I know someone who worked at Qualcomm with access to that baseband code, who had a personal project to scan it for backdoors. He came up empty. So if they are there, they are subtle. At least in Qualcomm basebands. Exploits probably provide all the backdoors the spooks need.

Two alternatives:

* Firmware is patched after the fact either by inserting a backdoor into the build process, or binary patching the resulting firmware image. Such an operation is likely to be compartmentalised to avoid employees knowing about it.

* Intelligence agencies seed online discussions with false assurances (note that I'm not suggesting any wrongdoing on your part - merely pointing out that an anonymous forum post is hardly verification that can be relied upon).

That said, I do agree that exploits are likely sufficient, and that planting a mass backdoor is probably not worth the risk of it being detected.

>planting a mass backdoor is probably not worth the risk of it being detected.

everyone is ignoring what was pointed out by "kennywinker"

https://news.ycombinator.com/item?id=20884384

the fact that both for android and for iphone seperately, there is a correlation with sound / silence and data usage, even if in the opposite sense. why did this not at least prompt the investigator to dig deeper?

I was in fact referring to exploits in my post. That's typically how NSA and GCHQ operate these days: either find exploits, or if a sufficient number can't be found, have some hard-to-detect exploits inserted into the code by operatives or as part of unrelated bug fixes.

There's also hardware exploits. The firmware doesn't need to have a back door if a certain sequence of packets sent to the network controller will cause key memory to be overwritten and live patch in a backdoor.

Agreed, hardware backdoors are very possible, but software is much cheaper to mess with. The spooks have in the past shown a preference for hardware jimmying, but those have been one-off cases.

That said: monkey-patching is much more easily concealed than hardware or source-code changes, and is more in line with how US spooks have been seen to operate.

why put it in baseband? does baseband have access to the raw audio buffers? just put it in ARM's secure world, that's what it's designed for...

Because the baseband is opaque to the software running elsewhere on the phone, proprietary, and not visible to inspection by security researchers.

Baseband processor has access to absolutely everything on all but Purism phones. Android is a guest OS.

I always thought baseband referred to the processor and firmware/software that responsible for the radio modem?

Do Android and baseband firmware run on one and the same processor(s)? Or are we calling ARM Secure World / TrustZone baseband these days?

Android runs on a processor that operates, or not, at the pleasure of the baseband processor. The latter has complete access to all memory, and complete control over the Android's CPU cores. Android and the cores it runs on have no access to the baseband processor's memory, or any control over its execution.