4 ms·

This BlackHat talk from 2021 seems relevant: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Over-The-Air-Baseband-Exploit-Gaining-Remote-Code-Execution-O

This BlackHat talk from 2021 seems relevant: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Over-The-Air-Baseband-Exploit-Gaining-Remote-Code-Execution-On-5G-Smartphones.pdf https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Over-T... It’s (probably) not the same bug, but gives you an idea of the state of baseband security and the attack surface. The baseband is an ARM chip running an RTOS. The security situation is not pretty. We have here an XML parser running in the baseband RTOS which has a stack overflow bug. There are no stack canaries and it looks like there’s no ASLR or even NX so they get trivial shellcode execution. Although they didn’t demonstrate persistence or AP compromise, I can’t imagine either of those would be hard from the privileged baseband, especially if the baseband drivers are as bad as the baseband firmware seems to be.

fulafel 4y ago
Yep. And the interface is not easily accessible for normal users so it's hard to fuzz, we're at the mercy of telcos telco-connected vendors for security testing.
notactuallyben 4y ago
Great work from P0 (and Keen lab). but this statement about baseband mitigations is only partially true. Huawei Balong platform has ASLR and stack canaries now (and some Infineon too I believe), and all baseband platforms are improving (even Mediatek). I didn't check Qualcomm lately, but they have a lot of similar protections now. It's not trivial to do a pivot to AP on modern iPhones or Android phones (excluding some categories) - especially with PAC (and MTE coming). But yeah, (Samsung) Shannon are an attractive target for attackers due to easily obtainable firmware, strings, DWARF (elf) firmware that you can find and relatively good debugging platform. The bugs are generally pretty low hanging too. This isn't the same on Qualcomm platforms (Hexagon is notoriously hard to RE and debug), or the iPhone platforms.
- saagarjha 4y ago
  Plus DART/IOMMU, I would imagine?
  - notactuallyben 4y ago
    Yep in most cases, but not always configured the best. Logic flaws seem the best way to go :)

fulafel 4y ago

Yep. And the interface is not easily accessible for normal users so it's hard to fuzz, we're at the mercy of telcos telco-connected vendors for security testing.

notactuallyben 4y ago

Great work from P0 (and Keen lab). but this statement about baseband mitigations is only partially true. Huawei Balong platform has ASLR and stack canaries now (and some Infineon too I believe), and all baseband platforms are improving (even Mediatek). I didn't check Qualcomm lately, but they have a lot of similar protections now. It's not trivial to do a pivot to AP on modern iPhones or Android phones (excluding some categories) - especially with PAC (and MTE coming). But yeah, (Samsung) Shannon are an attractive target for attackers due to easily obtainable firmware, strings, DWARF (elf) firmware that you can find and relatively good debugging platform. The bugs are generally pretty low hanging too. This isn't the same on Qualcomm platforms (Hexagon is notoriously hard to RE and debug), or the iPhone platforms.

saagarjha 4y ago
Plus DART/IOMMU, I would imagine?
- notactuallyben 4y ago
  Yep in most cases, but not always configured the best. Logic flaws seem the best way to go :)