Conversation

Daniel Micay
@DanielMicay
Remember this thread? twitter.com/DanielMicay/st This exploit chain is a great example of what I was talking about there: defcon.org/html/defcon-27 blade.tencent.com/en/advisories/ Compare this to
@laginimaineb
's early research exploiting Broadcom Wi-Fi where the firmware had full control.
Quote Tweet
Daniel Micay
@DanielMicay
How does GrapheneOS defend against attacks on the cellular baseband, Wi-Fi baseband or other firmware / hardware? reddit.com/r/GrapheneOS/c By carefully choosing hardware targets since the OS is only part of what matters. OS mostly just needs to avoid screwing up IOMMU isolation.
Show this thread
Twitter Web App
9
Retweets
26
Likes
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@laginimaineb
They needed an exploit to compromise the Wi-Fi firmware, followed by a privilege escalation exploit to gain full control over the modem ("WLAN firmware is integrated into the Modem subsystem as an isolated userspace process") and then a kernel exploit to get control of the OS.
1
2
Daniel Micay
@DanielMicay
Additionally, take note of "multiple mitigations on Qualcomm baseband, including DEP, stack protection, heap cookie, system call constraint, etc.". This is not the case for most competing basebands. You get this isolation and hardening with a Qualcomm SoC, not so much elsewhere.
2
11