Disabling Phone Baseband? [Rooted Android]

>I won't talk about why it's important. People on this chan should know. >Yes, there are other methods to spy/pwn someone's phone and a lot of them including simjacking, rogue base station, hardware backdoors, etc >Rooting and de-Googling a phone effectively takes care of dragnet surveillance of EVERYTHING you do on your Android OS (on a non-degoogled phone, Google has full remote access to all your soykaf as you know) >Anytime privacy is discussed and a custom degoogled ROM such as GrapheneOS or LineageOS is mentioned, people say that the baseband radio (E911) still gives your location away to someone with an IMEI catcher >Worse, many maintain that the baseband cannot at all be disabled as it runs on autonomous hardware with its own CPU. Some even say it can work while the phone itself is off. >Basebands and their inner workings are proprietary so they're hard to f*ck with >The only sure ways I know to mitigate baseband location tracking are faraday cages, taking out the battery (or a hardware killswitch a-la Librum), or jamming the signal with an SDR (highly illegal) >Through my research I've found that IMEI spoofing and disabling the baseband drivers could potentially work. Both techniques require root, and spoofing the broadcast IMEI requires interaction with the baseband on a low level Hence, this thread is going to be about the discussion of phone basebands. How do they work? Is it possible to get them to stop spying on you? What kinds are there and who manufactures them? What is the accuracy of location triangulation? Does disabling the baseband drivers actually work? Can the broadcast IMEI be spoofed? Help a noob privacy enthusiast out.

Probably not gonna get a lot out of this, baseband is still a great mystery as i understand it.

>>16057 Yeah that's why I asked the best hacker forum that I know which is this. I bet enough of us can figure this out if we put our minds to it. There's demand, after all. I know you can detect these signals by listening using a software defined radio, but I don't know the frequencies to listen to. So, my contributions to this discussion are as follows: >baseband drivers can be disabled, if the user has root and is skilled. This would in theory break cellular/E911 capabilities. Whether this fully breaks the baseband, I don't know. >Any technique which "silences" the baseband must be confirmed with an SDR, which I do not know how to do because I'm an absolute skiddie >the baseband is a mystery as you said, because it's all proprietary code that you need proprietary OEM specific tools and training to decipher.

>>16056 One solution is to use an offline tablet with no baseband and use VoiP only

>>16058 >the best hacker forum that I know which is this Heh. >confirmed with an SDR, which I do not know how to do You can buy an rtl-sdr and use a software like CubicSDR to scan nearby frequencies and look for spikes where a radio is transmitting. The rtl-sdr can't reach the new high frequencies in 3g/4g though. >baseband drivers can be disabled, Whether this fully breaks the baseband, I don't know. Presumably you mean the Android drivers. This will prevent Android from working with the baseband but the baseband has its own processor and ram and operating system so it will still ping cell towers as you walk past them, tracking your location and everything same as before. >Can the broadcast IMEI be spoofed? On the protocol level I think it's possible but convincing the baseband to do it for you is another thing. >>16059 >One solution is to use an offline tablet with no baseband and use VoiP only Finding a phone sized "tablet" is hard. Some people use old iPods. There's also the Nokia N810. All solutions I'm aware of are too old/underpowered/proprietary to be a decent smart phone replacement though.

Baseband is a part of main SoC, it is located in same package as CPU/GPU on modern phones to save volume. Old pre-2014 tablets and even earlier PDAs with cellular functionality used general purpose ARM CPU and separate baseband chip, many pre-2010 Nokia smartphones and "regular" cell phones already had unified baseband+CPU chips. Baseband does not handle antennas directly, there are transceiver modems to transform digital signal to analog radio wave. You should remove modems to render baseband part of the SoC unable to communicate to cellular tower network. Depending on device, it may also cripple other wireless radios. Depending on paranoia level and audacity of bioluminescents, a baseband (or any other lower and uncontrollable part of a smartphone) might possess ability to communicate (receive and send data) with adversary over WLAN, Bluetooth, USB cable host PC, blinking LED, blinking infrared LED, blinking screen, flashlight, cameras, speaker, microphone, vibrator, use any part of circuitry that can act as antenna (intentionally, or unintentionally, but rediscovered by an adversary). Hope you sleep well.

>>16064 >>16064 >Depending on paranoia level and audacity of bioluminescents, a baseband (or any other lower and uncontrollable part of a smartphone) might possess ability to communicate (receive and send data) with adversary over WLAN, Bluetooth, USB cable host PC, blinking LED, blinking infrared LED, blinking screen, flashlight, cameras, speaker, microphone, vibrator, use any part of circuitry that can act as antenna (intentionally, or unintentionally, but rediscovered by an adversary). In that case, how do I perform an attack like this? A total hardware pwn on a phone? It can't be easy to do.

>>16065 Not him but you dont need to pwn hardware. Software can access it so regular malware can do it. The most ridiculous csi miami soykaf ive seen is a live demo on hacker congress using the reflection in the phone users eye from the front facing cam to watch him type in his password. Obviously very blurry but good enough to figure out where the thumb goes and that was a decade ago. Should be easier now.

>>16056 Opening the phone and physically disconnecting the mobile antenna(s) seems like the safest strategy

>>16068 A rather permanent solution dont you think

>>16067 yeah, don't forget stuxnet communicated itself between speakers. Shit is real and scary

>>16070 Will the Librem phone save us?

>>16070 It's basically just reusing old technology and algorithms for noisy line modems and using them on somewhat-different hardware though. It's clever but hardly revolutionary or surprising.

>>16082 I just said it was scary