13 ms·

Snapdragon chip flaws put 1B Android phones at risk of data theft

247 points by jiripospisil 6y ago

ChuckNorris89 6y ago
The article is pretty spartan in details regarding the vulnerability but as I understand it, the DSP is the attack vector. Wouldn't it make sense for Qualcomm to hardware/software sandbox the memory content being processed by each part of the SoC? Would such an attack also work on PCs with iGPUs, since they share the system memory?
- not2b 6y ago
  If they isolate the memory that each part of the SoC can process, that means large amounts of data (for high definition video) have to be copied from one processor to another, so there's direct access. Then if the DSP's firmware has buffer overrun bugs, craft a suitable video and read/write whatever memory area you want to. (Not sure that this is what the bug is, but it's my guess).
- acdha 6y ago
  Yes - that’s what iOS devices and modern computers do. The risks of allowing unrestricted DMA started to get publicized in the mid-2000s when FireWire was used to attack locked Macs. IOMMUs are pretty common now but the OS still has to enable them.
  - RL_Quine 6y ago
    The modern version of that is thunderbolt naturally.
  - ajross 6y ago
    IOMMUs aren't the only way to get secure DMA, it's more common for small devices to have a double-ended device where the other end (OS vs. DSP in this case) needs to set up its own pointers itself. Doing it via page mapping is very heavyweight and used for performance reasons when you need both safety AND fast random access to large regions.
    - acdha 6y ago
      Yes - my main reaction was just that it was something of a surprise to see Qualcomm not using any of the common countermeasures for a class of attack which is not new and for which they’ve had problems in the past.
- ajross 6y ago
  They likely do sandbox it to some extent. It's routine for these devices to have their own SRAM decoupled from main memory, and to have a hardware-managed window to get to OS-visible RAM. Often there's a DMA controller that does that instead, etc... But all sandboxes can have holes. The phrasing in the article actually makes it sound more like this is a software bug in the firmware and not a hardware thing per se. GPUs likewise have a somewhat cooked visibility to DRAM and some amount of mapping and hardware DMA intermediate interfaces. But sure, a similar GPU flaw could do the same thing.
Ijumfs 6y ago
Android phones are constantly stealing your data, I'm not sure why a processor vulnerability would be cause for alarm when your entire OS is a data exfiltration and surveillance platform.
- xarthna 6y ago
  Can you explain this more?
  - Ijumfs 6y ago
    I welcome you to read the Android privacy policy. It's all explained in there for you.
- Wronnay 6y ago
  That's simply not true. AOSP is open source and you can run a Android phone without google services. You are generalizing the problem of some phone manufactures which deliver phones with software which spies on you but the OS isn't a surveillance platform - instead it's more open than iOS - you can't look at the source code of iOS as simple as you can look at the Android source code.
tpmx 6y ago
Yikes. Could Google theoretically remotely disable/remove apps that they identify using the DSP in malicious ways?
- roneythomas6 6y ago
  Yes they can through google play protect. But first they need to identify the app.
  - tpmx 6y ago
    You'd think they'd launch a crash program immediately to do exactly this. "Noone sleeps until this is fixed." Somehow I doubt that is going to happen, and that's also why I don't use Android.
    - deleted 6y ago
      [deleted]
    - steelframe 6y ago
      "Noone sleeps until this is fixed" sounds like a great way to make things even worse.
      - tpmx 6y ago
        Poor underpaid google workers.
        Xylakant 6y ago
        It’s not about pay. People that don’t sleep make mistakes - no matter what you pay them. Rest is an essential part of performance. Some people may need more and others less, but there’s no one that doesn’t.
        tpmx 6y ago
        Oh ffs... If your 2020 Google had been in charge of the Apollo 13 mission it would have been game over. .. I will spell it out: Sometimes your software team messes up really badly. This would be one of those times: 1 billion vulnerable people. These things don't happen that often, but when they do happen your better step up.
swordbeta 6y ago
DEF CON talk given by Check Point a few days ago: https://www.youtube.com/watch?v=CrLJ29quZY8 https://www.youtube.com/watch?v=CrLJ29quZY8
awinter-py 6y ago
Checkpoint's release for these vulnerabilities is here https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/ https://blog.checkpoint.com/2020/08/06/achilles-small-chip-b... not clear from the writeup how many devices are affected. They fuzz-tested 'a DSP chip' (sounds like just one) and then say that Qualcomm products are used in 40% of devices. press release focuses on exfiltrating media + GPS, not clear if this is a rootkit that can access the keyboard or take over your email. 'more than 400 vulnerable pieces of code were found' not clear to me -- maybe I don't know how fuzzing DSPs work? Do they have access to the source code because the image decoder is open source?
