News from the embedded world

[God Ginrai]

Wouldn't it be relatively easy to find out which processes are using the UTMS module and kill them?

It should be, just "lsof | grep /dev/ttyWhateverTheModemIs"But if you're already compromised then it's possible they've managed to replace lsof (or even libc) so that it doesn't show the malicious process. I'm pretty certain that that'll never happen though.

Which is why one shouldn't just run random binaries off of the web (regardless of the OS) without extreme caution, which should go without saying.
Would it also be a reasonable to assume that the vast majority of Linux-compatible malware/rootkits/etc are built for x86/x86_64 and not for ARM (which would actually require a separate builds, especially the ones that actually replace many system tools like ls, ps, kill, lsof, etc? Or is it possible that ARM based Pandora/Pyra systems could be susceptible to malware designed for Android, which is an ARM based Linux system?

You're misunderstanding. They are talking about a backdoor existing in the 3G module. If they get in through a backdoor in a 3G module, they can then replace your basic utilities. He wasn't talking about getting compromised through your own unsafe practices.

-God Ginrai

 

[szr]

Optional means the module is expensive (the actual hardware), so if you don't pay for it you don't get it.


I don't think we really need such a warning light. If you're paranoid about it, don't get the module.

If you could cut the module in half and just give me the GPS part of the die, I wouldn't have to choose. I just don't want my GPS to come at the cost of the Pyra having an additional avenue of attack above and beyond the Pandora.

As a Canadian, wireless data is too expensive for me to use. (Though, if it can be done with an indicator LED, having the option in case the situation improves is nice too.)

Couldn't you also just remove the SIM card? Wouldn't not having a SIM card effectively make the module GPS only, though?

 

[ssokolow]

Optional means the module is expensive (the actual hardware), so if you don't pay for it you don't get it.


I don't think we really need such a warning light. If you're paranoid about it, don't get the module.

If you could cut the module in half and just give me the GPS part of the die, I wouldn't have to choose. I just don't want my GPS to come at the cost of the Pyra having an additional avenue of attack above and beyond the Pandora.

As a Canadian, wireless data is too expensive for me to use. (Though, if it can be done with an indicator LED, having the option in case the situation improves is nice too.)

Couldn't you also just remove the SIM card? Wouldn't not having a SIM card effectively make the module GPS only, though?

e911 laws here in Canada require the chip to be capable of making calls to emergency services and performing geolocation for 911 dispatchers without a SIM installed. Geolocation is remotely triggered. That means that a powered but SIM-less baseband processor can still be abused by the authorities.

(And given how I've seen an old lady labelled as a domestic terrorist for participating in the peaceful protest of an attempt to build a dump site on an aquifer so close to the surface that it's practically swampland, I don't trust that.)

 

[szr]

Optional means the module is expensive (the actual hardware), so if you don't pay for it you don't get it.


I don't think we really need such a warning light. If you're paranoid about it, don't get the module.

If you could cut the module in half and just give me the GPS part of the die, I wouldn't have to choose. I just don't want my GPS to come at the cost of the Pyra having an additional avenue of attack above and beyond the Pandora.

As a Canadian, wireless data is too expensive for me to use. (Though, if it can be done with an indicator LED, having the option in case the situation improves is nice too.)

Couldn't you also just remove the SIM card? Wouldn't not having a SIM card effectively make the module GPS only, though?

e911 laws here in Canada require the chip to be capable of making calls to emergency services and performing geolocation for 911 dispatchers without a SIM installed. Geolocation is remotely triggered. That means that a powered but SIM-less baseband processor can still be abused by the authorities.

(And given how I've seen an old lady labelled as a domestic terrorist for participating in the peaceful protest of an attempt to build a dump site on an aquifer so close to the surface that it's practically swampland, I don't trust that.)

How does that work exactly, though? I was under the impression that a SIM card was needed in order to determine what carrier to connect to. With a SIM, how would it be able to know what to connect to? I'm not very familiar with Candian cellular systems, but when I had a left over GSM phone in the past that I no longer used, it still needed a SIM to be able to make emergency calls (through the carrier it had been used on previous.) Without the SIM it was useless.

 

[ssokolow]

Optional means the module is expensive (the actual hardware), so if you don't pay for it you don't get it.


I don't think we really need such a warning light. If you're paranoid about it, don't get the module.

If you could cut the module in half and just give me the GPS part of the die, I wouldn't have to choose. I just don't want my GPS to come at the cost of the Pyra having an additional avenue of attack above and beyond the Pandora.

