibly go wrong?<\/p>\n

With this in mind, security researcher Ralf-Philipp Weinmann of the University of Luxembourg\u00a0set out to reverse engineer the baseband processor software<\/a>\u00a0of both Qualcomm and Infineon, and he easily spotted loads and loads of bugs, scattered all over the place, each and every one of which could lead to exploits – crashing the device, and even allowing the attacker to remotely execute code. Remember: all over the air. One of the exploits he found required nothing more but a 73 byte message to get remote code execution. Over the air.<\/p>\n<\/blockquote>\n

It sounds like the background for a Daniel Suarez-like scifi novel about an evil genius crashing the world\u2019s economy by controlling the cell phones of politicians, bankers, and security personnel, and causing a stock market and financial market crash by making cell phones execute trades, steal money from bank accounts, and to fund his organization\u2019s terrorism.<\/p>\n<\/blockquote>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

The second operating system hiding in every mobile phone – Thom Holwerda stoweboyd: The baseband OS on mobile devices is a frightening mess: incompletely understood and very insecure: excerpt Every smartphone or other device with mobile communications capability (e.g. 3G or LTE) actually runs not one, but\u00a0twooperating systems. Aside from the operating system that we […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"link","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[],"tags":[1539],"class_list":["post-33770","post","type-post","status-publish","format-link","hentry","tag-emergent-digital-practices","post_format-post-format-link"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/p6PWot-8MG","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rafaelfajardo.com\/portfolio\/wp-json\/wp\/v2\/posts\/33770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rafaelfajardo.com\/portfolio\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rafaelfajardo.com\/portfolio\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rafaelfajardo.com\/portfolio\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rafaelfajardo.com\/portfolio\/wp-json\/wp\/v2\/comments?post=33770"}],"version-history":[{"count":0,"href":"https:\/\/rafaelfajardo.com\/portfolio\/wp-json\/wp\/v2\/posts\/33770\/revisions"}],"wp:attachment":[{"href":"https:\/\/rafaelfajardo.com\/portfolio\/wp-json\/wp\/v2\/media?parent=33770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rafaelfajardo.com\/portfolio\/wp-json\/wp\/v2\/categories?post=33770"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rafaelfajardo.com\/portfolio\/wp-json\/wp\/v2\/tags?post=33770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}