A new chapter in "C was a mistake", courtesy of Samsung - Page 1
Forum section: electronics / general

author: Marco
author_rank: Super Contributor
timestamp: March 17, 2023, 05:59:43 pm
content: https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.htmlSamsung was silly enough to leave its mobile phone baseband machine code out in the open ... and don't you know it, an ancient massive closed source C codebase with shared memory access to everything in mobile phones has buffer overflows as far as the eye can see. Who could have predicted that?A little more obscurity and not letting the machine code escape into the wild (for non state actor level adversaries at least) would have helped of course. All programmers waking up a little sooner and realizing how utterly fucked software was the moment buffer overflows entered the field would have helped more.

author: thm_w
author_rank: Super Contributor
timestamp: March 17, 2023, 09:15:06 pm
content: Yeah thats crazy that its even a possibility no matter how badly the code is written:Quote

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: March 17, 2023, 10:36:24 pm
content: I remember when the 'open' phones started showing up and the total push-back they received from existing phone companies to release or even licence anything.I suspected then that it was all un-audited garbage.

author: tom66
author_rank: Super Contributor
timestamp: March 17, 2023, 10:54:30 pm
content: Been around for a while.

author: tszaboo
author_rank: Super Contributor
timestamp: March 17, 2023, 11:17:16 pm
content: Quote from: thm_w on March 17, 2023, 09:15:06 pmAlmost feels like it was on purpose...

author: rdl
author_rank: Super Contributor
timestamp: March 18, 2023, 02:32:11 am
content: QuoteSo, stop using your phone as a ... phone?

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 18, 2023, 02:41:25 am
content: What exactly could be done by "remotely compromising" a phone?Compromising it in what way? What are the risks for the end user?

author: ejeffrey
author_rank: Super Contributor
timestamp: March 18, 2023, 02:43:46 am
content: Probably crypto mining, ddos botnets, and ransomware. Not good.

author: Marco
author_rank: Super Contributor
timestamp: March 18, 2023, 05:31:26 am
content: Quote from: SiliconWizard on March 18, 2023, 02:41:25 amCheck if they have any crypto apps and clean them out.

author: tom66
author_rank: Super Contributor
timestamp: March 18, 2023, 10:40:15 am
content: Quote from: SiliconWizard on March 18, 2023, 02:41:25 amIf you can crash the baseband by buffer overflow, you can arbitrary read and write any memory on the processor. The baseband is usually not restricted to the region of memory it can work in.That means you can essentially compromise the phone, to the point where SMS messages (as others have pointed out) could be redirected, or you could break the security around payments and banking apps, or steal personal data.

author: mendip_discovery
author_rank: Super Contributor
timestamp: March 18, 2023, 11:10:22 am
content: I have always had concerns about 2FA as it just turns the phone into the next point to attack.Criminals are similar to a Virus, the most successful ones are good at evolving.

author: tom66
author_rank: Super Contributor
timestamp: March 18, 2023, 01:02:43 pm
content: 2FA in general is a good idea. 2FA by SMS is not a good idea (except as an enhancement to 1FA, but only just.)I've noticed a fair few banks are moving away from it and using additional means of authentication, e.g. touch ID built into the phone.

author: shapirus
author_rank: Super Contributor
timestamp: March 18, 2023, 01:11:38 pm
content: So, someone chops off his finger with an axe. Terrible!Conclusion? Axes aren't safe.Solution? Let's begin making axes from silicone instead of steel so nobody can chop their fingers off anymore.

author: mendip_discovery
author_rank: Super Contributor
timestamp: March 18, 2023, 01:55:01 pm
content: Quote from: tom66 on March 18, 2023, 01:02:43 pm2FA is good but it is in no way as strong as people are led to believe. I know an engineer involved in SIM card level stuff and I nodded as he went off on a RANT about the insecurities SMS 2FA came up.The issue is if they make the security such a faff then people will not use it. I don't like using the SMS system of 2FA just because I don't like giving every website my mobile number, which can be used to link my identity between sites and if one site leaks then the criminals now have my number to bombard with scam texts. I already get annoyed when I have to go downstairs and find the landline just so I can get a code to log into a website.There will always be avenues of attack, either it being Social, Software or physical. Let us just hope we don't go back to physical being the only option.

author: Marco
author_rank: Super Contributor
timestamp: March 18, 2023, 08:51:17 pm
content: Quote from: shapirus on March 18, 2023, 01:11:38 pmI've probably said it before, but I'll say it again. Languages like Rust and Ada Spark are more like sawstops on table saws. For some types of wood you have to turn it off, when you do it's a plain old finger eating tablesaw.Though in C's case it's an American tablesaw, even the guard removed from the start and never put back.Quote from: mendip_discovery on March 18, 2023, 01:55:01 pmThe future will probably be secure enclaves + pin/bio, with only presence detection after an initial authentication for "common" logins. With a master password to copy your logins to a new secure enclave.Except at the most paranoid levels, which will stick with physical U2F + pin/bio.

author: shapirus
author_rank: Super Contributor
timestamp: March 18, 2023, 09:19:14 pm
content: Quote from: Marco on March 18, 2023, 08:51:17 pmI have to agree, sort of. These days, C is a tool for either artists, enthusiasts or top-skilled craftsmen. But when you need a tool with which a hundred of average Joes can create a smartphone application (which can later be supported by another hundred of those who replace the first), then something with builtin foolproofing is a much better choice, even if at the expense of losing control of the low-level stuff.In other words, C itself is not a mistake. But choosing it as a tool can be.

author: eti
author_rank: Super Contributor
timestamp: March 19, 2023, 02:04:33 am
content: Drop some into ChatGPT and see what it makes of it, haha!

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 19, 2023, 03:30:05 am
content: Quote from: eti on March 19, 2023, 02:04:33 amAbsolutely.