Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/35 Thanks!
Hello, so my name is Ralph Wyman,
and I'll be giving a talk about basement
exposition in 2013
and what has changed since I
last gave talks about this subject.
So who am I? I'm a security researcher
from Germany. I was previously in
academia at the University of Luxembourg.
I've recently started my own company
and have a keen interest in mobile,
wireless and embedded systems, and I try
to break them, find vulnerabilities in
them.
I was the first to practically
demonstrate exposed vulnerabilities and
based on sex three years ago,
for instance, at the Congress, at 27.
And in these three years,
a lot of things have changed and I'd like
to look back on what has happened
and what, what the changes
are and
what how the landscape has
has
become in 2030 and how it will develop
in the next couple of years.
So first of all, who in this
room has heard of the Hexagon
architecture before they came into this
talk?
Oh, so a lot of people took this just
by chance. Okay, interesting.
So the Hexagon architecture is
a CPU architecture developed by Qualcomm,
which is a mobile chip manufacturer
for Basement's.
Previously, all
base phones in the last couple of
years have been running
on on arm chips
many, many years ago.
There used to be this piece in
the old markets who had dedicated this
piece with the basement's for running.
So how many people in the room do
actually know what the baseband is
in a cellular phone?
OK. OK, that's good, because then I don't
have to start from scratch.
Okay?
OK. So I will talk about the importance
of the hexagon architecture
for mobile exploitation.
This talk, I will give an introduction to
this architecture.
I will talk about past issues with
a blast, which is the real time
operating system that Qualcomm is
using on these chips now.
I will talk about the difficulty
or the difficulty of return
oriented programing and similar
techniques on this architecture show
an example of vulnerability and
draw some conclusions.
So there's this company's
strategic strategy analytics,
which does
basically market share
surveys for various chips,
and they publish expensive
surveys for a couple of thousand dollars
for which they give abstracts as well.
And he
see a pie chart
for the the basement manufacturers
in two thousand thirteen.
And what you see is that in
terms of shipment share, 63
percent of all shipped units
were shipped by Qualcomm.
The next biggest
manufacturer is Intel.
So no media attack.
So, which
is a Chinese manufacturer, which is
very popular in China as well.
You don't find many units with Meditech
in Europe yet.
The second,
the third largest, is Intel, and
the rest is split, among
others that I'll go into on
one of the next slides.
Now, however,
most of you will have a smartphone,
and many of these smartphones are LTE
capable these days.
Now, if you look at the market share,
distribution for LTE chipsets is looks
somewhat different
now. This is the shipments here in the
first quarter of 2013 or for LTE
chipsets.
And what you see here is basically
Qualcomm totally dominates this market.
So 97 percent of
all of the chips, that's
all
of the chips that were going into mobile
phones that were LTE capable were
Qualcomm's.
Now this obviously creates
an interest to go after this target.
But let's have a look at the other
players first and what will
maybe change in the next year or in the
coming years.
So Intel, which
bought Infineon wireless,
I think like
two and a half for, I think
roughly about the same time I gave the
first talk three years ago.
They're now shipping the chips
that they promised two years ago.
So they have been promising these LTE
capable chipsets
for a
while, and they now shipping them in the
Galaxy Tab three, for instance.
That's the only device I found that
actually has this chip.
Media Tech has announced LTE capable
base for 2014.
Unclear what will happen
there in video,
but I, Sarah, which is a soft
modem, so soft modem manufacturer
that was, I think, originally from the
UK, also a couple
of years ago, and they now have
an LTE capable modem chipset as well.
This is a standalone chipset that's not
integrated with the actual application
processor. So you have different designs
in some of the devices.
You have the application processor and
the baseband CPU in the same package and
in the others, you have two
separate packages.
Now they
have product prototypes of these LTE
capable modem chipsets that they've
shown at various events,
and they've also announced
a Tegra 4i, which has
an integrated modem chipset
that is announced for early
2014.
So you probably find it in a device
by mid-2015, I guess.
