Hacker News Reader

Comment by nitrogen | Hacker News Reader

how would it exfiltrate the data without OS-level access to the IP stack

Do iPhones use modems embedded in the SoC? Modem firmware can communicate with the cell network without the OS.

No, they're separate baseband chips with Qualcomm-designed Snapdragon ICs running Apple-signed firmware with their own build flavors of Qualcomm's RTOS. Apple has to verify that the fab produces the low-level hardware exactly as designed, but nothing is going to sneak into that firmware.

Which cell network, in which country? What protocol are those packets going to travel over, what is their destination, and how do they get routed?

The exact same protocol and route as any normal packets - I'd presume that for a phone it's just as for computer network hardware, that OS is not in full control of the IP stack and the firmware can send extra packets that OS won't see (with the same source/routing as configured by the OS after it does it) and process the response packets without propagating them to where the OS might see them.

You would be able to detect those packets then - like if your phone is connected to your home WiFi router.

Well no, if the baseband firmware sends that then only the cell operator would see them, there's no user-controlled software or hardware between the chip and the mobile operator (like the router in the wifi scenario) unless you run your own 4G cell and record packets there. Just as for your laptop, if your ethernet firmware would be malicious in this way then it would apply only to the ethernet adapter and not any other network adapters like wifi.

If the OS turns off all wireless communications and the device is emitting any EM wave regardless of the protocol, you can detect it.

Reply on news.ycombinator.com