I was under the impression the most common architecture for mobile devices is to support DMA (direct memory access) from the baseband to main memory. This would obviate the "finding an OS exploit" step described, as operating systems do not attempt to be secure against attackers with full memory access. Can anyone with knowledge of these phones' architectures clue us in on the specifics of the situation?