▲ 185 ▼ Undocumented backdoor found in Bluetooth chip used by a billion devices (www.bleepingcomputer.com) submitted 2 years ago* by neme@lemm.ee to c/cybersecurity@sh.itjust.works 30 comments fedilink hide all child comments
[–] IceFoxX@lemm.ee 45 points 2 years ago (4 children) So i think 29 undocumented commands are far too many for a mistake.. permalink fedilink source hideshow 8 child comments replies: [–] grue@lemmy.world 44 points 2 years ago* (2 children) Maybe, maybe not. Keep in mind that opcodes are the lowest-level part of the programming stack. They're literally just integers transmitted on the system bus. So if you've got, for example, 35 operations that you're actually trying to implement, you need 2^n^ ≥ 35 or n = 6 signal lines in your bus to transmit it. But since 2^6^ = 64, that means it's possible to put another 29 values on that 6-bit bus, with completely undefined behavior unless you go out of your way to handle them in the instruction decoder (increasing the size and therefore cost of your silicon, which is very undesirable in an embedded chip that sells for less than $1). It is not at all implausible for one of those undefined instructions to just happen to do something that an attacker would find useful, by sheer coincidence. permalink fedilink source parent hideshow 4 child comments replies: [–] olafurp@lemmy.world 4 points 2 years ago (1 child) Couldn't they just designate them as no-op codes? permalink fedilink source parent hideshow 2 child comments replies: [–] dave@feddit.uk 15 points 2 years ago Yes, but to do that they have to be decoded and handled. That's basically what the commenter above was saying. The original 6502 had many undocumented opcodes for this reason, and developers stated exploiting them for various reasons. The CMOS 65C02 redefined them to no-op. This has been going on a long time. permalink fedilink source parent [+] sunzu2@thebrainbin.org 0 points 2 years ago* (last edited 11 months ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] grue@lemmy.world 29 points 2 years ago Well, yeah. That's because it's inherent to how CPUs work. Every single CPU on the planet has undefined opcodes, unless the number of defined ones just happens to be a power of two. permalink fedilink source parent [–] higgsboson@dubvee.org 10 points 2 years ago* (1 child) Probably why Android and apps are constantly asking me to turn on Bluetooth when I dont want or need it. Not that this chip is in my phone, but it begins to seem like a pattern. permalink fedilink source parent hideshow 2 child comments replies: [–] IceFoxX@lemm.ee 2 points 2 years ago (1 child) Maybe bouncer is something for you permalink fedilink source parent hideshow 2 child comments replies: [–] higgsboson@dubvee.org 2 points 2 years ago* (1 child) Looks like bouncer is no longer available. https://play.google.com/store/apps/details?id=com.samruston.permission I do have Graphene which can do something similar. or maybe its an Android 15 feature? Per app, there is a toggle to revoke an app's permission after an unspecified(?) period of time. "Manage app if unused" permalink fedilink source parent hideshow 2 child comments replies: [–] IceFoxX@lemm.ee 2 points 2 years ago* (last edited 2 years ago) You lucky nexus owner. I wish GrapheneOS could be flashed on more smartphones. Yeah so that definitely reads like the feature that bouncer provides and if that's anchored at the system level the Graphene solution is guaranteed to be better too. Either way, it offers a lot of good functions that you can't simply make available on another Android via root. Edit: I also forgot that Bouncer needs root to be fully functional. permalink fedilink source parent [–] adarza@lemmy.ca 7 points 2 years ago i gather that's why they're referring to the discovery as a 'backdoor' permalink fedilink source parent [+] sunzu2@thebrainbin.org -3 points 2 years ago* (last edited 11 months ago) (2 children) [deleted] permalink fedilink source parent hideshow 4 child comments replies: [–] osaerisxero@kbin.melroy.org 5 points 2 years ago (1 child) For android, location services doesn't work properly without Bluetooth on, so that could be related permalink fedilink source parent hideshow 2 child comments replies: [+] sunzu2@thebrainbin.org 2 points 2 years ago* (last edited 11 months ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] osaerisxero@kbin.melroy.org 3 points 2 years ago Iirc, precise location queries don't return values without the BT radio enabled. Works the other way too, the app needs location permission to discover bt devices in proximity and location must be enabled at the system level. permalink fedilink source parent [–] IceFoxX@lemm.ee -1 points 2 years ago step 1 Tracking and profilling step 2 selling data step 3 profit Android and ios use completely different methods. For example, they listen to frequencies that are inaudible to us and, for example, TV advertising plays an inaudible sound as a trigger for Android/IOs in addition to the audible sound. To impose targeted advertising in order to allocate devices even without a network, etc. They wouldn't actually need backdoors as they get more than enough information as it is. But I don't want to imply that I don't expect backdoors there, because this has been proven in any case and often enough. permalink fedilink source parent
