people • Anti-malware ◦ 99.9%* of Android malware is bullshit toll fraud • MDM ◦ “Manage” your way out of an insecure platform ◦ HEY I CAN SEE ALL MY VULNERABLE DEVICES, YAY! • Other features of mobile “security” products ◦ Find my phone (G does it), backup (G does it), …? * I just made this up, kinda
try to fix the underlying issues? ◦ “Enumerating badness” always doomed to fail ◦ Naw, that’s crazy talk! • Underlying issues (in our not-so-humble opinion) ◦ Lack of platform integrity ◦ Privilege escalation vulns, large attack surface ◦ Huge windows of vuln due to slow/non-existing patching practices
vulns and solutions ◦ Vulns in native and managed code ◦ More than privesc! • Let’s show what can be done ◦ Mostly PoC, but deployed to 100k’s of real-world devices ◦ If we can do this on the cheap, maybe Big Corp can do it for reals • “Defensive” talk, booooooooo vs.
a perfect world… • AOSP: Google ships a secure base platform. • OEM: Samsung and third-party suppliers don’t introduce vulns in their handsets and customizations. • Carrier: T-Mobile rolls out rapid OTA updates to keep users up to date and patched.
the real world… • AOSP: Android improving mitigations, but slowly. • OEM: Customizations by device OEMs are a primary source of vulnerabilities. • Carrier: Updates are not made available for months and sometimes even years.
the real world… • AOSP: Android improving mitigations, but slowly. • OEM: Customizations by device OEMs are a primary source of vulnerabilities. • Carrier: Updates are not made available for months and sometimes even years. All software has vulns, mobile or otherwise. Failing to deliver patches is the real issue.
must be integrated and tested for different platforms to ensure the best possible user experience. Therefore, distribution varies by manufacturer and device." - AT&T
must be integrated and tested for different platforms to ensure the best possible user experience. Therefore, distribution varies by manufacturer and device." - AT&T
security model • Permissions framework, “sandboxing” (Linux uid/gid) • Compromise of browser (or other app) != full control of device • Privilege escalation vulnerabilities • Unprivileged code execution → Privileged code execution • Publicly released to allow users to jailbreak their devices • Public exploits reused by mobile malware to root victim's devices • Ooooh, fancy mobile privesc, right???
with the following code? • Assuming a uid/euid=0 process dropping privileges... /* Code intended to run with elevated privileges */ do_stuff_as_privileged(); /* Drop privileges to unprivileged user */ setuid(uid); /* Code intended to run with lower privileges */ do_stuff_as_unprivileged();
not checked! setuid(2) can fail: • Android's zygote does fail if setuid does: • Fork until limit, when setuid fails, app runs as uid 0! EAGAIN The uid does not match the current uid and uid brings process over its RLIMIT_NPROC resource limit. err = setuid(uid); if (err < 0) { LOGW("cannot setuid(%d): %s", uid, strerror(errno)); }
How can we measure this problem? • X-Ray for Android • DARPA CFT funded • Performing _actual_ vuln assessment on mobile • Detects most common privescs • Works without any special privileges or permissions
Static probes • Can identify vulnerabilities using static analysis • Send up vulnerable component (eg. binary, library) to service • Disassemble and look for patched/vulnerable code paths libdvm.so result Analyze!
Dynamic probes • Not all vulnerabilities are in software components we can access • Example: kernel vulns, kernel image not accessible by X-Ray • Probe locally for vulnerability presence! • Basically sad, neutered, wacky half exploits :-( halp! liblevitator_v1.so Execute! result X-Ray Service
Google Play*, but free for download at http://xray.io • Results collected by us (and Five Eyes) from users who ran the X-Ray app on their Android device: 74,405 devices 4,312 models 190 countries * don’t ask
Android fragmentation is _real_ ◦ Not for app dev, but for exploit dev • X-Ray’s binary dataset ◦ 3,124 unique libsysutils.so ◦ 5,936 unique libdvm.so ◦ 5,303 unique vold • If only there was a way to collect all those binaries...
after the X-Ray release… • Percent of the global Android population that are vulnerable to a privilege escalation detected by X-Ray... 60.6% vulnerable
out to global Android population? • Selection bias? • Google provides stats on Android versions → • If we saw 98.8% of 2.2 devices were vulnerable, and 2.2 makes up 15.5% of Android globally, that contributes 15.3% to the total % of vulnerable Android devices.
41.2% vulnerable Early 2013 Late 2012 13.4% vulnerable Early 2014 Looks like OK progress, but... Only measuring those original 8 ancient privesc vulns from X-Ray 1.0, not any new ones!
that shouldn’t be patched, but are! • Version 2.3.2, but not vuln to gingerbreak • Backports without version bumps • Versions that should be patched, but aren’t! • Version 4.1, but still vuln to mempodroid • Incomplete patching, regressions • OEM vendors relying on public exploits to do vuln assessment
vulnerability affects Android devices with the PowerVR SGX chipset which includes popular models like the Nexus S and Galaxy S series. The vulnerability was patched in the Android 2.3.6 OTA update.” It’s like PRISM...for Android! mysql> SELECT COUNT(DISTINCT(model)) FROM results WHERE probe='levitator' AND result='vulnerable'; +------------------------+ | COUNT(DISTINCT(model)) | +------------------------+ | 136 | +------------------------+ mysql> SELECT DISTINCT(model) FROM results WHERE probe='levitator' AND result='vulnerable' AND model LIKE '%Kindle%'; +-------------+ | model | +-------------+ | Kindle Fire | +-------------+ OOPS!
