10 ms·

Google: Turn off VoLTE, Wi-Fi calling: severe Exynos modem vulnerabilities

341 points by dmitrygr 4y ago

thaumasiotes 4y ago
> Project Zero’s advice for those impacted follows: >> Until security updates are available, users who wish to protect themselves from the baseband remote code execution vulnerabilities in Samsung’s Exynos chipsets can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings. Turning off these settings will remove the exploitation risk of these vulnerabilities. > Google Pixel devices received software updates in 2021 that automatically enabled VoLTE and removed the toggle. That's some great advice.
- toast0 4y ago
  If you turn off VoLTE and Wi-Fi calling, I don't think you can get calls in the US, so I'm not suprised VoLTE can't be disabled.
  - yaomtc 4y ago
    Isn't LTE part of 4G? What about 5G?
  - josephcsible 4y ago
    I don't know about you, but I'd way rather not be able to get calls until Monday than be vulnerable to this exploit.
    - toast0 4y ago
      That's probably the right choice, if there's a firmware update on Monday. If not, it's probably time to buy a new phone.
    - mcsniff 4y ago
      If you are currently, you probably have been vulnerable to this and many other undisclosed vulns for years, 3 days isn't going to move the needle much in terms of risk, but indeed it is a step to take.
      - josephcsible 4y ago
        Doesn't everyone knowing the vulnerability exists now move the needle significantly?
- deleted 4y ago
  [deleted]
- flas9sd 4y ago
  even in Androids phone diagnostics? *#*#4636#*#*
dmitrygr 4y ago
"Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number. With limited additional research and development, we believe that skilled attackers would be able to quickly create an operational exploit to compromise affected devices silently and remotely." Funsies...
- Steltek 4y ago
  It's skilled attackers in proximity with radio gear and a laptop, right? This sucks for a lot of people but I don't think I'm on the list of targets such actors would care about.
  - chii 4y ago
    Just because you have nothing valuable to steal from your house, doesn't mean you shouldn't make sure the front door is locked!
CaliforniaKarl 4y ago
I wonder how you would be able to apply mitigations on carriers (like T-Mobile) that have turned off their 3G service. If you don't have a carrier which supports 3G (or lower), don't you need VoLTE turned on in order to make & receive voice calls?
- tguvot 4y ago
  you can get voip service and forward calls there.
  - CameronNemo 4y ago
    yeah I use jmp.chat because I got tired of the whole VoLTE shenanigans.
- toast0 4y ago
  T-Mobile may still have 2G up, possibly for calling only, but I don't think any other national US carrier has 2G or 3G up and running.
  - joecool1029 4y ago
    It works for data and calls, not fast but since not much falls to it anymore it seems to rarely be congested. My coverage with it was always better than with their 3G network and I used it years past its prime for conserving battery (until they deployed low-band LTE). You need at least a 3G device to use new sim cards to get on 2G but if you've been a customer a long time and you haven't changed cards, there are still activated ones in the wild that work with old devices (I was able to get calls and SMS to work on a t68i, but needed to use a w810i to get working data when I tried a few months back).
jacooper 4y ago
But I already have the march update?, it arrived on grapheneOS for the Pixel 6 pro
- aesh2Xa1 4y ago
  https://grapheneos.org/releases#changelog https://grapheneos.org/releases#changelog > T2B3.230109.009.2023031500 (Pixel 6, Pixel 6 Pro, Pixel 6a) — 2023-03-05 Android patch level but only 2023-03-01 Pixel patch until a March stock OS release is published with updated firmware, etc. (marked as 2023-03-01 overall patch level in the OS) Your baseband isn't protected. GrapheneOS patched Android, but the complete device set of images (firmware) is still vulnerable. That said, GrapheneOS does seem to implement its own additional baseband hardening.
  - jacooper 4y ago
    Good catch!
xvector 4y ago
At a certain point these aren't vulnerabilities and are just backdoors.
- znkynz 4y ago
  On my Pixel 7, the option to disable appears to be "4G Calling". This does mean in areas where 4G calling is the only option, you're screwed.
- brookst 4y ago
  That’s like saying an incompetent person who makes a lot of mistakes is somehow transformed into a malicious actor “at a certain point”. It’s just not true. It may help justify your emotional response to consider them so, but it’s not true.
  - upofadown 4y ago
    “Once is happenstance. Twice is coincidence. Three times is enemy action”
    - brookst 4y ago
      That saying applies to inexplicable coincidences. It doesn’t mean that everything that happens three times is an attack. I live in Seattle. It rained three times this week. That is not enemy action.
alyandon 4y ago
Ok go turn off VoLTE.... unless your carrier did the following * “Google Pixel devices received software updates in 2021 that automatically enabled VoLTE and removed the toggle.”
- ars 4y ago
  LTE is data only, if you want to make a call you need to have VoLTE (voice over LTE). So it's pretty reasonable to prevent disabling this. I wonder if you can disable LTE entirely and use an older standard.
  - jsheard 4y ago
    Many carriers have already retired 3G, so there's nothing left to fall back on if you were to disable 4G/LTE.
    - FeistySkink 4y ago
      2G is still there and isn't going anywhere.
      - jsheard 4y ago
