[Xperia Z1 Original Android Development] threader:
Qualcomm QSEE and Radio/Modem vulnerability. Totally broken. How do we "fix" it?

Hola.

First and worst problem, the Radio/Modem firmware is vulnerable to remote exploitation. Could we use the Radio F/W for the Z2 or any other currently supported device in the Z series and apply it to the Z1? Or do we just rip the sim card and never ever ever use the Radio/Modem again? ( And disable the Radio/Modem in kernel , and cut the traces on the logic board, and wrap the device in tin foil, and leave it in a led box, buried under 4 feet of concrete. )

http://arstechnica.com/security/201...nes-and-networks-at-risk-of-complete-takeover

Next, QSEE, https://bits-please.blogspot.no/2016/05/qsee-privilege-escalation-vulnerability.html?m=1

A chip update might be needed as the author suggested, if a magic kernel update can't mitigate this, I'd do the required changes in the my backports hobby projects of course, but did not touch this part last time as I've not enabled encryption myself, I do a lot of kernel sorcery on the device and gazillions of reboots, It's just not practical. I'll "officially" "forum launch" the backports kernel in the coming days as I have a few goodies lined up. https://github.com/threader/kernel-copyleft-14.6.A.1.xxx-backports/ - We could perhaps work around this by levering other encryption schemes native to the Linux kernel and just implement a light boot image and Kexec boot another kernel once the password is entered and such. Compiling a kernel w/o QSEE at all, and hammer a nail tru the chip :D .

But as this stands, the device isn't safe to use on the cell networks, as far as i know, the entire Qcom based and thereby the Z series is affected, along with every other Qcom device, past and current ... One can't risk getting owned without any knowledge and no working counter measures like this these days. But given the extent of this fault/vulnerability, it might be time to ditch the cellphone part of the cellphone all together, there simply is no such thing as security and privacy in this system, this is just one of several very serious faults and shortcomings of the worlds cellphone network system. Add this to the list after the for instance the SS7 system design malfunction which allows re-direction of calls without the knowledge of the subscriber, just like having a second sim card, and I can't really understand why any security concious person with a need for security would even considers walking around with these mobile tracking and information leaking devices... The computer in your pocket is the way in to all your personal information, you carry it around, connect to your local home network, your work network, your friends network, whatever, you risk infecting all these positions with malicious sorcery... Not good.

http://www.theregister.co.uk/2016/04/18/ss7_60_minutes_iphone/

http://www.cbsnews.com/news/60-minutes-hacking-your-phone/

https://www.youtube.com/results?search_query=Karsten Nohl caos

This is a real shame, really, I like Qcom and their SoCks. . . ... It's where my main familiarity lies with ARM and SoC's.. I feel like a leprechaun working with say, Exynox sources... Though their devices are sound of course, it's just a matter of familiarity of the device, code and community.

Cheers