As a Canadian, wireless data is too expensive for me to use. (Though, if it can be done with an indicator LED, having the option in case the situation improves is nice too.)

Couldn't you also just remove the SIM card? Wouldn't not having a SIM card effectively make the module GPS only, though?

e911 laws here in Canada require the chip to be capable of making calls to emergency services and performing geolocation for 911 dispatchers without a SIM installed. Geolocation is remotely triggered. That means that a powered but SIM-less baseband processor can still be abused by the authorities.

(And given how I've seen an old lady labelled as a domestic terrorist for participating in the peaceful protest of an attempt to build a dump site on an aquifer so close to the surface that it's practically swampland, I don't trust that.)

How does that work exactly, though? I was under the impression that a SIM card was needed in order to determine what carrier to connect to. With a SIM, how would it be able to know what to connect to? I'm not very familiar with Candian cellular systems, but when I had a left over GSM phone in the past that I no longer used, it still needed a SIM to be able to make emergency calls (through the carrier it had been used on previous.) Without the SIM it was useless.

I don't own a cellphone so I never looked into it further. I'm guessing that a compliant phone has some mechanism to make emergency calls on whichever compatible network it finds a good signal for first.

 

[slaeshjag]

^ That's pretty much how it works, yes. On most phone, you can even (at least you used to be able to) override the automatic network selection and connect to a network you only get emergency service on.

 

[Granitehead]

They are talking about a backdoor existing in the 3G module. If they get in through a backdoor in a 3G module, they can then replace your basic utilities. He wasn't talking about getting compromised through your own unsafe practices.

They can't easily get into your system through a backdoor in the 3G chip. Drivers should be FOSS. Maybe it would be able to compromise a download of a binary happening through it, but you are supposed to check MD5 (or better) hashes anyway after download.

 

[God Ginrai]

They are talking about a backdoor existing in the 3G module. If they get in through a backdoor in a 3G module, they can then replace your basic utilities. He wasn't talking about getting compromised through your own unsafe practices.

They can't easily get into your system through a backdoor in the 3G chip. Drivers should be FOSS. Maybe it would be able to compromise a download of a binary happening through it, but you are supposed to check MD5 (or better) hashes anyway after download.

All my statement did was correct a misunderstanding about what others were talking about. If you don't believe they are correct, address your comments to them.

-God Ginrai

 

[levi]

@szr Most phones will allow you to enter an emergency number even though it shows the phone locked when you turn it on. GPS location data is a relatively new innovation that I didn't think had come into force in many places though.


Note you really shouldn't test out entering an emergency number, it's probably illegal in some countries and it's definitely antisocial. Many operators have actually blocked this feature as it was being misused too much.

 

[ZetaNeta]

Wouldn't it be relatively easy to find out which processes are using the UTMS module and kill them?

It should be, just "lsof | grep /dev/ttyWhateverTheModemIs"
But if you're already compromised then it's possible they've managed to replace lsof (or even libc) so that it doesn't show the malicious process. I'm pretty certain that that'll never happen though.

Which is why one shouldn't just run random binaries off of the web (regardless of the OS) without extreme caution, which should go without saying.

Would it also be a reasonable to assume that the vast majority of Linux-compatible malware/rootkits/etc are built for x86/x86_64 and not for ARM (which would actually require a separate builds, especially the ones that actually replace many system tools like ls, ps, kill, lsof, etc? Or is it possible that ARM based Pandora/Pyra systems could be susceptible to malware designed for Android, which is an ARM based Linux system?

Show me a "proper" distro without a GCC by default, and you shall get a reward.


But ok, lets assume you dont like this "compiling", and removed GCC for the sake of security:


If you are not just infected but "cracked" on purpose, hacker will not care if you are running you linux on a toaster, as long as he got a toolchain for it.


If you got wget, curl, emacs, libwww-perl, netcat, bash (2.04-devel and up) or just any other utility to download stuff, malware may use it, but a hacker will figure it out, and use it to obtain his recompiled copy of GCC, or even the rootkit it self.


Some rootkits are only affect a special arch, and most of the time, a special build of a kernel. But most i saw, dont care what arch it is as long as it implements all the functions rootkit needs to properly function.


Android is another OS (I disagree, but most people think its a OS). As RMS said: "Its GNU/Linux, not just linux.", and you should understand that the difference between Android/Linux and GNU/Linux is almost complete.