        Is it? Wikipedia says that AT&T, Sprint and Verizon have already killed it, with only T-Mobile still going until next year: https://en.wikipedia.org/wiki/2G#Past_2G_networks https://en.wikipedia.org/wiki/2G#Past_2G_networks YMMV in other countries of course, but many networks worldwide have already phased it out or are going to soon.
      - Narkov 4y ago
        You do realise that there are countries outside of the USA? Australia has no 2G networks and 3G is approaching EOL.
        hackmiester 4y ago
        haha, all but one 2G network in the USA is gone, so I suspect they are not from the USA, actually.
jsheard 4y ago
Although this is a vulnerability in Samsung Exynos chipsets, ironically most Samsung flagship phones sold in the US shouldn't be affected because they use Qualcomm chipsets there rather than their own. The variants sold in Europe and Asia tend to have Exynos chipsets though, with the exception of the S23 series which is Qualcomm everywhere.
- favaq 4y ago
  That's interesting. People here in Europe hate Exynos chipsets, they say they are worse than Qualcomm. Are they giving up on them finally?
  - jsheard 4y ago
    The Exynos variants usually are worse than the Qualcomm ones, the cynical take was that most prominent phone reviewers are based in the US so giving that market the superior chipset served to bait-and-switch the other markets into buying inferior hardware. It remains to be seen if Exynos will return for the S24 or they'll stick with Qualcomm across the board.
    - hocuspocus 4y ago
      > the cynical take was that most prominent phone reviewers are based in the US I don't think that's true, most of the reviews I read and watch on YouTube are made in Europe, UK, India. When I worked at Samsung the reason was two-fold: - There's a lot of internal competition, having two SoC suppliers for your flagship phones gives you leverage against both Qualcomm and in-house teams. - Samsung treads lightly with US carriers. Using Qualcomm modems makes their certification process and field testing easier.
  - p_l 4y ago
    Dunno, the real complaint against exynos in favour of Qualcomm other than tribalism is that a lot of stuff was developed for Qualcomm with Adreno and not whatever GPU Exynos spouted at the time (custom weird thing early on, then PowerVR, nowadays Adreno). In USA they used Qualcomm due to CDMA shenanigans mainly. Oh, and stuff like qualcomm-specific hacks people were used to from Jail broken HTC devices (like phone call recording) not working. Final minority complaint was essentially based on qualcomm devices being more popular so you had more resources for custom roms, despite the fact that Exynos meant no need to do complicated jailbreak to load a custom rom. Personally I found no issue with Exynos chips whatsoever. Always some of the fastest stuff I had in my hands.
hirsin 4y ago
The pixel 6 modem has a bunch of known issues, to my understanding (certainly that's been the consensus when I've looked up solutions to my Pixel not getting a signal in the middle of Seattle until I toggle airplane mode on and off a few times). Hopefully this is the nail in the coffin for this modem series and they go back to using their previous modem
- dmitrygr 4y ago
  > their previous modem That's qualcomm. The very idea of google's phone SoCs was to ditch qualcomm
  - chasil 4y ago
    Can we get Project Zero to take a hard look at the next Pixels before they are released, please? This does not seem an unreasonable ask.
    - dmitrygr 4y ago
      If you learned of the myriad of ways in which google is set up to make sure this does not and cannot happen, you'd not sleep for weeks...
      - nightfly 4y ago
        I don't think I could care enough about any/all phones to lose sleep for a week+
    - saagarjha 4y ago
      That would be the job of other teams.
pflanze 4y ago
> allow an attacker to remotely compromise a phone at the baseband level Aren't modern phones supposedly securely separate the baseband from the OS (Android)? Does this mean that voice and data can be intercepted, but at least other data might be safe?
- parker_mountain 4y ago
  Android pretty effectively enforces TLS as well. Also, aside from the surface level issues of a vuln like this, an attacker now has a serious foothold on the device, which is still very bad.
- brookst 4y ago
  Pure speculation, but I would guess that the interfaces to baseband are not particularly hardened, so an attack on the phone from the baseband might be trivial. Or worse, the baseband might have a trusted channel to launch arbitrary code.
- pdoege 4y ago
  No. The baseband can DMA what it wants, when it wants. The baseband PMIC can power what it wants when wants. The AP is the junior partner.
  - flangola7 4y ago
    IOUMMU prevents this
  - userbinator 4y ago
    Not on MTK chipsets, or at least the older ones I'm familiar with: https://github.com/varunchitre15/MT6589_kernel_source/blob/master/mediatek/platform/mt6589/kernel/drivers/dual_ccci/src/ccci_platform.c https://github.com/varunchitre15/MT6589_kernel_source/blob/m... Look at the enable_mem_access_protection function.
  - notactuallyben 4y ago
    This is not true on pretty much any phone post 2014ish. Pretty much all platforms have IOMMU's or similar separation mechanisms. source: did baseband vr commercially
fomine3 4y ago
Original blogpost looks fine https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html https://googleprojectzero.blogspot.com/2023/03/multiple-inte...
- josephcsible 4y ago
  The Google Project Zero blog post implies that all Google Pixel models have received a fix, but really only some of them have, and it doesn't mention that the vulnerability can't be mitigated on them either. The 9to5Google post gets both of these things right, though: "the Pixel 6, 6 Pro, and 6a have yet to see that March update" and "Google Pixel devices received software updates in 2021 that automatically enabled VoLTE and removed the toggle."
