Slashdot Mirror
Encrypted Blackphone Patches Serious Modem Flaw (threatpost.com)
msm1267 writes: Silent Circle, makers of the security and privacy focused Blackphone, have patched a vulnerability that could allow a malicious mobile application or remote attacker to access the device's modem and perform any number of actions. Researchers at SentinelOne discovered an open socket on the Blackphone that an attacker could abuse to intercept calls, set call forwarding, read SMS messages, mute the phone and more. Blackphone is marketed toward privacy-conscious users; it includes encrypted messaging apps such as SilentText and Silent Phone, and it runs on a customized, secure version of Android, called PrivatOS.
Baseband processors (aka modems) have been the greatest technical weakness in cellphones since the dawn of SIM cards. They operate independently of the primary CPU and still crash when fuzzed and yet still have DMA lines to your RAM. Perhaps the bigger problem is how absurdly complex the ever growing number of protocol standards there are for baseband processors.
Anons need not reply. Questions end with a question mark.
The Neo900.org phone deliberately uses a CPU that does not have a modem built into it. The modem is a separate chip, and there is a watchdog chip that instantly resets it if it tries to do anything when supposed to be off.
The NSA has had access to Blackphones since day 1.
With extra insulation so the annoying whine doesn't escape the acoustic coupler.
Zero credibility.
Any competent University CS major programmer could have figured out this was a stupid fucking hole. They are clearly incompetent and should not be in the security industry.
Why didn't they pick this up in the security audit. They did test for security before releasing to market?
According to an interview that I think I heard in an old episode of risky.biz, the blackphone creators actually got access to source code for the modem. I remember this specifically because I was surprised about Nvidia being in that hardware business AND allowing them to audit it. I thought that would be a unique selling point. Too bad they seem to have forgotten to audit their own stuff instead.
The exploit is not in the baseband; it is a local socket on the phone accessible by apps with no special privileges (as far as I can tell).
Phil Zimmerman gave a talk on the Blackphone at Defcon 22:
DEF CON 22 How To Get Phone Companies To Just Say No To Wiretapping
I have transcribed this from the time 26:10 in the video:
26:10 Question from audience member:
Hi, so traditional phones are dependant on the baseband processor,
which has a whole lot of flaws depending on the protocols that they
are using. What are you doing to mitigate baseband processor factors?
Zimmerman:
Yeah, that is a good question. We had a meeting at Nvidia, because
Nvidia makes the chipsets that we are using for Blackphone.
And Nvidia had apparently aquired a company a while back that
made a baseband processor. It was built around a software defined
radio.
And I asked them that questiom; Can we do an independant security
review for the for firmware for the baseband processor.
And they said they would be open to that.
In fact, they were delighted to have a customer expressing interest
in really taking a close look at their baseband processor;
no other customer had ever brought up the question before.
You know, no other customer is as obsessive over it as we are.
I guess they should have spent some time looking at their own stuff rather than other people's code in this case.
From what I'm reading on their web post about the issue, it seems like there might be *ulterior motives* to PayPal blocking Neo900 from getting their funds to run business as usual.
Probably because the tech inside the phone (modem separated from CPU and cannot be remotely activated whatsoever) poses a real danger to surveillance efforts from the US government, at least.
This is, of course, all speculation with a dash of paranoia. Maybe it is just some technicality that will be resolved in short order.