Hacker News Reader

Comment by wvenable | Hacker News Reader

> I would assume that the backdoor for Android devices is the Android Market itself.

Not necessarily. The baseband firmware on your phone is probably more capable than you think. I played around with hacking my old HTC WinMo phone and with a little work I got the (Qualcomm) firmware to respond over USB. There's a complete file system on there that's nearly identical to the file system structure on my wife's dumb-phone (and accessed the same way). I assume they'd put everything they need at that level and don't have to insert anything into Android itself.

View on HN

Yes, but even on devices where the baseband has full access to main system address space, the baseband device is something that varies from one Android phone to the next; on the other hand, the Android Market is a constant across almost all Android devices.

So which would you rather develop: a different backdoor mechanism for every Android baseband out there, or a single mechanism for all phones equipped with the Android Market?

This code probably doesn't vary that much. Across all the qualcomm phones I looked at (Smart and feature phone), it's clearly the same basic operating system. So this one underlying OS that's almost identical across all phones smart or feature that use the same chipset (in my case, they are all CDMA phones). So what's easier to develop, a backdoor mechanism that works for every phone (feature or smart) in exactly the same way using the same code or a different mechanism for each phone OS?

You don't develop either. All you do is tell whoever wants to sell the phone that they must include a backdoor. That means the backdoor almost certainly gets implemented in vendor-specific code (whether their firmware, their add-ons, or their branch of the core OS).

Can you post or point the way toward how to play with basebands? Or, how you got the baseband to respond over USB?

I'm very curious about how these end up working, and can't find much public work in the Android space of people trying to reverse basebands.

Edit:

I found the 28C3 presentation entitled "Reverse-engineering a Qualcomm baseband." [1]

[1] http://events.ccc.de/congress/2011/Fahrplan/events/4735.en.h...

Reply on news.ycombinator.com