  - stragulus 4y ago
    So, essentially, you have to disable mobile data as well as wifi calling, thus disabling the ability to be called entirely until they release the march patch. Nice..
  - caf 4y ago
    Switch the preferred network to 3G should disable VoLTE.
e12e 4y ago
Ok,so looks like pixel 7 and 7 pro are patched: > On Pixel phones, the main CVE-2023-24033 vulnerability was fixed with the March 2023 security patch that rolled out on Monday but should have come a week earlier. > However, the Pixel 6, 6 Pro, and 6a have yet to see that March update and are currently vulnerable.
mistyvales 4y ago
Welp, turned off wi-fi calling but can't turn off VoLTE. I can set 3G, but since I'm on Fi, 3G won't work (T-mobile).. I get horrible 5G where I am, so it always goes to LTE.
- BenjiWiebe 4y ago
  If you are in the US, 3G is done from the big carriers. Verizon was the last hold out, only turning it off at the beginning of this year.
  - mistyvales 4y ago
    A shame! I have a Nokia Windows Phone that I used on 3.5G for a long time as a second phone, and now it's basically worthless other than maybe for a music player..
- hackmiester 4y ago
  VoLTE will work over 5G (and sometimes over 3G in esoteric configurations). It is very data centric, even using SIP for call control. A rule of thumb is, any time you have a data connection, VoLTE can be used. This is why Wi-Fi Calling and VoLTE took off at roughly the same time. Once you can route calls as data, you can offer it over both cellular and Wi-Fi. (Wi-Fi Calling has an additional outer IPsec layer, but it is the same "guts" inside the tunnel.)
  - gst 4y ago
    > VoLTE will work over 5G Doesn't 5G use VoNR? Or does VoNR imply the same SIP call format, but just over 5G instead of 4G?
    - hackmiester 4y ago
      That is my understanding of VoNR, but unfortunately I don't have experience with it.
    - p_l 4y ago
nneonneo 4y ago
This BlackHat talk from 2021 seems relevant: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Over-The-Air-Baseband-Exploit-Gaining-Remote-Code-Execution-On-5G-Smartphones.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Over-T... It’s (probably) not the same bug, but gives you an idea of the state of baseband security and the attack surface. The baseband is an ARM chip running an RTOS. The security situation is not pretty. We have here an XML parser running in the baseband RTOS which has a stack overflow bug. There are no stack canaries and it looks like there’s no ASLR or even NX so they get trivial shellcode execution. Although they didn’t demonstrate persistence or AP compromise, I can’t imagine either of those would be hard from the privileged baseband, especially if the baseband drivers are as bad as the baseband firmware seems to be.
- fulafel 4y ago
  Yep. And the interface is not easily accessible for normal users so it's hard to fuzz, we're at the mercy of telcos telco-connected vendors for security testing.
- notactuallyben 4y ago
  Great work from P0 (and Keen lab). but this statement about baseband mitigations is only partially true. Huawei Balong platform has ASLR and stack canaries now (and some Infineon too I believe), and all baseband platforms are improving (even Mediatek). I didn't check Qualcomm lately, but they have a lot of similar protections now. It's not trivial to do a pivot to AP on modern iPhones or Android phones (excluding some categories) - especially with PAC (and MTE coming). But yeah, (Samsung) Shannon are an attractive target for attackers due to easily obtainable firmware, strings, DWARF (elf) firmware that you can find and relatively good debugging platform. The bugs are generally pretty low hanging too. This isn't the same on Qualcomm platforms (Hexagon is notoriously hard to RE and debug), or the iPhone platforms.
  - saagarjha 4y ago
    Plus DART/IOMMU, I would imagine?
cubesnooper 4y ago
I find myself wishing more and more for a wifi‐only tablet in a phone form factor. Sure, I recognize that I’m in the minority here, as someone who keeps his phone in airplane mode/wifi‐only mode all the time. But it doesn’t mean giving up much: most of my messaging (including replying to texts and checking voicemails) can be done from the browser, GPS navigation works fine without an internet connection (maps can be trivially preloaded), and when I desperately need internet access while driving I can pull into any Starbucks, McDonalds, or Walmart. Mostly I do this for philosophical reasons (basically, purposely downgrading the importance of phone notifications relative to what activities I’m physically doing at a given time), but the security advantage of smaller attack surface is a benefit I hadn’t considered.
- MBCook 4y ago
  It existed. It was called the iPod Touch. It was a full iPhone without a cellular modem. It was discontinued, assumedly for low sales as more and more people gave their kids either iPads or hand me down iPhones instead of buying iOS touches like they used to.
  - CameronNemo 4y ago
    There was also the Samsung Galaxy Player. Discontinued long ago. https://en.m.wikipedia.org/wiki/Samsung_Galaxy_Player https://en.m.wikipedia.org/wiki/Samsung_Galaxy_Player
- BLKNSLVR 4y ago
  Is a phone without a SIM card any equivalent, or just the fact it has the ability to have a SIM card means the attack surface is too big?
  - vladvasiliu 4y ago
    I don't think it's equivalent judging by the fact that you can still make emergency calls, which means it's able to talk to the network anyway. I remember than an older Samsung I had (GS3 IIRC) would show the signal level even withou a SIM installed. Don't know what happens when you put it in airplane mode, though.
dtx1 4y ago
