4 ms·

Can someone post a TL;DR for those of us who can't watch video? * What's the vulnerability? * Has it been patched? * How do we mitigate it?

by wegs 6y ago

eimrine 6y ago
* How to exploit it
est31 6y ago
The video lists these links (last one has a bug in the URL, corrected by me): * https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 https://bugs.chromium.org/p/project-zero/issues/detail?id=20... * https://security.samsungmobile.com/securityUpdate.smsb https://security.samsungmobile.com/securityUpdate.smsb * https://github.com/googleprojectzero/SkCodecFuzzer https://github.com/googleprojectzero/SkCodecFuzzer TLDR: Using a fuzzer, they found multiple RCEs in a custom image format called qmage. It can be turned into a interactionless takeover by sending crafted MMS messages to a phone. A major part of the attack was defeating ASLR. The qmage vulnerabilities have been patched by Samsung in the May update.
the_pwner224 6y ago
Android has an image processing library. Samsung added support for some weird image formats by a Korean company. That is the vulnerable code. The Samsung messages app automatically downloads MMS attachments and processes them. So send weird image format via SMS => RCE. It has been patched in the latest update. The Twitter thread says that disabling MMS auto download in the messaging app [or using another MMS app?] should probably fix the 0-click aspect of it, but would still leave open other channels of exploitation.
- wegs 6y ago
  I have a Samsung phone. It doesn't seem to have an option to automatically disable MMS downloads, and last patch is from March. I'm wondering if I'm vulnerable.
kbenson 6y ago
From what I understand, the basis of the exploit is from Project Zero work[1]. Forbes also has a minimal write-up that might be easier to grok[1], but it's been long enough that I imagine you've gotten additional info already... 1: https://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.html https://googleprojectzero.blogspot.com/2020/04/fuzzing-image... 2: https://www.forbes.com/sites/forbes-personal-shopper/2020/05/06/duck-rabbit-book-meghan-markle/#35a374435be2 https://www.forbes.com/sites/forbes-personal-shopper/2020/05...

Can someone post a TL;DR for those of us who can't watch video? * What's the vulnerability? * Has it been patched? * How do we mitigate it?

by wegs 6y ago

Can someone post a TL;DR for those of us who can't watch video? * What's the vulnerability? * Has it been patched? * How do we mitigate it?

eimrine 6y ago

* How to exploit it

est31 6y ago

The video lists these links (last one has a bug in the URL, corrected by me): * https://bugs.chromium.org/p/project-zero/issues/detail?id=2002 https://bugs.chromium.org/p/project-zero/issues/detail?id=20... * https://security.samsungmobile.com/securityUpdate.smsb https://security.samsungmobile.com/securityUpdate.smsb * https://github.com/googleprojectzero/SkCodecFuzzer https://github.com/googleprojectzero/SkCodecFuzzer TLDR: Using a fuzzer, they found multiple RCEs in a custom image format called qmage. It can be turned into a interactionless takeover by sending crafted MMS messages to a phone. A major part of the attack was defeating ASLR. The qmage vulnerabilities have been patched by Samsung in the May update.

the_pwner224 6y ago

Android has an image processing library. Samsung added support for some weird image formats by a Korean company. That is the vulnerable code. The Samsung messages app automatically downloads MMS attachments and processes them. So send weird image format via SMS => RCE. It has been patched in the latest update. The Twitter thread says that disabling MMS auto download in the messaging app [or using another MMS app?] should probably fix the 0-click aspect of it, but would still leave open other channels of exploitation.

wegs 6y ago
I have a Samsung phone. It doesn't seem to have an option to automatically disable MMS downloads, and last patch is from March. I'm wondering if I'm vulnerable.

kbenson 6y ago

From what I understand, the basis of the exploit is from Project Zero work[1]. Forbes also has a minimal write-up that might be easier to grok[1], but it's been long enough that I imagine you've gotten additional info already... 1: https://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.html https://googleprojectzero.blogspot.com/2020/04/fuzzing-image... 2: https://www.forbes.com/sites/forbes-personal-shopper/2020/05/06/duck-rabbit-book-meghan-markle/#35a374435be2 https://www.forbes.com/sites/forbes-personal-shopper/2020/05...