9 ms·
Attacking Android Binder
- tripdout 2y agoI'd love to have this in-depth level of knowledge of kernel inner workings. Super interesting writeup.
- AshamedCaptain 2y agoBinder is actually something that was designed for BeOS and PalmOS, so ironically it is not very tied to Linux and IMHO one of these technologies that Google uses to abstract themselves from Linux. (It still has something to do with the early implementations since I recognize some of the #define names..)
- pjmlp 2y agoIt also provides a way for a pseudo-microkernel like architecture despite Linux, as many services run on their own process talking with the Linux kernel via Binder.
- p_l 2y agoIIRC, Binder also still includes "passing" the scheduler quanta between procese6when making a call - meaning that when you make a call from process A to process B, instead of waiting for process B to be scheduled for execution, it is swapped in place of process A in scheduling - effectively, process A "pays" for the CPU tone that process B needs to service the call.
- kaszanka 2y agoHow do they ensure this under Linux?
- fooblaster 2y agoThey don't. There is some notion of priority boosting but with everything running as sched_other it does essentially nothing.
- p_l 2y agoAfter extra checking, yes, they hack around a lack of infrastructure on kernel through tricks with setting nice values - I do know of patches that implement more, but they ultimate never got upstreamed
- a-dub 2y agothat's right. i believe an internet famous 90s female beos engineer was behind it. diane hakbod?
- saagarjha 2y agoDianne (Hackborn, hackbod@) is still working on Android :)
- sillywalk 2y agoFrom 2006(!) Interview and introduction to openbinder. https://www.osnews.com/story/13674/introduction-to-openbinder-and-interview-with-dianne-hackborn/ https://www.osnews.com/story/13674/introduction-to-openbinde...
- lmz 2y agoOr maybe they were referring to the exploitation parts needing to know about kernel allocator behavior etc.
- giancarlostoro 2y agoWhich makes me wonder how does one read up on kernel internals outside of just perusing all the code, how do you get all the wonderful history that is just lost unless you talk to someone who worked on it or find an insightful comment on HN. The one thing version control should emphasize more of is a way to go back through commits and let people (probably approved people) comb through and comment the code in a metadata way that the version control software can display without affecting commits. Would be neat to peruse code, hover (if you have a good editor / IDE ;) and see commentary by others on said code.
- doodlesdev 2y agoAnd again an extremely serious, device-compromising vulnerability, arises from a use-after-free. When will we learn? I don't think I'll ever be able to trust modern devices until we finally abandon memory-unsafe languages. It's such low hanging fruit at this point I don't understand anymore why OS developers keep investing their time in other parts of the threat model of operating systems if memory usage vulnerabilities keep arising that completely destroy the existence of any security layer in the system. Was Google's plan to replace Android with Fuchsia? Is there any plan to get rid of these vulnerabilities (specially use-after-free) at scale on Android like the Chrome project has attempted with the MiraclePtr project?
- pjmlp 2y agoIt is ongoing, https://source.android.com/docs/setup/build/rust/building-rust-modules/overview https://source.android.com/docs/setup/build/rust/building-ru...
- cyberax 2y agoThere's actually a reimplementation of Binder in Rust, for Linux: https://lwn.net/Articles/953116/ https://lwn.net/Articles/953116/
- Nereuxofficial 2y agoAnd furthermore, it is by a Google employee with plans to merge it into Android as far as i know
- chc4 2y agoFuchsia's kernel is written in C++. It's much more a microkernel design, and so device drivers usually run as userspace processes and some of them are Rust, but the core kernel is not written in a memory safe language.
- resource_waste 2y agoIt wasnt found in the wild... unlike Pegasus.
- 2y ago
- vitiral 2y ago> The motivation for this design is that a client can send a transaction and then wait for a response with one ioctl syscall. In contrast, IPC with sockets requires two syscalls, send and recv. What a great motivation. Oh wait, then you write your literal operating system and all services in Java of all languages. I find Android's architecture so frustrating, all the wrong design decisions
- kaba0 2y agoThen maybe learn a bit about it, before you decide based on bullshit whether you like it or not? Not that anyone would care about your opinion even then, when you can’t even get right such a basic thing as what it’s written in — then you surely are an expert of the topic.
- vitiral 2y agoI'm aware that binder itself isn't written in Java of that's what you mean (?)
- kelnos 2y agoYeah, I read that and did a double-take. That seems like a pretty silly micro-optimization. Binder is indeed widely used on Android, but I wouldn't expect in tight loops or critical paths. Sure, syscalls aren't cheap, but I can't see this odd interface saving much. Just seems like a recipe for confusion and bugs.
- p_l 2y agoIt is very much used in tight loops and critical paths, including graphics, audio, video, etc.
- pjmlp 2y agoWithout companies like Google, the best the community is able to deliver is to keep cloning 1970's UNIX in C, ever and ever again.