uh my name is Sebastian and I would liketo tell you a story about crafting theprivate phoneum it's basically about the challengesthat are on the way to create such aprivate phoneum and about how we as neo900 project uhwant to tackle those challengesumI also tell you a bit about uh currentstatus of neo900where we are at the momentsoto startlet's talkum a bit about what neo900 isum is them it's the match of GTA 04 thatwas already presented earlier byNicolaus and Nokia and 900 that's afamous Nokia Linux based phoneumthat was running on a mymo platformand we we actuallyuh going beyond that matchum near 900 it's it's also found thatcares about your privacy what does itmeanokay let's start witha bit of specsneo900 will be a bit upgraded uh whencompared to uh GTA 04 or N900um it's going to contain an uh TexasInstruments on map freeprocessor on working on one gigahertzand one gigabyte of RAMumfrom the most important featuresum I think an interesting one is a dualtouch resistive screenthere's a lot of discussion going onresistive and competitive screens and weactually believe that a good resistivescreen isbetter forprojects like that as ahacker friendly phone when you canactually launch any software you wantumfor near 900 will containumspecifically crafted modern sandbox andmonitoring solution and I'll get back toit laterum it's also a very hackeroriented phone uh what I mean is we'lluh we will have a lot ofadditional interfaces that you as a usercan utilize to make some crazy projectswhatever you would like whatever youimagine and you know how to do it youwe can stop you from from doing that allof them[Music]specifications or documentation will beavailable the project isis run in open Hardware Spirits soum that's uh definitely a open platformand one of the most open uhmobile phone smartphones available onthe marketokaylet'scompare the situationof howumcommon commonly available phones on themarketlook like when compared to platformslike open mock-up in front ofones like the neo900sumwe in common smartphoneslike iPhones like Android ones maybeWindows phonesumthere's a progressing trend of lockingdown and the software locking down theuserumwhat does it meanthe the device comes asclose the package of both hardware andsoftwareand the software isum also highly tied up withum lots of online servicesprovided byApple Google Microsoft and companieslike thatumthat's not exactly howhowour PCS operate what we are used to whenComputing on a desktop computers onlaptopsum where basically there we are adminsof our phonesI mean computers we decide whatoperating system we want to use wedecide what software we want to usewe installed that that software or notum however on mobile phones there'sthere's a difference becauseum and thereum nowadays more often than notdesigned as a world guidancethat is uh closedumecosystemsthat's uh I thinkum uh 20 watt for thatum wellum a company that managesthat world Garden actually have uh hasin control what can be uh launched whatcan be ran on that on that platformum as you probably know there areplatforms like app storesavailable on Android on on iOS and it'smost visible on iOS actually where youcannot even launch anyum any software that wasn't acceptedthat wasn't permitted to to arrive onApple's App Storeumwhy is that why does the cell phonereally differ so much from your averagelaptop or desktopuh technically it doesn'tit's just smaller and more integratedum technically there's no reason to tolock you downand thencomments smartphoneshave computing power comparable todesktops from some years ago orsoumwe can actually run the same software welaunched uh let's say 10 or 15 years agoon our compute test and now on on mobilephones and that's not howthere's no problem with thatumokayhoweverit's really convenient forum for thecompanies that um on the platformuh what's them and the problem with suchplatforms for for usersum there's a lack of documentation thereareum there is no information on how staffin those devices really workuh lots of components are closedwithout any source code without driversfor it so changing them if you wouldlike to install your own operatingsystemyou're in trouble because you would haveto write your own driverseven for common systems like Linuxwhen you don't have documentation youwould have to invest engineer everythingand that's a lot of effort a lot oftroubleumwe would uh and that also connects withumwith the next Point porting uh I uh wellthat it's never ending story becauseeven if there is some device availablelet's say Nexusthat allows some kind of freedom in uhinumlaunching uh your custom operatingsystemum it will quickly become obsolete therewill be never one never onceum that newer I mean and thatum[Music]will quicklyummove your developers from your communityto the next device next targets and fromfrom practice I have noticed that lotsofum projects to to Port some operatingsystem on uh platforms like that andnever never really ended there's alwayssomething that's not working and itbecomes obsolete before it's actuallyfinishedum that's also a problemwith gettingum even if something