- wyldfire 6y ago
  The qemu linux userspace implementation for hexagon is recently available and open source, yes. Not sure whether it would've been any harder to do fuzzing with the closed-source simulator that's been available for a long time. But the fuzzer doesn't need the libraries' source, it just makes it easier for the fuzzer if it has access to the source. And the availability of emulator or simulator code is probably independent of this too. The 400 distinct bugs are the uniquely faulting instructions or paths uncovered by the fuzzer.
deleted 6y ago
[deleted]
0xcde4c3db 6y ago
Ah, so it's actually pretty simple to avoid this vulnerability: all I need to do is upgrade to an Android phone based on one of the several competitive Snapdragon alternatives that are bound to be widely available given the staggering size of the market. Hold on, I'm sure I'll find one any minute now...
- gruez 6y ago
  What about samsung exynos and mediatek?
  - topicseed 6y ago
    The new Samsung Galaxy Note 20 Ultra ships with Exynos in the UK and EU but performance drops against the same phone running Snapdragon (shipped in the US). So whilst the security might be better, we're (tech geeks in EU/UK) don't want to pay the same price for a less performant phone sadly :/ But maybe in a few iterations!
    - iakov 6y ago
      I'm wondering why do people need the "performant phone". All the Android phones that I've had or seen in the last few years run the OS and apps with no issues. The amount of RAM might limit the multi-tasking, but otherwise I can't imagine a real-life use-case where I may want a "performant phone". Can you maybe shed some light on this for me, please?
      - nxc18 6y ago
        It starts to matter a lot with things like AR, video games etc. I work on an AR mobile product and the performance advantage for iOS is substantial. Outside of flagships, the performance of AR on android is pretty bad, while as far back as iPhone 8 you’re maintaining 60fps no problems. I haven’t tested older than that but I tend to believe the oft-quoted 5 year performance lead on the A series chips.
        6y ago
krn 6y ago
I have never had an iOS device in my life, but these three paragraphs provide probably the most convincing reason to finally make the switch: > A billion or more Android devices are vulnerable to hacks that can turn them into spying tools by exploiting more than 400 vulnerabilities in Qualcomm’s Snapdragon chip, researchers reported this week. > The vulnerabilities can be exploited when a target downloads a video or other content that’s rendered by the chip. Targets can also be attacked by installing malicious apps that require no permissions at all. > From there, attackers can monitor locations and listen to nearby audio in real time and exfiltrate photos and videos. Exploits also make it possible to render the phone completely unresponsive. Infections can be hidden from the operating system in a way that makes disinfecting difficult.
- slipheen 6y ago
  I like Apples devices, but aren't they just as vulnerable to CPU bugs? There's plenty of good reasons to use an iOS device (and some good reasons to avoid one), but I wouldn't think that CPU bug would be a particularly strong reason on either side.
  - GeekyBear 6y ago
    Bugs can be discovered anywhere. The question is whether those bugs will be patched. The original iPhone SE is about to start it's sixth year of OS updates and security patches. Which works out to less than $70 per supported year. That's a legitimate advantage over the Android ecosystem.
    - darksaints 6y ago
      In my personal experience, the sole reason for those updates is to cripple your hardware and battery life in order for you to upgrade to newer hardware.
      - lotsofpulp 6y ago
        In my experience, my iPhone 6 is perfectly usable, as is an old SE and 6S Plus. Batteries degrade, and after being replaced they work fine. And they’re still getting updates this year.
giudittapasta 6y ago
Uhm wasn't this already the case in augustus 2019?
ezekiel68 6y ago
Yet another reason why the protectionist hit job on Huawei was a bad idea. My Mate 30 Pro will not be affected by this flaw.
- spoopyskelly 6y ago
  > My Mate 30 Pro will not be affected by this flaw It will just keep being affected by being a bad phone.
afrcnc 6y ago
Blog spam. Typical ArsTechnica these days. Here's the actual report: https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/ https://blog.checkpoint.com/2020/08/06/achilles-small-chip-b...
- wffurr 6y ago
  Thanks for the link, but the Ars report provides some additional context that I think is informative and useful, and is written in a more readable style than the Checkpoint press release.
- stefan_ 6y ago
  Honestly this "report" is similarly devoid of any substantive content despite being the original source. At some point they discuss the dictionary meaning of DSP. Your best bet for any details is apparently this DEF CON presentation: https://www.youtube.com/watch?v=CrLJ29quZY8 https://www.youtube.com/watch?v=CrLJ29quZY8
1MachineElf 6y ago
Half amused, I wonder if the odd recommendations we get on YouTube from time to time are actually steganographs meant to distribute surveillance malware that leveragea this technique.