Then there's Spreadtrum, which is
actually
from a European perspective, that this is
a niche thing.
But from the Chinese perspective, this is
a huge player.
But the only do time division
LTE chipsets, and
they don't support 3G.
They ship this SC ninety six
ten already. I haven't ever looked
at these things.
But from what I've heard and what
I've seen, Spectrum is is a big player
on the Chinese market.
They have Broadcom, and this is an
interesting story.
So about two and a half month
ago, Broadcom announced that they had
bought Renaissance
Vanessa's baseband division.
And this is interesting because that is
the former Nokia baseband
teams.
And they basically Vanessa's
has a chip that is ready.
It's a big little
arm, so it's a Cortex A15
and well for Cortex-A15
and for Cortex A7
in one package together with a modem.
And according to this, through the specs,
I've read about this chip.
It supports LTE on almost
all bands, and it's capable
of up to 150 megabits per second.
So if this actually is something that
they're producing already and this is
a real threat to
the market share distribution that you've
seen before
for Ericsson, it's
unclear because
like
half a year or still, there was still
Ericsson, which was the semiconductor
manufacturer AC in a joint
venture with Ericsson.
And this broke up.
And now there's just the four
devices that Ericsson will continue,
which are the standalone chipsets.
But it's unclear what will happen to the
overthought the integrated chipsets.
OK, but now let's look
at how they're going to get so Hexagon
originated from Qualcomm's
general purpose.
This would signal processors that they
did many, many years ago.
I think almost two decades
ago, they started for the lower, but for
the actual for modulating
the actual physical layer, you have to
have a digital signal,
digital signal signal processor and
your cell phone.
And this is where the hexagon originated
from.
And it was also used for audio
processing.
Hexagon is a an architecture
that has very large instruction words,
and it can do about one to four
instructions per cycle, so it's very
interesting parallelism.
There it is a barrel processor,
which is like, you are
programing. You just have to get used
to this a little bit.
What this means is that
you basically every
process
sees a separate
set of
registers and you have like basically
three things
in this barrel and it shifts around.
So you actually have like three hardware
threats that need to be filled
by the by the software
scheduler.
And what this means is if you run
things off, if you run a task
single threaded, it only runs
at a fraction of the actual clock
speed. Namely, how many
of these things you have in the barrel?
So usually for the hexagon, you
have three of these slices in the barrel
and it shifts between these seats.
You have a unified outer space for coding
data that despite addressable.
However, there are alignment rules.
Usually things should be aligned by a
fourth byte,
but
by four by elements.
There are situations where the lines
yes, 32 general registers that
are 32 bit, but they can also
be used in registered pairs.
Those are then 64 bit wide.
An interesting feature is that
the architecture supports
so-called hardware loops that investible.
What this means is basically that
you initialize a
loop count to once and
you then have a loop body that you run,
but you don't need to spend any cycles on
actual comparisons in this loop.
So this is done by the hardware, and this
can be nested several
several steps.
There are many, many addressing modes on
this thing.
So, for instance, it has something
like a circular addressing
in reverse with a scatter factor
or something.
And I think the list of different
artistic modes in the Hexagon
manual is about one page already.
And in the latest revision,
the design rules
for this architecture
were actually for
the chip to be low power.
This is something that the constraints
here are truly orthogonal to to security.
So the idea was that if you use this very
long instruction word architecture
instead of out of order execution,
you gain a lower footage and a lower
power consumption.
So what you basically do is you don't
increase the clock rate on these chips,
but you increase the work that is done.
They also try to avoid all kind
of speculation like Pranesh speculation
or predictive data fetches.
And they also try to board members stalls
as as hard as possible.
Are three different levels
of parallelism in the
ZAPU. You have an instruction level
parallelism, you have a data level
parallelism of some things like
then you have the threat level
parallelism, which is
this this barrel thing?
There is
another interesting feature,
which is the
fact that the
atomic unit
of execution on this CPU is
not a single instruction of the so-called
instruction
packet, and
an instruction packet basically groups
together different instructions that will
be executed in parallel by the CPU.