is is already openuh isum shared with uh by thecreator of of the device let's say somecandle driversum it more likely thanthan that it won't beupstreamed it will be justshared in some table on some websiteand if you would like to uh to have thatdriver managed some maintained somehowyou would have to either maintain it byyourself or hope that theumthe manufacturer will release updatedversion somewhere in the futureum or you would have toto invest a lot of work in getting thatdrivers into shape that can beupstreamed toumto them Upstream projectthemumthe big problem is also with a so-calledplanned obsolescencebecause this trend of building um thedevices that aren't designed to to lastlongum your the otherumencouraged to replaceyour your devicelet's say each two or three or fouryears rather than keeping it longerthe economical reasons are obviousand the last point on this slide I thinkthe most important important onewhen you have to break into your owndevice in order to use it as you wishsomething is completely wrongit's something thatkind of imaginable to me that under somejurisdictions in the world there's it'seven illegal to just use your own bothdevicein some specific wayum as far as I know in United Statesthere's umdmca exception for phones so you canJailbreak uh iPhone butwhen you get an iPad it's not covered bythat exception so you cannot legally useiPad anywhere you you would likeso you buy a devicebut when you want to do something with adevice you own you you can'tlet's back to the main topic of thispresentation that is privacysohow can you privacy softwareobviously uh can suffer from data dataleaksand your data can get leaked via theInternet or some other Wirelesstechnology or some immovable mediaor if your life can be can be spied onon location tracking on audio video Ifshopping or logging your activitiescollecting metadataandum obviously a mobile phonewhich is a device that most of us areumuhmost of us have a new uh near usfor almostumwhole life whole day at leastum that's a very convenient device to totoget into some of your private data orinto Data details of your lifeum so if we would like to build a devicethat's strong on privacyit turns out thatgreat first step to do that is to builda good open and hackable hackable deviceum because that's actually a kind ofdevice that canbe trustable that canum be transparent to the userumbut there's a problemeven if we build a device likeGTA 04 or near 900 without using someadditional measuresthere's a bigugly property Black Box sitting insideit which is known to often be vulnerableand it's a basement processorbased on processor is a device thatactuallyconnects to the Via wireless network toto the base stations and do thecommunication with will providethere's a nice presentationby Ralph Philippe weinman uh told onblack hat con conferencea few years ago named audio bass bandshave belonged to us I highly recommendto look at itbecause it showshow easily a basement processors can beactuallyumtargeted astargeted for attackslots of thosefemales on those deviceshave their rootsin 80s or 90s andum they inherited the SEC all thesecurity approach from from that timeso there are lots of both overflows lotsofumlots of basicumsecurity problems that can be exploitedby anyone malicioussomewhere near your phoneumand what's more what's most scary thebasement processoroften hasuh hasquite a lot of control over the the minebecause the soil we trans the operatingsystem of the useruh like you know Linux like Android likeiOS sohaving control just under thethat operating system that mine of amain operating system is not enoughbecause the baseband can actuallyum influence that that OSthat's the main problem with projectslike like black phone whichum focused on shielding thatandroid-based based operating systembuttotally forgot about uh how uh it howvulnerable basement process can be uhrecently there's a maybe not not asrecently but there's a trend of uh intotightly integrating the basement withthe rest of the system it's happeningbecause of a lower costs mainlyumandtwo main threats out from that are thedirect connection to microphone anddirect memory access the first oneum causes the basement to be able toSimply listen to what happens around thefall without any consent of the mainmain system with a customer of user andthe second one direct memory accessactually allows basement to do whateverit wants with mainmain software main operating system thatuser launches with any application thatthat user uses on his phoneumandum shielding gram the operating systemthat that user actually uses withoutum we're taking care of the base bandreminds me of of the way howcannibals on Monkey Islandthreaded a guy blastum if you have if you're not familiarwith the game I'll explain it to you abitumum at some moment in the game guy bashhas to uh to land uh some bananas fromthe village andhe gets cut caught by uh by cannibuswhich who imprisoned him uh and lock thedoor but there's a hole uh in the floorwhich leads toum exitumand but there's a gag in the game thatyou can actuallygo back and be caught againand they