GoKawiilJoe Maring / Android Authority
TL;DR Google is integrating the Rust programming language into the Pixel 10’s modem firmware to mitigate memory-safety vulnerabilities such as buffer overflows.
The shift allows the modem to block Remote Code Execution (RCE) attempts triggered by malicious radio signals or SMS that require no user interaction.
While the change doesn’t affect signal strength or speed, it addresses a security vector that has been ignored by many in the industry for decades.
Practically all of us take the modem in our phones for granted. It’s a crucial component that controls network-related functions on your phone, and because of its importance, the modem runs complex and proprietary code that is notoriously difficult to secure. Google has now announced a significant shift in its security strategy, revealing that it has successfully integrated the Rust programming language into the Pixel’s baseband firmware.
While the current Pixel 9 already includes initial mitigations, the Pixel 10 is the first Pixel to feature proactive, memory-safe Rust code deeper within its modem architecture (h/t ArsTechnica).
Don’t want to miss the best from Android Authority? Set us as a favorite source in Google Discover to never miss our latest exclusive reports, expert analysis, and much more.
to never miss our latest exclusive reports, expert analysis, and much more. You can also set us as a preferred source in Google Search by clicking the button below.
Most modem firmware is traditionally written in C or C++. While these languages are efficient, they are “memory-unsafe,” meaning a single coding error can lead to vulnerabilities like buffer overflows. Hackers often target these bugs to achieve Remote Code Execution (RCE). In a worst-case scenario, an attacker could compromise a device just by sending a malicious radio signal or a specifically crafted SMS, with no user interaction required.
By moving to Rust, Google is effectively neutralizing these types of attacks. Rust is designed to prevent memory safety bugs by default, ensuring that the code simply won’t compile if it contains the types of errors that hackers typically exploit.
... continue reading