Smartphones With Popular Qualcomm Chip Secretly Share Private Information With US Chip-Maker
www.nitrokey.com

Affected smart phones are Sony Xperia XA2 and likely the Fairphone and many more Android phones which use popular Qualcomm chips. The data is sent without user consent, unencrypted, and even when using a Google-free Android distribution. This is possible because the Qualcomm chipset itself sends the data, circumventing any potential Android operating system setting and protection mechanisms.

  • loki
    8·
    2 years ago

    A comment on this by GrapheneOS reddit account here:

    NitroKey did not discover a backdoor. The post is very sensationalized and it’s unfortunate they didn’t run this by us first. The title used for the post here is editorialized and doesn’t match what the article actually states. This is not a backdoor.

    XTRA (PSDS) is an entirely separate thing from Qualcomm’s IZat service. XTRA (PSDS) simply provides static downloads via HTTPS GET requests of GNSS almanac data, i.e. the predicted locations of satellites for around a week in the future. XTRA is just Qualcomm’s proprietary branding for PSDS which is also used by every other major GNSS (GPS, GLONASS, etc.) implementation including Broadcom.

    IZat is a network location service similar to the Google and Apple services where devices can send a list of nearby cell towers, Wi-Fi networks and Bluetooth devices with their signal strength to receive back a location estimate. It also seemingly supports other features like location sharing. IZat appears to be a fairly privacy invasive service but it’s not enabled by default and is not directly related to XTRA.

    Qualcomm used to use izatcloud.net for both IZat and XTRA which are entirely separate services. They moved XTRA to xtracloud.net to make it clear that it’s a separate thing. Some devices using an older SoC or configuration may still use the confusing izatcloud.net URLs leading to people mixing up these things up.

    On Qualcomm Pixels, XTRA (PSDS) is implemented by xtra-service within the OS and SUPL is implemented by the cellular radio firmware. The OS chooses the URLs used for both XTRA and SUPL. Pixel/Nexus phones never integrated IZat. We have seen South Korean Qualcomm SoC phones providing the option to use IZat and it seems like it might be widely used there. It does not seem to be widely used internationally and is not simply enabled by default without users choosing to opt into using it. XTRA is normally always used since it’s just a static download.

    On Tensor Pixels, PSDS is done with the standard AOSP PSDS implementation and SUPL is done within the OS by Broadcom gpsd. We prefer the Tensor Pixel approach, but it doesn’t mean that the Qualcomm approach is less private. We just prefer having control over it within the OS.

    It is possible Qualcomm moved XTRA (PSDS) handling into firmware similar to SUPL on newer devices. We haven’t confirmed that ourselves since we aren’t currently doing research and development for newer Qualcomm devices. We do prefer the Tensor platform over Snapdragon, but this is barely a factor.

    There are no known backdoors in either Snapdragon or Tensor, and no one has found any evidence of any backdoors. The post title here is simply wrong. People not knowing about XTRA (PSDS) or SUPL doesn’t make them a backdoor.

    SUPL is much more of a privacy issue than XTRA, since SUPL involves sending a list of nearby cell towers with their signal strength to a server which helps with accelerating obtaining a satellite-based location lock.

    We document these topics here:

    https://grapheneos.org/faq#default-connections

    https://grapheneos.org/faq#other-connections