strengthen the the doorand when you escape again and go backthey straighten the door once againandyou can do it once again and obviouslynow that should do itof course you have no problem withescaping once again so uh that's justlike with with the base band situationbecause when you just keepstrengthening the the front door withoutdoing anything with that hole in thefloorsimply not doing anything meaningful toto secure your your data toum or anything that happens on yourphone that's that's not the wayumso what can we do with that can we makea basement that is open thatumcan beumlet's say audited by anyone on theplanet or uh can and which operation canbe checkedunfortunately it's not that easy becausecreating a basement processor is areally hard task and there is a reasonwhy there are only a few companies inthe world that actually produce themthatinstead of just using some licensedtechnologyand their code basis uhreallyum many years old soumand so starting such project to let'ssay just just write theumcompetitive uh female that could be uhcould be executed on some uh somebasement pieces availableumwould be really hard there isum okay that's next slidewhat's moreyou can just write the the code andlaunch it on on the processor becausethey're just lockedthey are umcryptographic signatures used by theirpresence to ensure that only theassigned versions of the software thatwere approved by aby the manufacturer will be executed onon that deviceand what's more there's ummandatory certification of ofum those devices because they docommunicate over the airand so thatthat of course has to comply withlegal regulationsand when you change anything in thesoftwareof such devicein most jurisdiction in the world thatvoids the certification so it has to bedone once againum and the device that that doesn't havea valid certification is simply illegalto usethere's a projectcalled osmoc on BB that actuallyimplements[Music]free firmware that can be executed onsuch a basement processorbut it's it's limited to one it'slimited to 2G Networksand second one it's limited to TexasInstruments Calypso basements that wereused in some old Motorola phones and inopenmoco devicesuh of course installing such um firmwareon your phone and just trying to use itum is not that easy it's illegalactually unless you get some governmentpermissions to do that or you operatedin fire like age and that's not reallythethe basic use case you would expect fromoperating the mobile phone and soum and andum BB is actually not oriented toum to provide a firmware that can beused as um as a phone it's more likeumlike a research projecthowever even if we couldum could produce an open basement and weshould fix a lot of uh a lot of a lot ofproject problemsit wouldn't magically fix all thePrivacy problemsthere are also other threatslike trackingit can be either based on uh solely onthe wireless network or assisted by GPSif dropping data leakage leakagesecurity bugs in female or even SIMcards and of course direct access to tomain Ramumwhich means that as I said before if onepart of the system is compromised in theother is as wellum there are links to uh to more detailsabout those trackingumtracking methods uh I if you'reinterested I recommend checking them outlater from the PDF slidesumof course there's also a threat ofGSM hackingbecause ifumif staff is so vulnerableum it'snot really hard to dofun or actually argue stuff with withGSManyone with a deviceum let's say osmoc on VBor some more specialized devicesumif he will if he ignored thatumof such actions he can actually do he orshe can do a lot of nasty stuff to thenetwork the encryption used in GSMwas actually broken long ago and it wasdeliberately weekend uh when the specswere were created to make a life ofgovernmental surveillance agencieseasier and if I remember correctly thatwasthat request came from Britainandthere was a discussion about that andGermany especially was[Music]was Far a stronger encryptionbecausethey were a bit afraid ofum of countries uh well and that was amatter of countries it was so packed andthe countries that didn't need thatweren't neighbors of of that countrieswere actually more concerned about thisstuff like surveillance so theyum Wanted weaker encryption and therewas a compromisereached which means that there there wasactually a stronger method it chosen butumthe last uh the last bites of the keyswere in the specs set to zeros soactuallythat's like that's just likeit wouldn't bethose those bits wouldn't be there atallthere's also a threat of Daniel ofservice attacks which are very easythere's also a link in this uh in thisslide to the other presentation thatshows howum how to useosmokom BB based phone uh to actuallyprevent anyum any phone in the neighborhood or somespecifically selected phone from doingany communication with with thePlayStation so we can easily justuse our phone uh or some other deviceto make uh impossible to for others toto use their phonesso actually the only protectionfrom those kind of stuff is theillegalityum the GSM standard is is pretty old andthere's even if things change in