A malware made for my iPaq 2210 (ARMv5) can easily work on my entire devboard park (all at least ARMv7).


A malware made for my Zyxel Keenetic can infect my NETGEAR DG834PN (If they will find space in the NAND ;3)


But unlikely those will work on Android, as Android is another OS.

 

[ZetaNeta]

Wouldn't it be relatively easy to find out which processes are using the UTMS module and kill them?

It should be, just "lsof | grep /dev/ttyWhateverTheModemIs"But if you're already compromised then it's possible they've managed to replace lsof (or even libc) so that it doesn't show the malicious process. I'm pretty certain that that'll never happen though.

Which is why one shouldn't just run random binaries off of the web (regardless of the OS) without extreme caution, which should go without saying.
Would it also be a reasonable to assume that the vast majority of Linux-compatible malware/rootkits/etc are built for x86/x86_64 and not for ARM (which would actually require a separate builds, especially the ones that actually replace many system tools like ls, ps, kill, lsof, etc? Or is it possible that ARM based Pandora/Pyra systems could be susceptible to malware designed for Android, which is an ARM based Linux system?

You're misunderstanding. They are talking about a backdoor existing in the 3G module. If they get in through a backdoor in a 3G module, they can then replace your basic utilities. He wasn't talking about getting compromised through your own unsafe practices.

-God Ginrai

* RMS came* RMS slapped "God Ginrai"

* RMS left

* God Ginrai thinks again

Again, if you didnt get that slap: WHY THE *UCK SHOULD 3G MODULE HAVE ANYTHING TO DO WITH ANYTHING ON THE MAIN SYSTEM?

Optional means the module is expensive (the actual hardware), so if you don't pay for it you don't get it.

I don't think we really need such a warning light. If you're paranoid about it, don't get the module.

If you could cut the module in half and just give me the GPS part of the die, I wouldn't have to choose. I just don't want my GPS to come at the cost of the Pyra having an additional avenue of attack above and beyond the Pandora.

As a Canadian, wireless data is too expensive for me to use. (Though, if it can be done with an indicator LED, having the option in case the situation improves is nice too.)

Couldn't you also just remove the SIM card? Wouldn't not having a SIM card effectively make the module GPS only, though?

e911 laws here in Canada require the chip to be capable of making calls to emergency services and performing geolocation for 911 dispatchers without a SIM installed. Geolocation is remotely triggered. That means that a powered but SIM-less baseband processor can still be abused by the authorities.

(And given how I've seen an old lady labelled as a domestic terrorist for participating in the peaceful protest of an attempt to build a dump site on an aquifer so close to the surface that it's practically swampland, I don't trust that.)

How does that work exactly, though? I was under the impression that a SIM card was needed in order to determine what carrier to connect to. With a SIM, how would it be able to know what to connect to? I'm not very familiar with Candian cellular systems, but when I had a left over GSM phone in the past that I no longer used, it still needed a SIM to be able to make emergency calls (through the carrier it had been used on previous.) Without the SIM it was useless.

No ideas about the Canada, but here, in Russia, each carrier is obliged to provide "emergency only calls" service to anyone willing it.

@szr Most phones will allow you to enter an emergency number even though it shows the phone locked when you turn it on. GPS location data is a relatively new innovation that I didn't think had come into force in many places though.

Note you really shouldn't test out entering an emergency number, it's probably illegal in some countries and it's definitely antisocial. Many operators have actually blocked this feature as it was being misused too much.

Towers may anyway locate you real well, and thats what is used in Russia.
You dont need to call there without a reason even if you got a simcard. Even if its a wired phone, still dont.

I cant imagine a situation when you got a no-simcard phone, and need emergency. From another side, there are alot of people "without a dual-sim phone, but in need of one", which may someday check it out.

Sometimes you just got no money on the balance, and nothing prevents you carrier to block the emergency by a technical flaw (happened at the time you still could get unlimited inet by just not logging out of the session).

Sometimes, you are forced behind the sofa by the terrorists, and all you find under it is you old nokia without a simcard.... all my "old nokias" are in similar places, and probably still have charge

Someone may steal you simcard. You may have you simcard being changed by a carrier for any reason. You could have broken it, and worry so much that you need a doctor.

But blocking "nosim emergency" is illegal in Russia. The abuse is something to be dealed with by the emergency it self

 

[God Ginrai]

Wouldn't it be relatively easy to find out which processes are using the UTMS module and kill them?