This is great news! Hear me out: we've long known that the current state of modems running their own tiny buggy unpatched is with way too much access to the device has been bad but no one could do much about it. A severe exploit like this doing actual damage to users of flagship phones from google and Samsung might be enough to finally change that. Unless it hurts the bottom line of those companies severely they won't change it. I think they should have released the info to force them to.
dhdhhdd 4y ago
There is no way to disable volte on a pixel phone. There is a way to disable wifi calling. :/
pabs3 4y ago
The source code for baseband software needs to be open source, I expect there are many more such vulnerabilities. I also wonder how many basebands contain Linux and are GPL violating.
- notactuallyben 4y ago
  None use Linux, most just use BSD licence software (or things like openssl). I haven’t seen any GPL code at all tbh. But yep, would be nice if it was open source, although not sure how much that would help (only if sufficiently motivated auditors can be bothered to look at it). A bunch of baseband firmware is even encrypted on disk now (loaded into BB memory from the kernel)
  - dogben 4y ago
    Quectel EG25-G is running linux https://nns.ee/blog/2021/04/01/modem-blog.html https://nns.ee/blog/2021/04/01/modem-blog.html
    - olabyne 4y ago
      I had a home 4G router for a while, a TPLink 200 something. The 4G modem inside was a full Android device ! See here https://openwrt.org/toh/tp-link/archer_mr200?datasrt=%5Efirmware%20openwrt%20install%20url#the_lte_modem https://openwrt.org/toh/tp-link/archer_mr200?datasrt=%5Efirm...
    - notactuallyben 4y ago
      I didn’t check, and on mobile now. But I would be very surprised if that was the actual baseband (more just a wrapper around it).
      - notactuallyben 4y ago
        So I got a little bit of time to check (https://github.com/Biktorgj/quectel_eg25_recovery/tree/EG25GGBR07A08M2G_30.006.30.006/update https://github.com/Biktorgj/quectel_eg25_recovery/tree/EG25G... - the NON-HLOS), and it's still actually running a Qualcomm Hexagon baseband (40mb binary by Qualtec when combined using Gal's unify_trustlet script). Load that into Hexagoon IDA plugin and you'll see it's bog standard Hexagon for all the remote GSM/LT code that actually does stuff (similar to the project zero research). I haven't verified (and don't own a Pinephone) but most Quectel boards I've seen in the past do enforce signature validation, so binary patches are not easy.
wnevets 4y ago
Did anyone else get a pop up on their Pixel asking to enable WiFi calling earlier in the week? Was that coincidence or related to this issue?
ThePowerOfFuet 4y ago
>On Pixel phones, the main CVE-2023-24033 vulnerability was fixed with the March 2023 security patch that rolled out on Monday but should have come a week earlier. That means GrapheneOS is already protected against this vuln: https://grapheneos.org/releases#2023031500 https://grapheneos.org/releases#2023031500 A tip of the hat (and my great thanks) to the GrapheneOS team!
- javajosh 4y ago
  This is a pretty big win for Graphene - nice work. That link mentioned 3/20 as the date Google will release a patch.
- fsflover 4y ago
  Not fully: https://news.ycombinator.com/item?id=35192379 https://news.ycombinator.com/item?id=35192379.
- OneLeggedCat 4y ago
  Pixel 6, 6a, 6 Pro are NOT protected from this on GrapheneOS. Not yet.
joosters 4y ago
..."Users who wish to protect themselves from the baseband remote code execution vulnerabilities in Samsung’s Exynos chipsets can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings." Very kind of them to offer the freedom of choice to all those users who don't want to protect themselves!
sneak 4y ago
> Meanwhile, the other 14 vulnerabilities are considered not as severe as they “require either a malicious mobile network operator or an attacker with local access to the device.” The kind of people with the resources to actively exploit this are the same kind of people who can compel the carriers to transmit whatever they want.
jchw 4y ago
Okay, so can Google please consider doing more work to isolate the modem from the application processor in Pixel phones now? This is a disaster, but probably worse than it needs to be.
darthmallrat 4y ago
Is this a valid mitigation for pixel 6/a/pro? - Turn off wifi calling - Turn on airplane mode And then ensure wifi is on and wait for the March security update.
clankyclanker 4y ago
In 2014, Replicant found and fixed similar modem vulnerabilities, which Samsung never patched, AFAIK. https://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor https://www.fsf.org/blogs/community/replicant-developers-fin... Have we surpassed incompetence and arrived at maliciousness yet?
wkat4242 4y ago
Hmm. WiFi calling is not a big deal. VoLTE however is. Some networks don't even support 2/3G anymore so VoLTE is the only way to make calls there. I always thought it was ridiculous that LTE didn't come with a built-in voice mode that was just universally supported. VoLTE is more of an add on app on top of of data and a big cause of compatibility problems. It wasn't even finished when the rest of the LTE standard came out so many early phones came without support. And many still have to fall back to 3G during calls due to incompatibilities or networks blocking them due to "not invented here". It's a mess compared to 2G/3G where you can just stick a sim card into any phone and know it will work just fine. In a far future a data only network makes sense but we're not there yet and we definitely weren't when LTE was specced. Voice should have been an integral part of the standard.
deleted 4y ago
[deleted]
James-1234 4y ago
[dead]

