Nothing is checked, everything is automatically trusted. What makes it even worse, is that every baseband processor inherently trusts whatever data it receives from a base station (e.g. For instance, there is barely any exploit mitigation, so exploits are free to run amok. The standards that govern how these baseband processors and radios work were designed in the ’80s, ending up with a complicated codebase written in the ’90s – complete with a ’90s attitude towards security.

The insecurity of baseband software is not by error it’s by design. You may have the most secure mobile operating system in the world, but you’re still running a second operating system that is poorly understood, poorly documented, proprietary, and all you have to go on are Qualcomm’s Infineon’s, and others’ blue eyes. You may think these baseband RTOS’ are safe and secure, but that’s not exactly the case. This is actually kind of weird, considering just how important these little bits of software are to the functioning of a modern communication device. The problem here is clear: these baseband processors and the proprietary, closed software they run are poorly understood, as there’s no proper peer review. For instance, the RTOS inside Qualcomm baseband processors (in this specific case, the MSM6280) is called AMSS, built upon their own proprietary REX kernel, and is made up of 69 concurrent tasks, handling everything from USB to GPS. As far as I know, this baseband RTOS is always entirely proprietary. This operating system is stored in firmware, and runs on the baseband processor. Since this functionality is highly timing-dependent, a real-time operating system is required. Aside from the operating system that we as end-users see (Android, iOS, PalmOS), it also runs a small operating system that manages everything related to radio.

3G or LTE) actually runs not one, but two operating systems. Every smartphone or other device with mobile communications capability (e.g. I’ve always known this, and I’m sure most of you do too, but we never really talk about it.

Qualcomm msm 6280 firmware