thenewest and that's there's always a wayto to just uh download downgrade thecommunication to to that old GSMstandardumsoin order to to make a phone that wouldbe really privateum it's necessary for it to be trustableand in order to to make a phone that istrustable or any other device it has tobe openumnotice that those arrows are directedthat means you can have a device that isopen but not trustable and stable butnot private uhbut on the other way aroundwhen you have a private phone it has tobe testable and openumforeignwhen it comes to all those threats thatare waiting for us and over therewe cannot really fixum if dropping of calls if the openingof internet connection and through thatrelation while connected to the networkthat is a method of positioningumum that those kind of stuff happenoutside of the deviceandterritoration is actually necessary forit to function that's how gsm networkworks it's the cellular after all and sothe only way to actuallydo something with that is to encryptso what's our idea to to deal with allof this stuff we believe in a contestsurveillance rather than audit and Trustuh whythis it's simply not feasible to toactually audit everything to thelevel that we can safely trust stufflike that let's say a basement but sojust simply overly complicated that'swhy and the second thing is that wesimply don't have access uh to to allthe information about itso in order to deal with it somehow weneed to consider it actually reviewbecause we don't have a full controlover itso it sounds a bit crazy to to put stuffconsidered to argue in a phone thatstrikes to be private or trustableum butum there is a way in this madnessbecauseweactually want to sandbox and constantlymonitor that okay stuff that black boxesthat we uh that we put into the deviceumsothe basement processor is basicallylocked into a cagewe carefully selectand thenall the signals that aretransferred from their main processor tothe basement processor and vice versaand we don't allow uh anydirect access that would could happenwithout any no adding content ofum of the main system that's controlledby the user sothere is uh obviously no directconnection to microphones or speakersumthat's all controlled by the CPUum all of the stuff like the power lineslike antennas like integrated GPSum are a monitoredso we can tell if uh if modem actuallydoes something andumthe most criticalstaff actually has a Vehicles integratedin it so we can for instance block theuhGPS antennas that so that the modem evenif basement even if you would like to uhto use itit won't be able toso thanks to such design designif the modem is compromised the mainsystem remains safesoifwe use the encryption thenand follow all of the othergood practices of beingfavored and secure we should be fineand in case the modem uh is supposed tobe off but it isn't we know that andwhat's the most important we can reactaccordingly before anything bad happensumthe the same applies to GPSumsoif we notice thatthat GPS antenna is used in a momentthatum user haven't launched any GPS basedapplication or nothing really isumGPS related is working on on the mainsystemwe know that something is is fishybut here we don't even have to uh to actquick because the antenna will bedisabled anyway so modem won't be reallyable to to use the GPSand the same with audiowe can tell that modem tries to to usethe microphonebut as it won't be directly connecteduminto the modemthen it simply won't be able you cancontrol by your own operating systemum what exactly goes into the modem soyou if you want and if you really uhif you both paranoid and uhand you like jokes you cansimply justput uh Rick Astley on on that line andplay it all the time and wonder if someNSA what some NSA agent will think aboutyou or something like thatsoum so yes when one modem when basementacts badlyuser is notified and either automatichad resetor had shut down by cutting power can beappliedum and what's important it can beappliedit's all in the control of the userbecause user can choose to to actuallyignore thatdepending on on the situation he or sheis inin some casesuh when let's say someone is reallyworried about uh about being tracked anduh is in some situation that thatumrequires him to or how to think about itum it can be chosen to to actuallyumum Leaf stuff working becausecutting it out would be let's saysuspicious but what's the most importantthe user is notified so there is a nosewhat's going on and the user canum can adjust his or her behaviorumaccordinglyyes soum for instance by removing the batterydestroying the device hiding the otherdeceit in bus and leaving but thanks toum to so things like external powerswitchwe use a that does not really have to togo into such drastic measuresum and the basement can be just turnedoff and never turned on again forinstanceum so uhleaving uh just uh external power switchwithout any monitoring uh would beumproblematic in a sense that it wouldn'tbe able to tell the user thatum that something is going somethingwrong is going onum and actually that knowledge isI think much more important that beingjust being