There are full parallel pipelines
which are called slots for some reason,
and different instruction types are
assigned to these different slots.
And, of course, constraints for
this grouping supply that you can read
in the documentation.
I can't give you all the constraints on
this presentation.
Of course, these constraints
simply
have the effect that the hardware
resources are not oversubscribed.
If you read the manuals, they will tell
you that you cannot branch into the
middle of a packet.
It's not quite clear whether branching
in their terminology means that you
also should not be able to
return into a packet.
Empirically, however, you can
at least
most of the time.
I've had some issues with that, which I
however, think might have to do with
our caches.
So it might be that there's an
instruction level cache which
has a packet
fetched
already, and then it fails if I
go into the middle of it.
However, I've had success with this.
If there was a certain distance
between the
the
packet I branched into and the
location
that so that I returned into and the
location that I returned from.
OK, let's have a look at the chips that
evolution.
So there's the cutest
P six version.
One of the cutest V six
is the internal name for
the hexagon.
I guess it's like the sixth iteration of
the DSP that they produced
and the version one.
I actually I only found one
handset that supposedly has
this chipset, which is the Pentyrch
racer vigor.
I'm not sure. Has anybody in this room
ever heard of this device?
It's.
So the US market.
But even when you talk to people
from the US, nobody knows this one.
The curious fifth six version, too,
wasn't a lot of devices then all
of them that had accused the A6 50
or the MSM 80 to 100.
And these other chipsets,
the
cutest version three,
however,
seems to have mostly been in
CDMA devices.
One of the devices is not a CDMA device
that was able to find was the Sony Xperia
Accrue HD.
I was 12 s, so this is a
model specific for the for the
Asian market.
The version four, again, is
the one that is very widespread
at the moment
and
at the rest of the talk will be about so
version three and below.
Basically, it's historic.
It's not because that those
were from the times when
the baseband, the actual
SO baseband stack was still
running on an arm
CPU.
And the cutest architecture
really was for the audio processing and
modulation task.
So the Msomi 960,
for instance, is in the Samsung Galaxy
S four in the Apple iPhone
five
and the five S and
actually the iPhone five
nine nine six one five three
and the five S is nine six one
five
Ms.
And the BlackBerry
10, you again have the MSMEs and
18:9 16 there. There's a lot of other
devices that have the same
chipset.
I'm not going to list all of them.
And the very latest iteration
is the MSM
A9 74, which is,
for instance, in the LG G2
and the Sony Xperia XZ that Ultra
and also the Nexus five.
Internally, these also have these
Snapdragon names, so
be B5. For instance, that Snapdragon 800
Snapdragon 600 is cutest
before.
OK, but I prefer the actual
chip's names instead of the the
Snapdragon names.
So let's see what kind of documentation
and tool change you have.
So
Hex the Hexagon pro-Remain Sky now is
available for version two, four and five
for some reason is not available for
version three.
That wasn't widely used anyway.
When I last gave this talk
one half month ago, I wasn't aware that
they had released the version four and
version five reference manuals.
They did that in the
beginning of October.
But you really have to search for it, and
it's I haven't seen it announced
anywhere,
but I'll
give you the references at the end and
you can find it.
Initially, I tried to build my own tools
from scratch.
Which is, yeah, it's
the ICC, it's complex.
It's from in terms
of complexity is about as
complex as x86 with all of the extensions
that you have at the moment, I would say,
but with less documentation
and
obviously testing is a lot harder
than an x86.
So I mean,
for instance, like I guess like
a lot of people in this room have written
and arm this assembler, that's easy.
You can do that. Like for if you don't
want
to do all of the new stuff, you can do
that in a weekend.
You will not be able to do that for a
fact. And that's what I'm trying to tell
you will try.
We will most probably spend like a month
or two and then you will still
not have the full functionality.
And then I wish you very good luck with
testing that.
So it is.
