Librem 5 compromised?

I would like to consult about Librem5.

I introduced your company’s product and have been using it for over 3 years because I have been subjected to personally targeted attacks.

Lately, when my friend and wife call me, they often hear music instead of my voice, and I can’t have a conversation because of the silence, so I often have to hang up on them.

An evil hacker had rewritten the program so that when I called, when I answered the phone, instead of my voice, music I’d never heard was played to the person on the other end of the phone who called me. However, I left it alone because I could just call back from my call history.

Starting today, I can access the internet, but I can’t make phone calls. I thought it was a problem with the phone company, but I was able to make calls by replacing the SIM card with a device with another OS such as Android, so it’s not the phone company’s problem.

The phone was working until yesterday. Recently, I have been inquiring through the support desk of manufacturers around the world about EDR/XDR security software that can be used with Librem5. As I did so, the situation worsened and from today onwards I was unable to make or receive calls. Even if I did ``Reflashing the Phone’', the programs below the OS level were rewritten and the phone was always turned off and the radio waves were not reaching, so now I can’t make or receive calls from home.

Please let me know how I can get my phone back to its original state so I can make and receive calls.

https://developer.puri.sm/Librem5/Development_Environment/Phone/Troubleshooting/Reflashing_the_Phone.html

I’ve done this many times before and tried to initialize attacks from bad hackers and take countermeasures, but this time it wasn’t possible.

Please provide advice and support for recovery.

What I have done so far to recover Librem5 calls

I have two modems, so even if I replaced it with another modem, I couldn’t make calls.

I changed the OS from PureOS to mobian, but I still can’t make calls.

There was a high possibility that the BIOS of the computer had been rewritten when it was attacked, so after initializing it, I set up various security and password settings, and now I can use Debian 12 stably.

I think it was probably the same attack as before, tampering with the firmware.

There is no documented method for correcting firmware tampering, so I have contacted support but have not received a response yet.

If you are a Purism staff member and see this, please let me know how to deal with it. Alternatively, I would like to send Librem5 to Purism for repair, so I sent an email to support, but there was no reply. Please tell me that you would like a reply email.

1 Like

Reply is not instantaneous. When did you email Purism Support?

Of course, if your environment has really been completely compromised then you won’t receive any reply emails.

It is unclear which “computer” is referred to here. There is no BIOS on the Librem 5 though.

What was the error message? Which steps worked? Which step did not work? Do you have a log? (with sensitive information redacted)

2 Likes

The transmission time is April 18th.(Japan time) I have sent it to support.
It will be firmware. The U-Boot command line is also unusable.

https://developer.puri.sm/Librem5/Development_Environment/Phone/Troubleshooting/Reflashing_the_Phone.html
The error message here is “No matching image found”.

The steps are as follows after each installation:
cd librem5-flash-image
sudo ./scripts/librem5-flash-image
Output result
2024-04-22 17:49:38 INFO Looking for librem5r4 luks byzantium image
2024-04-22 17:49:53 ERROR No matching image found
It will be.
I would appreciate your advice.
I also used translation software for the main text, so please forgive me if some parts of the English are a bit strange.

1 Like

This doesn’t sound like a mysterious error message, or suggestive of any compromise.

Maybe though use
sudo ./scripts/librem5-flash-image --stable

Given that that is before the weekend, I don’t think you have waited long enough.

3 Likes

Thank you for your prompt response and advice.
I regained some calmness and composure. Thank you very much.
Is it simply a malfunction if I can’t make a phone call even after returning to PureOS and inserting a SIM card?
Or maybe only the phone (calls) are turned off due to tampering with the firmware.
If so, is it possible to improve the situation?
I would be very happy if you could tell me how to initialize the firmware for Librem5 (pureos).

I searched for it using the above search, but I would like to know how to initialize the official firmware.
I look forward to your continued support.

2 Likes

The modem firmware was updated multiple times within the last three years, so your Librem 5 is likely due for various firmware updates. You can determine the modem firmware version by using bm818-tools:

sudo apt install bm818-tools

Afterwards, restart your Librem 5, then open the app, which looks like a blue circle containing a Wi-Fi symbol. You should see a screen similar to the one below:

If it does not match the timestamps, contact Purism support for instructions on updating your modem firmware, then report back in this thread after successfully performing the upgrade procedure.

2 Likes

Did you actually try the replacement command that I gave you and if so what was the result?

1 Like

Dear Mr.irvinewade
Thank you very much.
Librem5 has successfully returned to PureOS state.
This is the command executed below.

cd librem5-flash-image
sudo ./scripts/librem5-flash-image --stable

It was very helpful! Thank you.

However, the phone still cannot make calls. SMS and internet are available.
I would like to update the firmware, so could you please tell me how?

sudo apt install bm818-tools

I will post a screenshot of the firmware using bm818 tools.
Since it is old firmware, please tell me how to update to new firmware.
I look forward to your continued support.

2 Likes

Dear Mr.FranklyFlawless
Thank you very much. Thank you for your help.
Thank you very much for introducing me to the formware application.
I am happy to be able to help the staff and users.
Now that I have understood the current situation using bm818tools, I will do my best to update the firmware.
Thank you very much for your advice!

1 Like

To update the firmware, please send an email to support@puri.sm to get the download and install instructions. I recommend making the title of your email “BM818 firmware upgrade instructions needed” or something similar, so that they will notice it quickly.

The upgrade process is easy.

2 Likes

For clarity … you are talking about the modem firmware. There is quite a lot of other firmware in other components of the Librem 5. The modem firmware is clearly the most relevant to being able to make calls, or not.

Mobile service providers around the world are turning off the 3G network and thereby requiring VoLTE support in the phone. So if you suddenly cannot make calls, that could be the reason (although in general your mobile service provider will give you notice in advance of the 3G shutdown).

When you contact Purism Support, I would mention to them which modem variant you have i.e. -E1, -A1 or -T1. It is a pity really that bm818-tools does not display that information.

3 Likes

Hello.
Thank you very much for your advice.
Librem5 is now able to make phone calls.
I would like to thank everyone and the Purism support staff for their assistance. thank you very much.

4 Likes

Great, mark my post as a solution, and thank you for reporting back.

2 Likes