Baseband Hacking: A New Era Of Smartphone Hacking. Baseband Hacking: A New Era Of Smartphone Hacking Need To Worry

Bootloader is neither BaseBand nor Firmware.

BOOTLOADER:
Versions: 3.9, 4.6

What it is?

The iPhone has at least two bootloaders. One is called "ARM Core Bootloader" (ARM stands for iPhone processor) and refers to the operating system. We are interested in a bootloader called "BaseBand Bootloader". More information on bootloader features will be included soon.

A bootloader is a loving mom who goes to the iPhone's room when it turns on. She wakes him up, pulls him out of his crib and prepares him for school. Its main function is to make sure that the iPhone wakes up before getting out of the crib; that the iPhone got out of the crib before going to the shower; that the iPhone took a shower before getting dressed and that the iPhone got dressed before going outside. Without the bootloader, the iPhone would doze at the bus stop in wet pajamas, waiting for the bus.

Bootloaders are responsible for ensuring that when the iPhone boots up, it does everything that needs to be done in the correct order.

Like humans, iPhone has one mom for life. If you bought an iPhone with bootloader version 3.9, then you always have it, no matter how many upgrades you have done.

Of course, there are times when people have a stepmother. Some people have gone from their mommy 4.6 to mommy 3.9. We hope that if your iPhone did it, you know about it.

Why is it important?

The version of your bootloader determines the type of unlock you can use. Because 3.9 is a mummy liberal and unprejudiced, she will allow developers to do whatever they want at boot time. This makes the phone accessible.

The bootloader 4.6 is much stricter. Mistress 4.6 is confident that her iPhone will grow up and become the President and she controls everything that he does (or does not do). For example, 4.6 does not allow writing BaseBands that fail validation.

In order for BaseBand (see below for an explanation) to pass validation, you need secpack. Imagine that this is a secret word that children and parents have come up with in case the uncle suddenly wants to pick up the children from school. Without the secret word secpack "and it is impossible to record the hacked BaseBand on the phone. And without the BaseBand hacking, it is impossible to use the unlock method used in the ZiPhone. To somehow fight this, ZiPhone and Independence offer you a divorce from your impenetrable mom 4.6 and give you in return kind mom 3.9.

If you still want to live with Mom 4.6 (because you also want to become President), then you have to use the so-called soft-update method, which installs software updates to the OS, but does not change BaseBand. This method is sometimes called hybrid unlock.

What do I have?

The iPhone unlock methods are mainly aimed at the "BaseBand Bootloader". There are versions 3.9 and 4.6. Initially, iPhones came with Bootloader 3.9. If your firmware was version 1.1.1 or earlier, you have 3.9. If you bought an iPhone in 2008, most likely you have 4.6.
In any case, if you used the ZiPhone, then you have version 3.9 Original.

BASEBAND:
Versions: 03.12.06_G, 03.14.08_G, 04.01.13_G, 04.02.13_G, 04.03.13_G, 04.04.05_G

What it is?

BaseBand (hereinafter - BB) is the iPhone portfolio.

BB manages the interaction between the phone part of the iPhone and the operating system. Most cell phones separate the BB chip from the phone's main memory and processor. We don't know if this is the case for the iPhone. BB is one of those things Mrs Bootloader checks when she wakes up her iPhone.

Whenever the iPhone is connected to cell towers - for voice or data - it works through the BB. BB is also responsible for the operability of the SIM card and for receiving the signal.

So why did Apple do this? Why did Apple create a secure, hard-to-reach, and sealed piece of hardware to store phone functions?

Obviously, in order for it to be protected, difficult to access and closed. More reasons? Because that's how cell phones work. Every modern cell phone has a BB. These functions are separated for the same reason that computers have separate audio and video cards - to ensure stability.

When the iPhone goes to school, he has to take something with him. He needs notebooks, a ruler, a calculator, a folder, etc. BB has it all. As many of you know, you can take a schoolbag away from a student without fatal outcome for him. Your BB may not work, but the iPhone will work - although it will look more like an iPod Touch if it does.

You may be thinking that you are making a call when you dial numbers on your iPhone. Wrong. You create a chain of instructions. By pressing the "Call" button you transmit these instructions to the operating system, and it transmits them to BB. BB turns off EDGE / GPRS, sends a message to the cell tower about the start of a call, gives the tower a phone number, waits for a response signal ("Busy" or "Free") and, as soon as the connection starts, it turns on the microphone and the speaker of the phone. Since BB knows how to do all this, the iPhone can only say "Call this number" and wait for an answer. He doesn't need to use his relatively powerful processor to do such mundane things.

Why is it important?

This is important at this point because this is the difference between having and not having a Find Me feature in Google Maps. In the future, other functions may rely on the updated BB. So far, "Find Me" is BB's only "new" feature.

Remember - BB carries out all communications between cell towers and the iPhone OS. There is a possibility that the phone always receives data about its location from the towers - which is why programs like Navizon work. But as of version 4.03.13_G, Apple added code that simplified the process. Navizon is probably looking for the coordinates of the towers in the BB. From version 4.03.13_G and higher, Apple's program only needs to ask "Where am I?" BB does all the work and sends the coordinates back.