It seems to be much easier to start from
a publicly released toolchain, and
Qualcomm indeed does release
a touching based
on the on.
They release patches to the new
toolchain. So you have kind of been utils
for the GCSE.
And recently they've also started
posting patches to Hexagon.
However, the so much extra
LVM, so their hexagon touches to LVM
and they are in the tree now.
However, the hexagon
supporting LVM looks very
rough at the moment. For instance, the
MSI framework that you would need for
disassembly for disassembling is
not there at all.
And the
output that I get from
the the assembler and the compiler,
it
looks OK.
But the maturity
of the cnn-youtube chain seems to be
much more advanced than the album
of the album. Things seems to be an
experiment, but I think that's where
there will move eventually.
If you look at the differences between
the diff, between the different revisions
and you want to see like how how has this
moved along?
Now you will see that there's
unfortunately no reference manual for the
version three available, so
you have no changelog.
So we have to defeat the awkward headers
in the hexagon neutrals.
But you will then find is they've added
this very useful instruction pause,
which allows it to pause for up to
263 cycles,
and they've added
a vector
instruction, which is a vector reduce
complex multiply by scalar instruction.
This is something that you need if you do
DSP programing.
This is the thing that you find
documented. Interestingly,
the only document the user level stuff
because you then find
all of these other differences to
be locked, you'll be unlocked.
Well, that's kind of obvious.
Then you have to either unlock, which
is potentially related to runtime
exceptions, but I don't
know what K0 means and what
zero lock does.
I guess it's a privileged instruction,
but I don't know.
It's not clear from the documentation
that they have simply for
the L2 clean envelope.
Index. I guess that's like for cash and
validation. For the same
for I'm. I have no clue what it does that
don't ask.
So what you get is documentation
for running your own user level
of code on the hexagon.
And I don't think that's the goal that
Qualcomm actually has.
So they want you to write
this application.
So. So they want you to write code
to make use of the DSP on the
architecture.
In version three,
version four, it's a similar thing if
you look there, they actually have
a change log what they what
has, what has happened
and they tell you without a virtual
support for virtualization.
Worse, I don't see it anywhere.
Not even like in the not even in the in
the in the
hexagon opcode files.
I don't see I don't see which switch
instructions are responsible for
virtualization.
They have added
support for software defined
radio, so they have added to instructions
which basically make the
the so-called reactive spreading
in Dublin KDM HD modulation.
Well, basically
two or three instruction thing,
but some of them they have already added
in version three. If you look at the
differences and therefore also they also
tell you that they have debug and trace
enhanced. But again, I
don't know, like there is no further
documentation about this.
And also, they allegedly have a logic
address space, which I can verify as
well.
I don't I don't see this in the
in the Akoth file photo generated.
Then if you look at the curious
P5 and up.
So this is the Snapdragon 800,
they've now introduced floating point
support.
That's interesting.
I guess this is related to the fact that
the Snapdragon 800 is the first
device that has
these all these audio capabilities that
first came out with the Moto X, where you
have voice activation, so you can
say, OK, phone, do something for me.
I guess that's what they need is the
floating point support for it, but that's
the first one that I was introducing.
And they also have some fanatical
enhanced data cache, pre fetch.
I don't, so I don't know what that is.
I haven't been able to find further
documentation about this.
There's also this version 5.5,
which, um,
I don't know actually which chip that
went into.
And this adds the cyclone registers
useful. If you want to benchmark things
and it has this vector, add in select
maximum half words instruction,
which yeah, it's a simple instruction
useful for something I don't know.
But I mean, if you look at their
manuals, you'll see that they've actually
choose this up here to do things.
They have actually added instructions
to make, for instance, things like H.264
decompression faster.
So they have very specific applications
in areas for which they app these
instructions. But you cannot.
If you don't haven't seen these
application scenarios, they can certainly
tell would have added them for unless
they tell you.