[–] grue@lemmy.world 44 points 2 years ago* (2 children) Maybe, maybe not. Keep in mind that opcodes are the lowest-level part of the programming stack. They're literally just integers transmitted on the system bus. So if you've got, for example, 35 operations that you're actually trying to implement, you need 2^n^ ≥ 35 or n = 6 signal lines in your bus to transmit it. But since 2^6^ = 64, that means it's possible to put another 29 values on that 6-bit bus, with completely undefined behavior unless you go out of your way to handle them in the instruction decoder (increasing the size and therefore cost of your silicon, which is very undesirable in an embedded chip that sells for less than $1). It is not at all implausible for one of those undefined instructions to just happen to do something that an attacker would find useful, by sheer coincidence. permalink fedilink source parent hideshow 4 child comments replies: [–] olafurp@lemmy.world 4 points 2 years ago (1 child) Couldn't they just designate them as no-op codes? permalink fedilink source parent hideshow 2 child comments replies: [–] dave@feddit.uk 15 points 2 years ago Yes, but to do that they have to be decoded and handled. That's basically what the commenter above was saying. The original 6502 had many undocumented opcodes for this reason, and developers stated exploiting them for various reasons. The CMOS 65C02 redefined them to no-op. This has been going on a long time. permalink fedilink source parent [+] sunzu2@thebrainbin.org 0 points 2 years ago* (last edited 11 months ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] grue@lemmy.world 29 points 2 years ago Well, yeah. That's because it's inherent to how CPUs work. Every single CPU on the planet has undefined opcodes, unless the number of defined ones just happens to be a power of two. permalink fedilink source parent
[–] olafurp@lemmy.world 4 points 2 years ago (1 child) Couldn't they just designate them as no-op codes? permalink fedilink source parent hideshow 2 child comments replies: [–] dave@feddit.uk 15 points 2 years ago Yes, but to do that they have to be decoded and handled. That's basically what the commenter above was saying. The original 6502 had many undocumented opcodes for this reason, and developers stated exploiting them for various reasons. The CMOS 65C02 redefined them to no-op. This has been going on a long time. permalink fedilink source parent
[–] dave@feddit.uk 15 points 2 years ago Yes, but to do that they have to be decoded and handled. That's basically what the commenter above was saying. The original 6502 had many undocumented opcodes for this reason, and developers stated exploiting them for various reasons. The CMOS 65C02 redefined them to no-op. This has been going on a long time. permalink fedilink source parent
[+] sunzu2@thebrainbin.org 0 points 2 years ago* (last edited 11 months ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] grue@lemmy.world 29 points 2 years ago Well, yeah. That's because it's inherent to how CPUs work. Every single CPU on the planet has undefined opcodes, unless the number of defined ones just happens to be a power of two. permalink fedilink source parent
[–] grue@lemmy.world 29 points 2 years ago Well, yeah. That's because it's inherent to how CPUs work. Every single CPU on the planet has undefined opcodes, unless the number of defined ones just happens to be a power of two. permalink fedilink source parent
[–] higgsboson@dubvee.org 10 points 2 years ago* (1 child) Probably why Android and apps are constantly asking me to turn on Bluetooth when I dont want or need it. Not that this chip is in my phone, but it begins to seem like a pattern. permalink fedilink source parent hideshow 2 child comments replies: [–] IceFoxX@lemm.ee 2 points 2 years ago (1 child) Maybe bouncer is something for you permalink fedilink source parent hideshow 2 child comments replies: [–] higgsboson@dubvee.org 2 points 2 years ago* (1 child) Looks like bouncer is no longer available. https://play.google.com/store/apps/details?id=com.samruston.permission I do have Graphene which can do something similar. or maybe its an Android 15 feature? Per app, there is a toggle to revoke an app's permission after an unspecified(?) period of time. "Manage app if unused" permalink fedilink source parent hideshow 2 child comments replies: [–] IceFoxX@lemm.ee 2 points 2 years ago* (last edited 2 years ago) You lucky nexus owner. I wish GrapheneOS could be flashed on more smartphones. Yeah so that definitely reads like the feature that bouncer provides and if that's anchored at the system level the Graphene solution is guaranteed to be better too. Either way, it offers a lot of good functions that you can't simply make available on another Android via root. Edit: I also forgot that Bouncer needs root to be fully functional. permalink fedilink source parent
[–] IceFoxX@lemm.ee 2 points 2 years ago (1 child) Maybe bouncer is something for you permalink fedilink source parent hideshow 2 child comments replies: [–] higgsboson@dubvee.org 2 points 2 years ago* (1 child) Looks like bouncer is no longer available. https://play.google.com/store/apps/details?id=com.samruston.permission I do have Graphene which can do something similar. or maybe its an Android 15 feature? Per app, there is a toggle to revoke an app's permission after an unspecified(?) period of time. "Manage app if unused" permalink fedilink source parent hideshow 2 child comments replies: [–] IceFoxX@lemm.ee 2 points 2 years ago* (last edited 2 years ago) You lucky nexus owner. I wish GrapheneOS could be flashed on more smartphones. Yeah so that definitely reads like the feature that bouncer provides and if that's anchored at the system level the Graphene solution is guaranteed to be better too. Either way, it offers a lot of good functions that you can't simply make available on another Android via root. Edit: I also forgot that Bouncer needs root to be fully functional. permalink fedilink source parent