It should be, just "lsof | grep /dev/ttyWhateverTheModemIs"But if you're already compromised then it's possible they've managed to replace lsof (or even libc) so that it doesn't show the malicious process. I'm pretty certain that that'll never happen though.

Which is why one shouldn't just run random binaries off of the web (regardless of the OS) without extreme caution, which should go without saying.
Would it also be a reasonable to assume that the vast majority of Linux-compatible malware/rootkits/etc are built for x86/x86_64 and not for ARM (which would actually require a separate builds, especially the ones that actually replace many system tools like ls, ps, kill, lsof, etc? Or is it possible that ARM based Pandora/Pyra systems could be susceptible to malware designed for Android, which is an ARM based Linux system?

You're misunderstanding. They are talking about a backdoor existing in the 3G module. If they get in through a backdoor in a 3G module, they can then replace your basic utilities. He wasn't talking about getting compromised through your own unsafe practices.

-God Ginrai

* RMS came* RMS slapped "God Ginrai"

* RMS left

* God Ginrai thinks again

Again, if you didnt get that slap: WHY THE *UCK SHOULD 3G MODULE HAVE ANYTHING TO DO WITH ANYTHING ON THE MAIN SYSTEM?

Try reading before you post. Your incredibly childish post is not even directed at the right person:

They are talking about a backdoor existing in the 3G module. If they get in through a backdoor in a 3G module, they can then replace your basic utilities. He wasn't talking about getting compromised through your own unsafe practices.

They can't easily get into your system through a backdoor in the 3G chip. Drivers should be FOSS. Maybe it would be able to compromise a download of a binary happening through it, but you are supposed to check MD5 (or better) hashes anyway after download.

All my statement did was correct a misunderstanding about what others were talking about. If you don't believe they are correct, address your comments to them.

-God Ginrai

Honestly, this is incredibly rude, and you shouldn't be taking this attitude with anyone on the forums.

-God Ginrai

 

[ssokolow]

They are talking about a backdoor existing in the 3G module. If they get in through a backdoor in a 3G module, they can then replace your basic utilities. He wasn't talking about getting compromised through your own unsafe practices.

They can't easily get into your system through a backdoor in the 3G chip. Drivers should be FOSS. Maybe it would be able to compromise a download of a binary happening through it, but you are supposed to check MD5 (or better) hashes anyway after download.

All my statement did was correct a misunderstanding about what others were talking about. If you don't believe they are correct, address your comments to them.

-God Ginrai

Actually, I was worried about location tracking. It's already been confirmed that the chip connects to the main processor as a USB device rather than via shared memory so compromise via that avenue (other than "tricked into installing malware" or "browser exploit") is unlikely even when the chip is turned on..

 

[God Ginrai]

They are talking about a backdoor existing in the 3G module. If they get in through a backdoor in a 3G module, they can then replace your basic utilities. He wasn't talking about getting compromised through your own unsafe practices.

They can't easily get into your system through a backdoor in the 3G chip. Drivers should be FOSS. Maybe it would be able to compromise a download of a binary happening through it, but you are supposed to check MD5 (or better) hashes anyway after download.

All my statement did was correct a misunderstanding about what others were talking about. If you don't believe they are correct, address your comments to them.

-God Ginrai

 Actually, I was worried about location tracking. It's already been confirmed that the chip connects to the main processor as a USB device rather than via shared memory so compromise via that avenue (other than "tricked into installing malware" or "browser exploit") is unlikely even when the chip is turned on..

I'm sorry, I'm looking through the posts and I can't seem to find where you participated in the chain of replies I was responding to. Are you sure you're not mistaken?

If so, please, by all means, direct me to your post that I was indirectly responding to.

-God Ginrai

 

[ssokolow]

They are talking about a backdoor existing in the 3G module. If they get in through a backdoor in a 3G module, they can then replace your basic utilities. He wasn't talking about getting compromised through your own unsafe practices.

They can't easily get into your system through a backdoor in the 3G chip. Drivers should be FOSS. Maybe it would be able to compromise a download of a binary happening through it, but you are supposed to check MD5 (or better) hashes anyway after download.

All my statement did was correct a misunderstanding about what others were talking about. If you don't believe they are correct, address your comments to them.

-God Ginrai

 
Actually, I was worried about location tracking. It's already been confirmed that the chip connects to the main processor as a USB device rather than via shared memory so compromise via that avenue (other than "tricked into installing malware" or "browser exploit") is unlikely even when the chip is turned on..

