Qualcomm Snapdragon X7 LTE-A

[Bjørn Mork]

Benoît <benoit at neviani.fr> writes:

>>I don't know if you already saw this:
>>http://laforge.gnumonks.org/blog/20161230-33c3-presentation/
>>
>>The situation is similar for any LTE modem.  Which means that there
>>isn't really much the host drivers can do to secure the system. The
>>modems are powerful systems by themselves, running a big binary firmware
>>blob you have no control over.  It doesn't really matter if it is based
>>on lots of GPL software either. The important central piece of it (the
>>"baseband") is binary only and based on unknown sources.
>>
>>
>>Bjørn
>
> Thanks for sharing the link Bjørn!
> This is concerning me :
> https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Mickey-Shkatov-Jesse-Michael-Scared-poopless-LTE-and-your-laptop-UPDATED.pdf
>
> So does that mean that there is nothing to do from the host
> perspective to "secure" the system?
>
> If an internal Linux is run inside the chip and that this Linux can be
> rooted or externally executed some commands...
>
> Does that mean that if the chip/baseband is compromised then the whole
> host system is as well? No way to protect the host against this?

No, it's not quite that bad.  The only connection between the modem and
host system is by USB.  So if you "just" protect USB on the host, then
you are safe against attacks on the host.

Note that the modem can impersonate any USB device, so you it's not
sufficient to protect against attacks via the modem drivers.

> I am very interested to heard about any info as now I am in doubt to
> buy a laptop with a chip like this included...(if I spend time to
> enforce my system and one little piece destroy all the rest :-(

The good thing about laptop modems is that they still are plug-in
modules.  So you can always unplug them if you want to.



Bjørn