I am looking into getting a used Thinkpad to install Linux on and both models I was leaning towards have a SIM card tray and thus are capable of cellular connectivity.
My understand - which could be wrong - is that at least with a cellular phone the baseband processor is a privacy concern because it could at least technically connect to/communicate with a tower independently of the CPU, and without the user ever knowing, even in airplane mode or with cellular turned off. Because of this I am trying to minimize my cellphone (devices with baseband processors) use and what I need it for, including going as far as getting an old school dumbphone with removable battery.
Does that concern carry over to a laptop with a SIM card slot? I would never put a SIM in it, but I assume it has a baseband processor in it and it could independently communicate with a tower without me knowing right?
I assume with a laptop and linux maybe there are more options to disable that and/or disconnect it.
I was really surprised to see that old Thinkpads have SIM card slots. I was really close to getting one but now I am not sure.
Wrong. you can remove the antenna easily, you can remove the cellular modem easily. You can disable it within the EFI bios on a thinkpad.
No need to configure anything within linux. Buy the laptop take out the card, it usually is combined with the Wi-Fi card so you may have to buy one to replace it, a 1 min task and make sure it’s on the firmware model list allowed for that thinkpad unless you want to also modify the EFI image, which isn’t bad as well because Intel Management Engine is probably on it and that’s a giant back door no one talks about.
with enterprise style laptops like thinkpads, sim trays are very common, it doesn’t mean the laptop has an actual cellular modem
the modem is usually an m.2 card module that slots into the wwan slot, which you could remove if it was present, but often isn’t optioned in
combined wifi+modem cards are extremely rare in laptops, with the exception being some arm laptops in which case it is likely not removable at all due to being part of the SoC
Update: The seller/retailer confirmed it doesn’t have a WWAN module installed.
So even though according to them it has a SIM card slot (I haven’t got around to fully looking for it yet lol), it cannot connect to cellular networks.
Phew!
My understanding from talking to numerous retailers is that lots of old Thinkpads have a SIM card slot but in order for that to work it needs WWAN module and that was an optional add-on and users opting for that was not very common. So used Thinkpads with the module are not common.
None for Spectre v2 targeted towards this device, you have to weigh whether this applies against your threat model or not. If it does, pick different hardware, and if it does not, this option remains viable.
It is worth noting that there have been no known cases of Spectre V2 being exploited in the wild. That’s not to say it hasn’t been done, but depending on your threat model and budget the odds of you being personally targeted for such an attack may be low enough to just accept the risk.
Thanks for responding! I assumed that was the case. Often is with stuff like this.
I am still wrapping my head around it and looking in to it but I assume the risk is low for someone with my - low- threat model.
Do you know if it is correct to assume that mostly people with a -high- threat model should be really concerned about this? People who’s thread model includes potentially being specifically targeted?
I never even thought about checking chip vulnerabilities when buying a computer. Next time I will for sure!
Threat models aren’t a level like “high” or “low”, they’re an engagement with the threats you are concerned about and your strategies for mitigating the risks associated with them. Only you can answer such questions about your personal threat model, because the whole point of threat modeling for personal privacy is for you to address your concerns in a way that satisfies you.