[–] higgsboson@dubvee.org 2 points 2 years ago* (1 child) Looks like bouncer is no longer available. https://play.google.com/store/apps/details?id=com.samruston.permission I do have Graphene which can do something similar. or maybe its an Android 15 feature? Per app, there is a toggle to revoke an app's permission after an unspecified(?) period of time. "Manage app if unused" permalink fedilink source parent hideshow 2 child comments replies: [–] IceFoxX@lemm.ee 2 points 2 years ago* (last edited 2 years ago) You lucky nexus owner. I wish GrapheneOS could be flashed on more smartphones. Yeah so that definitely reads like the feature that bouncer provides and if that's anchored at the system level the Graphene solution is guaranteed to be better too. Either way, it offers a lot of good functions that you can't simply make available on another Android via root. Edit: I also forgot that Bouncer needs root to be fully functional. permalink fedilink source parent
[–] IceFoxX@lemm.ee 2 points 2 years ago* (last edited 2 years ago) You lucky nexus owner. I wish GrapheneOS could be flashed on more smartphones. Yeah so that definitely reads like the feature that bouncer provides and if that's anchored at the system level the Graphene solution is guaranteed to be better too. Either way, it offers a lot of good functions that you can't simply make available on another Android via root. Edit: I also forgot that Bouncer needs root to be fully functional. permalink fedilink source parent
[–] adarza@lemmy.ca 7 points 2 years ago i gather that's why they're referring to the discovery as a 'backdoor' permalink fedilink source parent
[+] sunzu2@thebrainbin.org -3 points 2 years ago* (last edited 11 months ago) (2 children) [deleted] permalink fedilink source parent hideshow 4 child comments replies: [–] osaerisxero@kbin.melroy.org 5 points 2 years ago (1 child) For android, location services doesn't work properly without Bluetooth on, so that could be related permalink fedilink source parent hideshow 2 child comments replies: [+] sunzu2@thebrainbin.org 2 points 2 years ago* (last edited 11 months ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] osaerisxero@kbin.melroy.org 3 points 2 years ago Iirc, precise location queries don't return values without the BT radio enabled. Works the other way too, the app needs location permission to discover bt devices in proximity and location must be enabled at the system level. permalink fedilink source parent [–] IceFoxX@lemm.ee -1 points 2 years ago step 1 Tracking and profilling step 2 selling data step 3 profit Android and ios use completely different methods. For example, they listen to frequencies that are inaudible to us and, for example, TV advertising plays an inaudible sound as a trigger for Android/IOs in addition to the audible sound. To impose targeted advertising in order to allocate devices even without a network, etc. They wouldn't actually need backdoors as they get more than enough information as it is. But I don't want to imply that I don't expect backdoors there, because this has been proven in any case and often enough. permalink fedilink source parent
[–] osaerisxero@kbin.melroy.org 5 points 2 years ago (1 child) For android, location services doesn't work properly without Bluetooth on, so that could be related permalink fedilink source parent hideshow 2 child comments replies: [+] sunzu2@thebrainbin.org 2 points 2 years ago* (last edited 11 months ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] osaerisxero@kbin.melroy.org 3 points 2 years ago Iirc, precise location queries don't return values without the BT radio enabled. Works the other way too, the app needs location permission to discover bt devices in proximity and location must be enabled at the system level. permalink fedilink source parent
[+] sunzu2@thebrainbin.org 2 points 2 years ago* (last edited 11 months ago) (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] osaerisxero@kbin.melroy.org 3 points 2 years ago Iirc, precise location queries don't return values without the BT radio enabled. Works the other way too, the app needs location permission to discover bt devices in proximity and location must be enabled at the system level. permalink fedilink source parent
[–] osaerisxero@kbin.melroy.org 3 points 2 years ago Iirc, precise location queries don't return values without the BT radio enabled. Works the other way too, the app needs location permission to discover bt devices in proximity and location must be enabled at the system level. permalink fedilink source parent
[–] IceFoxX@lemm.ee -1 points 2 years ago step 1 Tracking and profilling step 2 selling data step 3 profit Android and ios use completely different methods. For example, they listen to frequencies that are inaudible to us and, for example, TV advertising plays an inaudible sound as a trigger for Android/IOs in addition to the audible sound. To impose targeted advertising in order to allocate devices even without a network, etc. They wouldn't actually need backdoors as they get more than enough information as it is. But I don't want to imply that I don't expect backdoors there, because this has been proven in any case and often enough. permalink fedilink source parent