able toto shut down the device and be sure thatit won't do anythingwe see behind our backum yesum alsoumI found some time ago um interestingarticle about answer that's not reallyarticle that was there was commentsunder sabbatical that mentioned uhinterestingumum interesting thing that can happen onsome airports andthere was actually I think someone whotried something similar than like ourmonitoring and notice thatum on the airport his phone isum simply attacked by a storm of of paycut of packetsumit turns out that lots of airportsactuallyworks somehow like a father cage andisolate then the people insidefrom the networks and it's the networksoutside soum they have their own base stationsinstead soumso the tracking on the airports can bemore effectiveumso the monitoring like that can revealuhsome activitieslike thatso yes what's what matters is that inthe end it's the user who gets the fullcontrol over how the device works andhow it reacts uh to to threats and whilestaying secure might need some effortfrom the user because obviously eventhemthe mostuh secure mostwell-designed device won'twant to do anything for you if yousimply don't use the common sense whowhile you're communicating with othersum butum when you actuallyumI got lost Okay sowhen you use a device that claims to todo all the work for youit can only give you a false sense ofsecurity uh becauseum because it's not hard to to revealaccidentally even some some things aboutyou soum giving a false sense of security iscan be actually worse than no securityat all because when you feel confidentyou can do different things that whenyou don't feel confident that you whenyou're carefulso it'sit's important to to remember that wecannot simplyumsimply forget about everything and hopethat uh private secured intestabledevice will do all the work for us it'snot like thatI have collected uh some interestingresourcesumthat I found when preparing to preparingto this presentationum there are interesting things aboutwilting SIM cardsum it'spretty fun stuff and fun and scaryuh when you consider that not onlythe stuff that's inside the the phonethat you use can be compromised but alsothat little SIM card that youwould most likely switch to the otherphone if you wouldfor instancesuspect that your previous one wassomehow come from myself that would be aSIM cardbecause theyum their encryption is also pretty weakfor today's standards uh with new newestSIM cards it's a bit betterum butthe situation is constantly changingthere so even if something new isumis introduced it pretty quickly getsbrokenum there's an interesting projectcalled GSM map that uses data collectedby people with osmo con BB devicesthat shows on a map how secure orinsecure are networksin different parts of the worldbecause it's not only phone it's alsothe the network that can be configuredin different ways more or less securenetwork can demand some authenticationor can justjust accept anything or there's alsoum I think one of those links also talksabout it and uh thing about uh howanyone on the world could with access tothe gsm network could actually uh findout wherethe recipient of his SMS is located byanalyzing how whichum SMS Centerumiswas receiving the message and nowadaysas far as I knowsome protection against that was Uplandor applied on most of the networks butthat was nevertheless very interestingthing that something like that wasfunctioning in this way for quite a longtimethere's an interesting uh report fromumof open BSC on osmocom projectsumaboutumhow they operated a test Networkumin the field andthat's an interesting part uh in itaboutum GPS assistantassisted trackingum that the base station of the networkthere's a specification that allows thebase station of the network to ask thethe phone the user phone toprovide a GPS data for instance toum for uh to betterlocation while calling for an ambulanceor stuff like that but whatwhat they found out is that when theystarted to send those packets on theirown test Networks actuallyum none of themdevices that were used by participantsof that conferenceinformed the users that the exactlocation from GPS was requested and sentto to the network so it all happenedcompletely transparently andumand turned out that most a lot of thosedevices implemented that featureumokaythere's also an interesting project alsofrom osmokom guysum named Sim Trace which is a system fortracing Sim communication between theSIM card and the mobile phoneit can be used for implementing somekind of sim firewalls or stuff like thatum unfortunately it's it would be a bitproblematic to to implement thatuminside the phone because uhthe Sim interface is actually part ofthe certification so anything that cantamper with it will probably not beallowed but nevertheless it's a veryinteresting concept and uh interestingstuff to play withum Okay sosurnameumthat's almost almost the end of thepresentation I would like to tell youabout the current status of our projectalmost 400 devices were already beenimpairedand that's already twice as much as weneeded to proceed at the beginning weassumed that if we won't