247 points by jiripospisil 6y ago

The article is pretty spartan in details regarding the vulnerability but as I understand it, the DSP is the attack vector. Wouldn't it make sense for Qualcomm to hardware/software sandbox the memory content being processed by each part of the SoC? Would such an attack also work on PCs with iGPUs, since they share the system memory?

not2b 6y ago
If they isolate the memory that each part of the SoC can process, that means large amounts of data (for high definition video) have to be copied from one processor to another, so there's direct access. Then if the DSP's firmware has buffer overrun bugs, craft a suitable video and read/write whatever memory area you want to. (Not sure that this is what the bug is, but it's my guess).
acdha 6y ago
Yes - that’s what iOS devices and modern computers do. The risks of allowing unrestricted DMA started to get publicized in the mid-2000s when FireWire was used to attack locked Macs. IOMMUs are pretty common now but the OS still has to enable them.
- RL_Quine 6y ago
  The modern version of that is thunderbolt naturally.
- ajross 6y ago
  IOMMUs aren't the only way to get secure DMA, it's more common for small devices to have a double-ended device where the other end (OS vs. DSP in this case) needs to set up its own pointers itself. Doing it via page mapping is very heavyweight and used for performance reasons when you need both safety AND fast random access to large regions.
  - acdha 6y ago
    Yes - my main reaction was just that it was something of a surprise to see Qualcomm not using any of the common countermeasures for a class of attack which is not new and for which they’ve had problems in the past.
ajross 6y ago
They likely do sandbox it to some extent. It's routine for these devices to have their own SRAM decoupled from main memory, and to have a hardware-managed window to get to OS-visible RAM. Often there's a DMA controller that does that instead, etc... But all sandboxes can have holes. The phrasing in the article actually makes it sound more like this is a software bug in the firmware and not a hardware thing per se. GPUs likewise have a somewhat cooked visibility to DRAM and some amount of mapping and hardware DMA intermediate interfaces. But sure, a similar GPU flaw could do the same thing.

Ijumfs 6y ago

Android phones are constantly stealing your data, I'm not sure why a processor vulnerability would be cause for alarm when your entire OS is a data exfiltration and surveillance platform.

xarthna 6y ago
Can you explain this more?
- Ijumfs 6y ago
  I welcome you to read the Android privacy policy. It's all explained in there for you.
Wronnay 6y ago
That's simply not true. AOSP is open source and you can run a Android phone without google services. You are generalizing the problem of some phone manufactures which deliver phones with software which spies on you but the OS isn't a surveillance platform - instead it's more open than iOS - you can't look at the source code of iOS as simple as you can look at the Android source code.

tpmx 6y ago

Yikes. Could Google theoretically remotely disable/remove apps that they identify using the DSP in malicious ways?

roneythomas6 6y ago
Yes they can through google play protect. But first they need to identify the app.
- tpmx 6y ago
  You'd think they'd launch a crash program immediately to do exactly this. "Noone sleeps until this is fixed." Somehow I doubt that is going to happen, and that's also why I don't use Android.
  - deleted 6y ago
    [deleted]
  - steelframe 6y ago
    "Noone sleeps until this is fixed" sounds like a great way to make things even worse.
    - tpmx 6y ago
      Poor underpaid google workers.
      - Xylakant 6y ago
        It’s not about pay. People that don’t sleep make mistakes - no matter what you pay them. Rest is an essential part of performance. Some people may need more and others less, but there’s no one that doesn’t.
        tpmx 6y ago
        Oh ffs... If your 2020 Google had been in charge of the Apollo 13 mission it would have been game over. .. I will spell it out: Sometimes your software team messes up really badly. This would be one of those times: 1 billion vulnerable people. These things don't happen that often, but when they do happen your better step up.

swordbeta 6y ago

DEF CON talk given by Check Point a few days ago: https://www.youtube.com/watch?v=CrLJ29quZY8 https://www.youtube.com/watch?v=CrLJ29quZY8

awinter-py 6y ago

Checkpoint's release for these vulnerabilities is here https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/ https://blog.checkpoint.com/2020/08/06/achilles-small-chip-b... not clear from the writeup how many devices are affected. They fuzz-tested 'a DSP chip' (sounds like just one) and then say that Qualcomm products are used in 40% of devices. press release focuses on exfiltrating media + GPS, not clear if this is a rootkit that can access the keyboard or take over your email. 'more than 400 vulnerable pieces of code were found' not clear to me -- maybe I don't know how fuzzing DSPs work? Do they have access to the source code because the image decoder is open source?