341 points by dmitrygr 4y ago

> Project Zero’s advice for those impacted follows: >> Until security updates are available, users who wish to protect themselves from the baseband remote code execution vulnerabilities in Samsung’s Exynos chipsets can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings. Turning off these settings will remove the exploitation risk of these vulnerabilities. > Google Pixel devices received software updates in 2021 that automatically enabled VoLTE and removed the toggle. That's some great advice.

toast0 4y ago
If you turn off VoLTE and Wi-Fi calling, I don't think you can get calls in the US, so I'm not suprised VoLTE can't be disabled.
- yaomtc 4y ago
  Isn't LTE part of 4G? What about 5G?
- josephcsible 4y ago
  I don't know about you, but I'd way rather not be able to get calls until Monday than be vulnerable to this exploit.
  - toast0 4y ago
    That's probably the right choice, if there's a firmware update on Monday. If not, it's probably time to buy a new phone.
  - mcsniff 4y ago
    If you are currently, you probably have been vulnerable to this and many other undisclosed vulns for years, 3 days isn't going to move the needle much in terms of risk, but indeed it is a step to take.
    - josephcsible 4y ago
      Doesn't everyone knowing the vulnerability exists now move the needle significantly?
deleted 4y ago
[deleted]
flas9sd 4y ago
even in Androids phone diagnostics? *#*#4636#*#*

dmitrygr 4y ago

"Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number. With limited additional research and development, we believe that skilled attackers would be able to quickly create an operational exploit to compromise affected devices silently and remotely." Funsies...

Steltek 4y ago
It's skilled attackers in proximity with radio gear and a laptop, right? This sucks for a lot of people but I don't think I'm on the list of targets such actors would care about.
- chii 4y ago
  Just because you have nothing valuable to steal from your house, doesn't mean you shouldn't make sure the front door is locked!

CaliforniaKarl 4y ago

I wonder how you would be able to apply mitigations on carriers (like T-Mobile) that have turned off their 3G service. If you don't have a carrier which supports 3G (or lower), don't you need VoLTE turned on in order to make & receive voice calls?

tguvot 4y ago
you can get voip service and forward calls there.
- CameronNemo 4y ago
  yeah I use jmp.chat because I got tired of the whole VoLTE shenanigans.
toast0 4y ago
T-Mobile may still have 2G up, possibly for calling only, but I don't think any other national US carrier has 2G or 3G up and running.
- joecool1029 4y ago
  It works for data and calls, not fast but since not much falls to it anymore it seems to rarely be congested. My coverage with it was always better than with their 3G network and I used it years past its prime for conserving battery (until they deployed low-band LTE). You need at least a 3G device to use new sim cards to get on 2G but if you've been a customer a long time and you haven't changed cards, there are still activated ones in the wild that work with old devices (I was able to get calls and SMS to work on a t68i, but needed to use a w810i to get working data when I tried a few months back).

jacooper 4y ago

But I already have the march update?, it arrived on grapheneOS for the Pixel 6 pro

aesh2Xa1 4y ago
https://grapheneos.org/releases#changelog https://grapheneos.org/releases#changelog > T2B3.230109.009.2023031500 (Pixel 6, Pixel 6 Pro, Pixel 6a) — 2023-03-05 Android patch level but only 2023-03-01 Pixel patch until a March stock OS release is published with updated firmware, etc. (marked as 2023-03-01 overall patch level in the OS) Your baseband isn't protected. GrapheneOS patched Android, but the complete device set of images (firmware) is still vulnerable. That said, GrapheneOS does seem to implement its own additional baseband hardening.
- jacooper 4y ago
  Good catch!

xvector 4y ago

At a certain point these aren't vulnerabilities and are just backdoors.

znkynz 4y ago
On my Pixel 7, the option to disable appears to be "4G Calling". This does mean in areas where 4G calling is the only option, you're screwed.
brookst 4y ago
That’s like saying an incompetent person who makes a lot of mistakes is somehow transformed into a malicious actor “at a certain point”. It’s just not true. It may help justify your emotional response to consider them so, but it’s not true.
- upofadown 4y ago
  “Once is happenstance. Twice is coincidence. Three times is enemy action”
  - brookst 4y ago
    That saying applies to inexplicable coincidences. It doesn’t mean that everything that happens three times is an attack. I live in Seattle. It rained three times this week. That is not enemy action.

alyandon 4y ago

Ok go turn off VoLTE.... unless your carrier did the following * “Google Pixel devices received software updates in 2021 that automatically enabled VoLTE and removed the toggle.”

ars 4y ago
LTE is data only, if you want to make a call you need to have VoLTE (voice over LTE). So it's pretty reasonable to prevent disabling this. I wonder if you can disable LTE entirely and use an older standard.
- jsheard 4y ago
  Many carriers have already retired 3G, so there's nothing left to fall back on if you were to disable 4G/LTE.
  - FeistySkink 4y ago
    2G is still there and isn't going anywhere.
    - jsheard 4y ago
      Is it? Wikipedia says that AT&T, Sprint and Verizon have already killed it, with only T-Mobile still going until next year: https://en.wikipedia.org/wiki/2G#Past_2G_networks https://en.wikipedia.org/wiki/2G#Past_2G_networks YMMV in other countries of course, but many networks worldwide have already phased it out or are going to soon.
    - Narkov 4y ago
      You do realise that there are countries outside of the USA? Australia has no 2G networks and 3G is approaching EOL.
      - hackmiester 4y ago
        haha, all but one 2G network in the USA is gone, so I suspect they are not from the USA, actually.