get at least200 uh of the device to build and thenthat won't be worth it andwe managed toto reach a figure that's twice as muchand that's awesome and most of thedesign is actually finished right nowand the schematics are catching up withthe designumuh what's important as sourcing matteris toughas components that we need slowly fadeaway in the marketand we will have to do something withthat soonumwe have an amazing uh blog interinteractive block diagramthatwas prepared by Vanessa okayum it's under the the link uh here uhwhich can show you the architecture ofneo900 and when you uh when you hoveryour mouse pointer above any componentyou'll getmore specific information links todocumentation and stuff like that so ifyou plan to to do some veryhackish stuff with your neo900 you canalready start preparing reading all theschematics and documentation and[Music]Etcsowhat are the next steps we soon willhave to start sourcing the risk Partsthe one gigabyte RAM isthe I think the biggestone of themand there's also uhissue ofum the cases original and 900 onesas some of them[Music]of the pre-orders uhuh will be also for the complete deviceswith the case not only the thereplacement board for uh for N900soum we will have to to order all these uhstuff rather sooner than laterso we will have to actually start uhstart uhgetting the the money for for it so ifyouum if youpay the that minimal 100error that was necessary that is stillnecessary to uh to get you on the boardum in then soon we will ask you to uh toumto add something in order to to secureto actually buy the parts for you foryour deviceand what's the the most important andthe big bot and based prototypeis progressing is expectedin February to arrive it will be outalready able toumtook quite wellumsimulate the the final device so anywork onon software and system integration canbe[Music]umquite well done already on with thisprototypeso that would be it thank you for forlistening and there's the first link uhgoes to to the slides and also check thethe second one for other resources wehave onumwe prepared earlier andschematic papers visibility study andrecently there was also a paper onum oninfrared connection how it will work onon neo900 you can join the ISC channelon free note neo900and ask theask some questions we'll be glad to toanswerand I think that that's allthanksthank youwe now wait for[Music]umfor stuff in managed to announce thatso um can you turn out the sound on thatlaptopso Sebastian can you hear meyes yes I can hear yousoumthank you very much for your talkum maybe we can do a few questions ifthere are someI think we are a little bit behind theschedule so maybe two or three questionsifwe have some questions in the audienceyou can come here to the microphone andso this is life and this is delayed butif you can hear your inboxhi my name is Marcus and thank you foryour work on the neo900 I'm a huge fanum just want to raise up the point thatas soon as you dothe issue that the modem is connected tothe microphone directly is to see ifsafe CPU power while you're running aphone call so each monitoring solutionthat you might come up with will raiseyour power consumptionforeignit's actually quite easy to uh to dealwith that because there are solutionslikeum audio codecs it was actually alreadyimplemented in uh all theum open mocha and open phonics devicesit's it was also like that in Nokia and900. uh you can just root the audioconfigure the routing of the audio in away you like some moment so when youdon't want to use themodem to to have a callyou just keep them the connection to themicrophone disabled and in the momentyou start the call you enable that ofcourse the software does it for you soumthat's enough I'll look it upthe second point is I'd like to teachyou a bit how often have you changedyour estimationfor the layout of the board yethow often well well the wayumthere were delaysit changed uh a bit already a few timesumit's actually had to had to tellwe don't have aexactexact estimated time of arrival rightnow we will we are playing it a bit safenow as wenoticed as well that our estimationsaren't reallygreat but well that's pretty common inprojects like thatplease notice that in most of themthe hardware project and where somephone is developed by by some companythe project is announced publicly prettylate in thedevelopment process soum any delays any iterationssituations where whereum already prepared stuff is scrappedand done from scratchwhich happen from time to timeare simply notumnot known to the public sowhile the neo900 was actually announcedat the very beginning where nothing wasthere it just had to to raise thesupport and just then any work couldcould start so that's them that's thedownside of being completely open thatwe can updatesound likeum vaporware or something like that butrest assured that the work is going onand we're progressing and uh eventuallythis all of this stuff willsee the lightwell thank you for your commentsthank you for the questionwe have another questionno more questionsokay so once again thank you very muchthank you have a nice eveningbye bye