What do I have?

FIRMWARE:
Versions: 1.0.0, 1.0.1, 1.0.2, 1.1.1, 1.1.2, 1.1.3, 1.1.4

What is it?

Firmware (hereinafter - FW) - this is our student, iPhone. This is all that he is, his soul. This is his operating system.

Let's take another look at what we've already read. When you turn on the iPhone, Mom / BB starts waking up and preparing the student / Firmware for school. She makes sure that all morning procedures / services have been completed. She equips and gives the briefcase / Baseband to the student / Firmware and sends it to the school.

FW is very flexible. To date, it includes the iPhone kernel, Springboard (desktop), all its applications, WiFi, Internet functions, etc. Through FW, Apple can and does change a lot of things.

Why is it important?

Shaky icons and web apps, SMS to multiple numbers, Find Me in Google Maps and SDK (already!). Knowing the version of your FW is important in order to keep abreast of the events around Jailbreak "a and Unlock. With each new version, popular functions and applications appeared that forced people to update - or kill themselves for fear of losing compatibility with third-party applications or unlocked SIM cards after updates.

What do I have?

Your version is displayed in iTunes whenever you connect your iPhone to your computer. Look in the Summary tab.

Below you will find how to find an exclusively 100% original copy of your first check!

Recently, I have received many messages asking for help in certain issues related to unlocking Apple iCloud Activation Lock.
I hasten to answer all of you right away here - on the pages of my blog.
Many people ask - where to get the original receipt of the first purchase and what is it?
The answer is - this is the most common cashier's receipt if you bought your device personally in a store. For example, when buying an Apple iPhone in the Apple Store, you will definitely be given such a check and it will look something like this -

About iOS iCloud Activation lock - one more time!
It has been a long time since Apple launched the iOS Activation lock, and this option has proven to be quite reliable. Also, the content of the Apple website regarding the use of iCloud Lock has changed at times. The conditions for the official unlocking of the iOS iCloud Activation lock from Apple have radically changed.
All these factors, as well as letters with questions about how now you can actually disable the iOS iCloud Activation lock on iOS devices, prompted me to write this article. Below you will receive a detailed description of how you can independently and completely officially disable iCloud Activation lock on your iOS device. After this procedure, your iPhone - iPod - iPad will work absolutely fully without any nuances in use. This is especially true for devices with a modem module, such as iPhone and iPad with 3G.

Security researcher Ralph-Philippe Weinmann says he
found a new way to embed it on mobile devices - with the help of a fake
base station and vulnerabilities found in firmwares of microcircuits sold
by Qualcomm and Infineon Technologies. Weinmann will demonstrate a hack at
example, both iPhone and Android devices, this week during
the Black Hat conference in Washington.

Previously, mobile hacking attempts affected the operating system of the phone.
or other software, but this hack focuses on intruding into
a telephone processor, which is equipment that sends radio signals and
receiving them from telephone towers.

Details of the Baseband Hack

In reports

IDG News Service and
, this new hack is detailed. In short, it is
a highly technical process that requires the installation of a fake telephone tower
to communicate with the target device. This has been an impossible task in recent years.
due to huge costs - tens of thousands of dollars. But now, thanks to the new
open source software called
, any
can set up a tower for $ 2,000, which equals the price of computer hardware.
Mobile companies are also making essential equipment more affordable by
providing consumers with femtocells (low-power and miniature cellular station
communications designed to serve a small area - one office or
apartments) in an attempt to expand mobile reach. Femtocells like 3G MicroCell
from AT&T, even less expensive; AT&T hardware costs only $ 150.

To carry out the attack, Weinmann installs a fake transceiver that
is used to send malicious code using a radio signal to
target device. Code exploits vulnerability found in GSM / 3GPP
phone baseband processor stacks. Weinmann says that such organizations,
as GSM Association and European Telecommunications Standards Institute
(European Telecommunications Standards Institute) does not even
considered the possibility of this type of attack.

Do I need to worry?

In addition to the costs of this particular type of hacking - it is still
quite expensive - the code that Weinmann wrote is unique,
since it requires deep knowledge of the chipset device and only some hackers
know a lot about this, says the IDG report.

In essence, Weinmann was able to set a new vector for the development of hacking.
smartphones, open up a field that is currently being studied by a small
the number of researchers. In August, for example, Chris Paget demonstrated
spoofing attack at Defcon hacker conference in Las Vegas, after receiving
permission for this from the US Federal Communications Agency at the last minute.
Weinmann's followers will probably be able to continue his work, but it will take
enough time.

In other words, this is still a growing area for hackers.

It's too early to talk about the varieties of this new baseband hacking technique.
hacking, but for now, security experts say that
the general public shouldn't be worried about attacks like this in the near future.

According to Sophos security consultant Graham Cluley, "If
if someone would like to spy on your cell phone conversations, it would be
it is easier to trick the user into installing an application that
is a spy, or get physical access to a mobile phone for
installing spyware code, "he said." I would be surprised if someone
made every effort that this researcher suggests for this. "