To protect the device from vulnerabilities in network processor firmware, network interfaces including Wi-Fi and baseband have limited access to application processor memory. When USB or SDIO is used to interface with the network processor, the network processor can’t initiate Direct Memory Access (DMA) transactions to the application processor. When PCIe is used, each network processor is on its own isolated PCIe bus. An IOMMU on each PCIe bus limits the network processor’s DMA access to pages of memory containing its network packets or control structures.
Of course there's always the chance that there's a bug in one of these interfaces
And on Android: ¯\_(ツ)_/¯ Even for the Google Pixel I can't find a security whitepaper, just a blog post with a couple of vague bullet points.
Comments
The radios quite probably use DMA to blast bits to/from main memory.
Get code execution on the radio chip, use that to harvest the decryption keys from RAM and the rest is pretty trivial.
From the iOS security whitepaper:
Of course there's always the chance that there's a bug in one of these interfaces
And on Android: ¯\_(ツ)_/¯ Even for the Google Pixel I can't find a security whitepaper, just a blog post with a couple of vague bullet points.
Isn't the key in a part of RAM only accessible through the Secure Enclave? (As in, you shouldn't be able to set up DMA to certain ranges.)