jsheard 4y ago

Although this is a vulnerability in Samsung Exynos chipsets, ironically most Samsung flagship phones sold in the US shouldn't be affected because they use Qualcomm chipsets there rather than their own. The variants sold in Europe and Asia tend to have Exynos chipsets though, with the exception of the S23 series which is Qualcomm everywhere.

favaq 4y ago
That's interesting. People here in Europe hate Exynos chipsets, they say they are worse than Qualcomm. Are they giving up on them finally?
- jsheard 4y ago
  The Exynos variants usually are worse than the Qualcomm ones, the cynical take was that most prominent phone reviewers are based in the US so giving that market the superior chipset served to bait-and-switch the other markets into buying inferior hardware. It remains to be seen if Exynos will return for the S24 or they'll stick with Qualcomm across the board.
  - hocuspocus 4y ago
    > the cynical take was that most prominent phone reviewers are based in the US I don't think that's true, most of the reviews I read and watch on YouTube are made in Europe, UK, India. When I worked at Samsung the reason was two-fold: - There's a lot of internal competition, having two SoC suppliers for your flagship phones gives you leverage against both Qualcomm and in-house teams. - Samsung treads lightly with US carriers. Using Qualcomm modems makes their certification process and field testing easier.
- p_l 4y ago
  Dunno, the real complaint against exynos in favour of Qualcomm other than tribalism is that a lot of stuff was developed for Qualcomm with Adreno and not whatever GPU Exynos spouted at the time (custom weird thing early on, then PowerVR, nowadays Adreno). In USA they used Qualcomm due to CDMA shenanigans mainly. Oh, and stuff like qualcomm-specific hacks people were used to from Jail broken HTC devices (like phone call recording) not working. Final minority complaint was essentially based on qualcomm devices being more popular so you had more resources for custom roms, despite the fact that Exynos meant no need to do complicated jailbreak to load a custom rom. Personally I found no issue with Exynos chips whatsoever. Always some of the fastest stuff I had in my hands.

hirsin 4y ago

The pixel 6 modem has a bunch of known issues, to my understanding (certainly that's been the consensus when I've looked up solutions to my Pixel not getting a signal in the middle of Seattle until I toggle airplane mode on and off a few times). Hopefully this is the nail in the coffin for this modem series and they go back to using their previous modem

dmitrygr 4y ago
> their previous modem That's qualcomm. The very idea of google's phone SoCs was to ditch qualcomm
- chasil 4y ago
  Can we get Project Zero to take a hard look at the next Pixels before they are released, please? This does not seem an unreasonable ask.
  - dmitrygr 4y ago
    If you learned of the myriad of ways in which google is set up to make sure this does not and cannot happen, you'd not sleep for weeks...
    - nightfly 4y ago
      I don't think I could care enough about any/all phones to lose sleep for a week+
  - saagarjha 4y ago
    That would be the job of other teams.

pflanze 4y ago

> allow an attacker to remotely compromise a phone at the baseband level Aren't modern phones supposedly securely separate the baseband from the OS (Android)? Does this mean that voice and data can be intercepted, but at least other data might be safe?

parker_mountain 4y ago
Android pretty effectively enforces TLS as well. Also, aside from the surface level issues of a vuln like this, an attacker now has a serious foothold on the device, which is still very bad.
brookst 4y ago
Pure speculation, but I would guess that the interfaces to baseband are not particularly hardened, so an attack on the phone from the baseband might be trivial. Or worse, the baseband might have a trusted channel to launch arbitrary code.
pdoege 4y ago
No. The baseband can DMA what it wants, when it wants. The baseband PMIC can power what it wants when wants. The AP is the junior partner.
- flangola7 4y ago
  IOUMMU prevents this
- userbinator 4y ago
  Not on MTK chipsets, or at least the older ones I'm familiar with: https://github.com/varunchitre15/MT6589_kernel_source/blob/master/mediatek/platform/mt6589/kernel/drivers/dual_ccci/src/ccci_platform.c https://github.com/varunchitre15/MT6589_kernel_source/blob/m... Look at the enable_mem_access_protection function.
- notactuallyben 4y ago
  This is not true on pretty much any phone post 2014ish. Pretty much all platforms have IOMMU's or similar separation mechanisms. source: did baseband vr commercially

fomine3 4y ago

Original blogpost looks fine https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html https://googleprojectzero.blogspot.com/2023/03/multiple-inte...

josephcsible 4y ago
The Google Project Zero blog post implies that all Google Pixel models have received a fix, but really only some of them have, and it doesn't mention that the vulnerability can't be mitigated on them either. The 9to5Google post gets both of these things right, though: "the Pixel 6, 6 Pro, and 6a have yet to see that March update" and "Google Pixel devices received software updates in 2021 that automatically enabled VoLTE and removed the toggle."
- stragulus 4y ago
  So, essentially, you have to disable mobile data as well as wifi calling, thus disabling the ability to be called entirely until they release the march patch. Nice..
- caf 4y ago
  Switch the preferred network to 3G should disable VoLTE.