USA, FVEY//20230108 ➢ (S//SI//REL) Covert platform for mobile TAO implants ◦ Highly successful (~75,000 active implants worldwide) ➢ (S//SI) Metadata selector types ◦ Device ID, manufacturer, model, version, carrier, country, IP address, vulnerability state ➢ (S//SI) Integrates with POOPCHUTE and BLAMEVUPEN ◦ Palm Pilot support in development XRAY Project Results
source code ◦ AOSP != code running on devices ◦ modifications by OEMs • Can’t modify system files and/or partitions ◦ patched binaries might brick device ◦ cannot replace signed partitions or files on them • Scalability and testing ◦ too many different devices and OS versions ◦ patches need to be decoupled form source code
for Android ◦ includes: attack detection and warning mechanism • Independent of device and Android version ◦ support for Dalvik bytecode and native code
only develop patch once, patch any device ◦ test patches in the field • Practical ◦ almost no overhead (user won’t notice any) ◦ we don’t need source code ▪ not everything of Android is open source
In-memory patching at runtime ◦ need to patch processes at startup ▪ before process executes vulnerable code ▪ monitor system for new processes ◦ no need to modify system files or system partitions ▪ important!
• Patches as independent code ◦ self-contained shared library ◦ patching via function hooking ◦ no access to original source code required ◦ scale across different OS versions
Replacement for vulnerable function ◦ equivalent code without vulnerability ◦ wrapper that adds input/output sanitization • Install ◦ hook vulnerable function ▪ keep original function usable, we will need it later • Communication link ◦ read config parameters ◦ write log messages, report attacks
Patch failure ◦ detected using telemetry ◦ failing patch is removed • This is tricky ◦ works only to certain extend ◦ but enables some kind of field testing
patch from source, transform to PatchDroid patch ◦ apply patch strategy best suited for vulnerability ◦ sources: e.g., AOSP, Cyanogen, etc... • Develop custom patch ◦ vulnerability known, but no patch available
call orig method and check return value ◦ throw exception if result != null • LinkedHashMap is used outside of ZipFile ◦ need to only patch behavior in ZipFile code • Hook: java.util.ZipFile.readCentralDir() ◦ install hook for LinkedHashMap ◦ call original readCentralDir() ◦ unhook LinkedHashMap
the patch daemon ◦ monitor system for newly created process ◦ inject patches into process ◦ monitor patched process • PatchDroid App ◦ UI ◦ Helper Service ◦ Attack Notification
the patch daemon ◦ monitor system for newly created process ◦ inject patches into process ◦ monitor patched process • PatchDroid App ◦ UI ◦ Helper Service ◦ Attack Notification
based on ADBI ◦ framework for hooking native code on Android ◦ http://github.com/crmulliner/adbi/ • Dalvik patches based on DDI ◦ framework for hooking Dalvik methods ◦ http://github.com/crmulliner/ddi/
for monitoring and injection ◦ most target processes run as root ◦ patchd -> requires root • PatchDroid app lives in /data/data/… ◦ no need to modify ‘/system’ file system ▪ often signed and checked by bootloader ◦ can be installed/removed like any other app ▪ we don’t want to brick devices
the guys from BlueBox • Bug in handling of APK files ◦ APK can be modified without breaking its signature • Can be used for privilege escalation (root device) ◦ modify APK signed with platform/oem key ◦ that APK roots any device from given OEM!
multiple bugs • Bugs in Java code (Dalvik bytecode) ◦ first priv esc vuln due to bug in Dalvik bytecode • Bug present in AOSP until version 4.3 ◦ Affected almost all Android devices at that time
M, is badly hacked and your software detected it, after I found obvious examples (all of which I video- taped). Help please if possible? Thank you.” STAHP.
fucked • More public pressure on the responsible parties • Top-down from Google • Bottom-up from users and companies • Open up platform security to third-parties? • Allow enterprises, third-parties to offload patching responsibility • Better platform security in general, less vulns to patch
ReKey ◦ basically working but still a PoC • Add patches for vendor specific bugs!? ◦ that’s a lot of bugs • Open Source it? ◦ X-Ray probes are woefully out of date ◦ Exynos, Webkit, MasterKey, etc ◦ Interest in open source version for community development and new probes?
framework ◦ made for modding Android without reflashing FW ◦ replaces zygote • Cydia Substrate ◦ mode for modding Android without reflashing FW ◦ complex
duosec
tatsuya1970
kaonavi
appleboy
vtryo
hiranabe
isaoshimizu
subroh0508
kentarofujii
fullkaiten
sh_fk2
cscengineer
codingconduct
3n
ianozsvald
ipullrank
katarinadahlin
oripsolob
rkendrick25
axbom
kimpetersen
frankvandijk
gurzu
marcelosomers
