Johanna Faust, a mixed race Jew, prefers to publish pseudonymously. She is committed: first, to preventing war, ecological disaster, and nuclear apocalypse; last to not only fighting for personal privacy & the freedom of information, but, by representing herself as a soldier in that fight, to exhorting others to do the same. She is a poet, always. All these efforts find representation here: "ah, Mephistophelis" is so named after the last line of Christopher Marlowe's Dr. Faustus, whose heretical success flouted the censor for a time. 













































































































































          

        

          

        










The Second Operating System Hidden In Your Cell Phone

















Invasion of the Privacy Snatchers II - or, how I never learned to stop worrying and love my cell phone -- a faustian mashup











Just what you needed -- a secret brain in your cell phone.  From which many a covert exploit, no doubt.







from OS News: 













Every smartphone or other device with mobile communications capability (e.g. 3G or LTE) actually runs not one, but two operating systems. Aside from the operating system that we as end-users see (Android, iOS, PalmOS), it also runs a small operating system that manages everything related to radio. Since this functionality is highly timing-dependent, a real-time operating system is required.



This operating system is stored in firmware, and runs on the baseband processor. As far as I know, this baseband RTOS is always entirely proprietary. For instance, the RTOS inside Qualcomm baseband processors (in this specific case, the MSM6280) is called AMSS, built upon their own proprietary REX kernel, and is made up of 69 concurrent tasks, handling everything from USB to GPS. It runs on an ARMv5 processor.



[snip]



With this in mind, security researcher Ralf-Philipp Weinmann of the University of Luxembourg set out to reverse engineer the baseband processor software of both Qualcomm and Infineon, and he easily spotted loads and loads of bugs, scattered all over the place, each and every one of which could lead to exploits - crashing the device, and even allowing the attacker to remotely execute code. Remember: all over the air. One of the exploits he found required nothing more but a 73 byte message to get remote code execution. Over the air.



You can do some crazy things with these exploits. For instance, you can turn on auto-answer, using the Hayes command set. This is a command language for modems designed in 1981, and it still works on modern baseband processors found in smartphones today (!). The auto-answer can be made silent and invisible, too.



While we can sort-of assume that the base stations in cell towers operated by large carriers are "safe", the fact of the matter is that base stations are becoming a lot cheaper, and are being sold on eBay - and there are even open source base station software packages. Such base stations can be used to target phones. Put a compromised base station in a crowded area - or even a financial district or some other sensitive area - and you can remotely turn on microphones, cameras, place rootkits, place calls/send SMS messages to expensive numbers, and so on. Yes, you can even brick phones permanently.



Read more













Don't suppose you feel any safer -- hard to feel any less safe.







Be seeing you.























put here for your consideration by



on this









































1 comment:































        

      









Subscribe to:
Post Comments (Atom)