e12e 4y ago

Ok,so looks like pixel 7 and 7 pro are patched: > On Pixel phones, the main CVE-2023-24033 vulnerability was fixed with the March 2023 security patch that rolled out on Monday but should have come a week earlier. > However, the Pixel 6, 6 Pro, and 6a have yet to see that March update and are currently vulnerable.

mistyvales 4y ago

Welp, turned off wi-fi calling but can't turn off VoLTE. I can set 3G, but since I'm on Fi, 3G won't work (T-mobile).. I get horrible 5G where I am, so it always goes to LTE.

BenjiWiebe 4y ago
If you are in the US, 3G is done from the big carriers. Verizon was the last hold out, only turning it off at the beginning of this year.
- mistyvales 4y ago
  A shame! I have a Nokia Windows Phone that I used on 3.5G for a long time as a second phone, and now it's basically worthless other than maybe for a music player..
hackmiester 4y ago
VoLTE will work over 5G (and sometimes over 3G in esoteric configurations). It is very data centric, even using SIP for call control. A rule of thumb is, any time you have a data connection, VoLTE can be used. This is why Wi-Fi Calling and VoLTE took off at roughly the same time. Once you can route calls as data, you can offer it over both cellular and Wi-Fi. (Wi-Fi Calling has an additional outer IPsec layer, but it is the same "guts" inside the tunnel.)
- gst 4y ago
  > VoLTE will work over 5G Doesn't 5G use VoNR? Or does VoNR imply the same SIP call format, but just over 5G instead of 4G?
  - hackmiester 4y ago
    That is my understanding of VoNR, but unfortunately I don't have experience with it.
  - p_l 4y ago

nneonneo 4y ago

This BlackHat talk from 2021 seems relevant: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Over-The-Air-Baseband-Exploit-Gaining-Remote-Code-Execution-On-5G-Smartphones.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Over-T... It’s (probably) not the same bug, but gives you an idea of the state of baseband security and the attack surface. The baseband is an ARM chip running an RTOS. The security situation is not pretty. We have here an XML parser running in the baseband RTOS which has a stack overflow bug. There are no stack canaries and it looks like there’s no ASLR or even NX so they get trivial shellcode execution. Although they didn’t demonstrate persistence or AP compromise, I can’t imagine either of those would be hard from the privileged baseband, especially if the baseband drivers are as bad as the baseband firmware seems to be.

fulafel 4y ago
Yep. And the interface is not easily accessible for normal users so it's hard to fuzz, we're at the mercy of telcos telco-connected vendors for security testing.
notactuallyben 4y ago
Great work from P0 (and Keen lab). but this statement about baseband mitigations is only partially true. Huawei Balong platform has ASLR and stack canaries now (and some Infineon too I believe), and all baseband platforms are improving (even Mediatek). I didn't check Qualcomm lately, but they have a lot of similar protections now. It's not trivial to do a pivot to AP on modern iPhones or Android phones (excluding some categories) - especially with PAC (and MTE coming). But yeah, (Samsung) Shannon are an attractive target for attackers due to easily obtainable firmware, strings, DWARF (elf) firmware that you can find and relatively good debugging platform. The bugs are generally pretty low hanging too. This isn't the same on Qualcomm platforms (Hexagon is notoriously hard to RE and debug), or the iPhone platforms.
- saagarjha 4y ago
  Plus DART/IOMMU, I would imagine?

cubesnooper 4y ago

I find myself wishing more and more for a wifi‐only tablet in a phone form factor. Sure, I recognize that I’m in the minority here, as someone who keeps his phone in airplane mode/wifi‐only mode all the time. But it doesn’t mean giving up much: most of my messaging (including replying to texts and checking voicemails) can be done from the browser, GPS navigation works fine without an internet connection (maps can be trivially preloaded), and when I desperately need internet access while driving I can pull into any Starbucks, McDonalds, or Walmart. Mostly I do this for philosophical reasons (basically, purposely downgrading the importance of phone notifications relative to what activities I’m physically doing at a given time), but the security advantage of smaller attack surface is a benefit I hadn’t considered.

MBCook 4y ago
It existed. It was called the iPod Touch. It was a full iPhone without a cellular modem. It was discontinued, assumedly for low sales as more and more people gave their kids either iPads or hand me down iPhones instead of buying iOS touches like they used to.
- CameronNemo 4y ago
  There was also the Samsung Galaxy Player. Discontinued long ago. https://en.m.wikipedia.org/wiki/Samsung_Galaxy_Player https://en.m.wikipedia.org/wiki/Samsung_Galaxy_Player
BLKNSLVR 4y ago
Is a phone without a SIM card any equivalent, or just the fact it has the ability to have a SIM card means the attack surface is too big?
- vladvasiliu 4y ago
  I don't think it's equivalent judging by the fact that you can still make emergency calls, which means it's able to talk to the network anyway. I remember than an older Samsung I had (GS3 IIRC) would show the signal level even withou a SIM installed. Don't know what happens when you put it in airplane mode, though.

