Qualcomm Snapdragon X7 LTE-A

[Benoît]

On Mon, Jan 09, 2017 at 09:29:29AM +0100, Bjørn Mork wrote:
>Benoît <benoit at neviani.fr> writes:
>
>>>I don't know if you already saw this:
>>>http://laforge.gnumonks.org/blog/20161230-33c3-presentation/
>>>
>>>The situation is similar for any LTE modem.  Which means that there
>>>isn't really much the host drivers can do to secure the system. The
>>>modems are powerful systems by themselves, running a big binary firmware
>>>blob you have no control over.  It doesn't really matter if it is based
>>>on lots of GPL software either. The important central piece of it (the
>>>"baseband") is binary only and based on unknown sources.
>>>
>>>
>>>Bjørn
>>
>> Thanks for sharing the link Bjørn!
>> This is concerning me :
>> https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Mickey-Shkatov-Jesse-Michael-Scared-poopless-LTE-and-your-laptop-UPDATED.pdf
>>
>> So does that mean that there is nothing to do from the host
>> perspective to "secure" the system?
>>
>> If an internal Linux is run inside the chip and that this Linux can be
>> rooted or externally executed some commands...
>>
>> Does that mean that if the chip/baseband is compromised then the whole
>> host system is as well? No way to protect the host against this?
>
>No, it's not quite that bad.  The only connection between the modem and
>host system is by USB.  So if you "just" protect USB on the host, then
>you are safe against attacks on the host.

Thanks for that, any idea how to protect USB on the real life ?
I am thinking about it but I don't think about a tool for that

>Note that the modem can impersonate any USB device, so you it's not
>sufficient to protect against attacks via the modem drivers.
>
>> I am very interested to heard about any info as now I am in doubt to
>> buy a laptop with a chip like this included...(if I spend time to
>> enforce my system and one little piece destroy all the rest :-(
>
>The good thing about laptop modems is that they still are plug-in
>modules.  So you can always unplug them if you want to.

That's true but I would not open the chassis to disconnect it everytime 
I want to disconnect it..it is not doable as I would spend 30 min 
everytime I want to connect / disconnect it.. I am more thinking about a 
solution to disable USB or protect it (like the point above)
>
>
>
>Bjørn

-- 
Benoit