wyldfire 6y ago
The qemu linux userspace implementation for hexagon is recently available and open source, yes. Not sure whether it would've been any harder to do fuzzing with the closed-source simulator that's been available for a long time. But the fuzzer doesn't need the libraries' source, it just makes it easier for the fuzzer if it has access to the source. And the availability of emulator or simulator code is probably independent of this too. The 400 distinct bugs are the uniquely faulting instructions or paths uncovered by the fuzzer.

deleted 6y ago

[deleted]

0xcde4c3db 6y ago

Ah, so it's actually pretty simple to avoid this vulnerability: all I need to do is upgrade to an Android phone based on one of the several competitive Snapdragon alternatives that are bound to be widely available given the staggering size of the market. Hold on, I'm sure I'll find one any minute now...

gruez 6y ago
What about samsung exynos and mediatek?
- topicseed 6y ago
  The new Samsung Galaxy Note 20 Ultra ships with Exynos in the UK and EU but performance drops against the same phone running Snapdragon (shipped in the US). So whilst the security might be better, we're (tech geeks in EU/UK) don't want to pay the same price for a less performant phone sadly :/ But maybe in a few iterations!
  - iakov 6y ago
    I'm wondering why do people need the "performant phone". All the Android phones that I've had or seen in the last few years run the OS and apps with no issues. The amount of RAM might limit the multi-tasking, but otherwise I can't imagine a real-life use-case where I may want a "performant phone". Can you maybe shed some light on this for me, please?
    - nxc18 6y ago
      It starts to matter a lot with things like AR, video games etc. I work on an AR mobile product and the performance advantage for iOS is substantial. Outside of flagships, the performance of AR on android is pretty bad, while as far back as iPhone 8 you’re maintaining 60fps no problems. I haven’t tested older than that but I tend to believe the oft-quoted 5 year performance lead on the A series chips.
      - 6y ago

krn 6y ago

I have never had an iOS device in my life, but these three paragraphs provide probably the most convincing reason to finally make the switch: > A billion or more Android devices are vulnerable to hacks that can turn them into spying tools by exploiting more than 400 vulnerabilities in Qualcomm’s Snapdragon chip, researchers reported this week. > The vulnerabilities can be exploited when a target downloads a video or other content that’s rendered by the chip. Targets can also be attacked by installing malicious apps that require no permissions at all. > From there, attackers can monitor locations and listen to nearby audio in real time and exfiltrate photos and videos. Exploits also make it possible to render the phone completely unresponsive. Infections can be hidden from the operating system in a way that makes disinfecting difficult.

slipheen 6y ago
I like Apples devices, but aren't they just as vulnerable to CPU bugs? There's plenty of good reasons to use an iOS device (and some good reasons to avoid one), but I wouldn't think that CPU bug would be a particularly strong reason on either side.
- GeekyBear 6y ago
  Bugs can be discovered anywhere. The question is whether those bugs will be patched. The original iPhone SE is about to start it's sixth year of OS updates and security patches. Which works out to less than $70 per supported year. That's a legitimate advantage over the Android ecosystem.
  - darksaints 6y ago
    In my personal experience, the sole reason for those updates is to cripple your hardware and battery life in order for you to upgrade to newer hardware.
    - lotsofpulp 6y ago
      In my experience, my iPhone 6 is perfectly usable, as is an old SE and 6S Plus. Batteries degrade, and after being replaced they work fine. And they’re still getting updates this year.

giudittapasta 6y ago

Uhm wasn't this already the case in augustus 2019?

ezekiel68 6y ago

Yet another reason why the protectionist hit job on Huawei was a bad idea. My Mate 30 Pro will not be affected by this flaw.

spoopyskelly 6y ago
> My Mate 30 Pro will not be affected by this flaw It will just keep being affected by being a bad phone.

afrcnc 6y ago

Blog spam. Typical ArsTechnica these days. Here's the actual report: https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/ https://blog.checkpoint.com/2020/08/06/achilles-small-chip-b...

wffurr 6y ago
Thanks for the link, but the Ars report provides some additional context that I think is informative and useful, and is written in a more readable style than the Checkpoint press release.
stefan_ 6y ago
Honestly this "report" is similarly devoid of any substantive content despite being the original source. At some point they discuss the dictionary meaning of DSP. Your best bet for any details is apparently this DEF CON presentation: https://www.youtube.com/watch?v=CrLJ29quZY8 https://www.youtube.com/watch?v=CrLJ29quZY8

1MachineElf 6y ago

Half amused, I wonder if the odd recommendations we get on YouTube from time to time are actually steganographs meant to distribute surveillance malware that leveragea this technique.