dtx1 4y ago

This is great news! Hear me out: we've long known that the current state of modems running their own tiny buggy unpatched is with way too much access to the device has been bad but no one could do much about it. A severe exploit like this doing actual damage to users of flagship phones from google and Samsung might be enough to finally change that. Unless it hurts the bottom line of those companies severely they won't change it. I think they should have released the info to force them to.

dhdhhdd 4y ago

There is no way to disable volte on a pixel phone. There is a way to disable wifi calling. :/

pabs3 4y ago

The source code for baseband software needs to be open source, I expect there are many more such vulnerabilities. I also wonder how many basebands contain Linux and are GPL violating.

notactuallyben 4y ago
None use Linux, most just use BSD licence software (or things like openssl). I haven’t seen any GPL code at all tbh. But yep, would be nice if it was open source, although not sure how much that would help (only if sufficiently motivated auditors can be bothered to look at it). A bunch of baseband firmware is even encrypted on disk now (loaded into BB memory from the kernel)
- dogben 4y ago
  Quectel EG25-G is running linux https://nns.ee/blog/2021/04/01/modem-blog.html https://nns.ee/blog/2021/04/01/modem-blog.html
  - olabyne 4y ago
    I had a home 4G router for a while, a TPLink 200 something. The 4G modem inside was a full Android device ! See here https://openwrt.org/toh/tp-link/archer_mr200?datasrt=%5Efirmware%20openwrt%20install%20url#the_lte_modem https://openwrt.org/toh/tp-link/archer_mr200?datasrt=%5Efirm...
  - notactuallyben 4y ago
    I didn’t check, and on mobile now. But I would be very surprised if that was the actual baseband (more just a wrapper around it).
    - notactuallyben 4y ago
      So I got a little bit of time to check (https://github.com/Biktorgj/quectel_eg25_recovery/tree/EG25GGBR07A08M2G_30.006.30.006/update https://github.com/Biktorgj/quectel_eg25_recovery/tree/EG25G... - the NON-HLOS), and it's still actually running a Qualcomm Hexagon baseband (40mb binary by Qualtec when combined using Gal's unify_trustlet script). Load that into Hexagoon IDA plugin and you'll see it's bog standard Hexagon for all the remote GSM/LT code that actually does stuff (similar to the project zero research). I haven't verified (and don't own a Pinephone) but most Quectel boards I've seen in the past do enforce signature validation, so binary patches are not easy.

wnevets 4y ago

Did anyone else get a pop up on their Pixel asking to enable WiFi calling earlier in the week? Was that coincidence or related to this issue?

ThePowerOfFuet 4y ago

>On Pixel phones, the main CVE-2023-24033 vulnerability was fixed with the March 2023 security patch that rolled out on Monday but should have come a week earlier. That means GrapheneOS is already protected against this vuln: https://grapheneos.org/releases#2023031500 https://grapheneos.org/releases#2023031500 A tip of the hat (and my great thanks) to the GrapheneOS team!

javajosh 4y ago
This is a pretty big win for Graphene - nice work. That link mentioned 3/20 as the date Google will release a patch.
fsflover 4y ago
Not fully: https://news.ycombinator.com/item?id=35192379 https://news.ycombinator.com/item?id=35192379.
OneLeggedCat 4y ago
Pixel 6, 6a, 6 Pro are NOT protected from this on GrapheneOS. Not yet.

joosters 4y ago

..."Users who wish to protect themselves from the baseband remote code execution vulnerabilities in Samsung’s Exynos chipsets can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings." Very kind of them to offer the freedom of choice to all those users who don't want to protect themselves!

sneak 4y ago

> Meanwhile, the other 14 vulnerabilities are considered not as severe as they “require either a malicious mobile network operator or an attacker with local access to the device.” The kind of people with the resources to actively exploit this are the same kind of people who can compel the carriers to transmit whatever they want.

jchw 4y ago

Okay, so can Google please consider doing more work to isolate the modem from the application processor in Pixel phones now? This is a disaster, but probably worse than it needs to be.

darthmallrat 4y ago

Is this a valid mitigation for pixel 6/a/pro? - Turn off wifi calling - Turn on airplane mode And then ensure wifi is on and wait for the March security update.

clankyclanker 4y ago

In 2014, Replicant found and fixed similar modem vulnerabilities, which Samsung never patched, AFAIK. https://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor https://www.fsf.org/blogs/community/replicant-developers-fin... Have we surpassed incompetence and arrived at maliciousness yet?

wkat4242 4y ago

Hmm. WiFi calling is not a big deal. VoLTE however is. Some networks don't even support 2/3G anymore so VoLTE is the only way to make calls there. I always thought it was ridiculous that LTE didn't come with a built-in voice mode that was just universally supported. VoLTE is more of an add on app on top of of data and a big cause of compatibility problems. It wasn't even finished when the rest of the LTE standard came out so many early phones came without support. And many still have to fall back to 3G during calls due to incompatibilities or networks blocking them due to "not invented here". It's a mess compared to 2G/3G where you can just stick a sim card into any phone and know it will work just fine. In a far future a data only network makes sense but we're not there yet and we definitely weren't when LTE was specced. Voice should have been an integral part of the standard.

deleted 4y ago

[deleted]

James-1234 4y ago

[dead]