I'm sorry, I'm looking through the posts and I can't seem to find where you participated in the chain of replies I was responding to. Are you sure you're not mistaken?


If so, please, by all means, direct me to your post that I was indirectly responding to.

-God Ginrai

Oh, sorry. I probably got confused about which thread you were replying to.

I'm a bit pressed for time so I didn't (and still don't) have time to double-check the reply chain, I'm following practically every Pyra thread, and I've talked about this topic a fair bit.

 

[szr]

Show me a "proper" distro without a GCC by default, and you shall get a reward.


But ok, lets assume you dont like this "compiling", and removed GCC for the sake of security:


If you are not just infected but "cracked" on purpose, hacker will not care if you are running you linux on a toaster, as long as he got a toolchain for it.


If you got wget, curl, emacs, libwww-perl, netcat, bash (2.04-devel and up) or just any other utility to download stuff, malware may use it, but a hacker will figure it out, and use it to obtain his recompiled copy of GCC, or even the rootkit it self.


Some rootkits are only affect a special arch, and most of the time, a special build of a kernel. But most i saw, dont care what arch it is as long as it implements all the functions rootkit needs to properly function.


Android is another OS (I disagree, but most people think its a OS). As RMS said: "Its GNU/Linux, not just linux.", and you should understand that the difference between Android/Linux and GNU/Linux is almost complete.


A malware made for my iPaq 2210 (ARMv5) can easily work on my entire devboard park (all at least ARMv7).


A malware made for my Zyxel Keenetic can infect my NETGEAR DG834PN (If they will find space in the NAND ;3)


But unlikely those will work on Android, as Android is another OS.

I think you misunderstood me. I'm not against having GCC installed. I compile things all the time and I like having it.

Also, I agree that Android in and of itself is not really an OS but more of a graphical environment that runs on a custom Linux kernel.

 

[ZetaNeta]

Show me a "proper" distro without a GCC by default, and you shall get a reward.


But ok, lets assume you dont like this "compiling", and removed GCC for the sake of security:


If you are not just infected but "cracked" on purpose, hacker will not care if you are running you linux on a toaster, as long as he got a toolchain for it.


If you got wget, curl, emacs, libwww-perl, netcat, bash (2.04-devel and up) or just any other utility to download stuff, malware may use it, but a hacker will figure it out, and use it to obtain his recompiled copy of GCC, or even the rootkit it self.


Some rootkits are only affect a special arch, and most of the time, a special build of a kernel. But most i saw, dont care what arch it is as long as it implements all the functions rootkit needs to properly function.


Android is another OS (I disagree, but most people think its a OS). As RMS said: "Its GNU/Linux, not just linux.", and you should understand that the difference between Android/Linux and GNU/Linux is almost complete.


A malware made for my iPaq 2210 (ARMv5) can easily work on my entire devboard park (all at least ARMv7).


A malware made for my Zyxel Keenetic can infect my NETGEAR DG834PN (If they will find space in the NAND ;3)


But unlikely those will work on Android, as Android is another OS.

I think you misunderstood me. I'm not against having GCC installed. I compile things all the time and I like having it.

Also, I agree that Android in and of itself is not really an OS but more of a graphical environment that runs on a custom Linux kernel.

Ok, now you probably misunderstood me. Do you know the basics of cracking and setting security against it?


That was sarcasm. Android(/Linux) IS in fact a OS. Linux IS NOT a OS, yet, it works side-by-side with the userland to form a OS. (DEVTMPFS for example, or BINFMT_MISC is a large part of it)


Android is a serious OS, with its own binaries and workings. Yes, its mainly proprietary (Yes! Shocked?). And it contains around "Zero point zero zero zero" of GNU userland you may find on you desktop.


And when you mean "desktop" linux, i assume you mean GNU. Which is all those Debians, Gentoos and etc are based upon.


Dont mix those things. To more experienced users it may sound even more weird.


I am very experienced in this, as i am developing my own OS upon Linux kernel, going from GNU, but hoping to strip it down to a "single binary of init i wrote".

 

[SNESFAN]

The down talking is being handed out in troves...

 

[LineOf7s]

Oh God, we're back to the "Linux is not an OS" topic.  Great.

 

[DAP]

Oh God, we're back to the "Linux is not an OS" topic.  Great.

GNU is not an operating system without Linux. I'm still waiting for the Hurd to reach a usable state. https://www.gnu.org/software/hurd/