OK, but let's look at the very basic
things that look at the the useful
instructions that we all can
can understand. Because I mean, the fact
is, if you look for vulnerabilities
that you run across
a loop that does some
simple stuff, most of the
time you will not care because
it's in the lower layers.
So I mean, at least for me, that was a
very quick test.
If there are exceptions
to this, for instance, if you have
something that could be spot, which is
this a splat instruction
which puts the same bite into all the
Brits? That's the vector instruction that
is actually not four percent that can be
used, for instance, in memo set.
But look at the
manual and you will get an idea which
of the instructions you will mostly see
in DSP scenarios.
And then you can see, OK, well, if you
ever see this in a function, you will
probably not have to analyze it further
because it's just for the lower layers.
And it's not actually something that
would be allow you to trigger a memory
corruption easily.
I'm not saying it's impossible.
There have been cases where you
have been able, but it's just like it's
it's a metric for me to judge
how hardware we'll look at a function.
So if I can see it's from
the the lower signal processing layers,
I'm less likely to look at it.
Okay, so useful insertions
obviously are transfer instructions which
allow to transfer between registers or
allow you to put a new religion
to register.
And you have early instructions, for
instance, add, subtract, multiply
and so on.
And for this, you have like a 16
byte sign, immediate, immediate
for the arithmetic that you can use an
attempt for the logical.
If you do an X or something,
you have combined instructions
that
allow you to combine
immediately into basically
a register here,
and you have MUX instructions that
allow you to
basically multiplex with
the predicate.
So depending on the predicate, you put
one or the other into the instruction.
You have a very large chunk of knob
instructions two to the twenty four and
off instructions for you.
Basically, any instruction that starts
with the seven f sorry, I should
have mentioned that the CPU
architectures little engine.
So any instructions that start with
a seven F, the rest of that doesn't
matter. It's enough.
OK. Now.
A while ago,
I'm not going to tell you exactly when to
make searching a little harder.
An archive of ships The documentation for
the Amazon 960
mysteriously appeared on the developer's
site.
And
interestingly, this not only contained
chipset documentation, but for some
reason they
whoever posted it
also put seven a.m.
security Bolton into that archive.
So Mess is the advanced
mobile subscriber system, which is the
Qualcomm codename for the baseband stack,
and these basically
are
very detailed descriptions
of the bugs that they have fixed
in the trees that they give to
the vendors.
And this obviously means that all of
these bugs must now be considered public.
But you also find
interesting things
like the leaked docs, for
instance, claim that
in
benchmarks, they found that Hexagon
for their baseband stack spends up
to three times to cycle
than an arm nine on
the control code in the baseband,
so the control code.
This means, like all the all the things
that are not the the actual
the modulation.
OK,
now
I'm skipping around a little bit.
I wasn't quite finished with the
architecture. Obviously, I just wanted to
put the thing about the leaked docs
in there who would come back to
that in a bit.
But first of all, you have to also see
what kind of different control registers
you have
on
the CPU. So you have the loop registers,
which are for the hardware loops.
You have a program coming.
Obviously, you have a user status
register, just a modifier
registers which are for the circular.
Everything notes you have predicate
registers, which are for things like
comparisons of the story, result of a
comparison.
You have to use a general pointer
widget for things like fed local storage,
and you have a global pointed that can be
used for global data.
Now, before we come to actual
vulnerabilities and looking at them, we
have to understand the calling
conventions a little bit.
So there are Kohler's saved
and cold these safety registers
in the FBI.
Outside the FBI document as public?
No, it wasn't in Alaska.
I did not know that it was public last
time I gave the stock
register generally.
So registers are zero, two or
five are generally used for passing the
parameters, but
parameters can be modified by the culty.
So the caller must not depend on this
being on modified upon return
are six to our 15 or scratch registers,
which need to be color saved
are 14 or 15 are
oftentimes in the API and they're
supposedly they're supposed to be
used for of the procedure.
Linkage tables are
16 to 17.
27 are against scratch
justice, but this must be clearly safe,
not call safe R28.
Also, the scratch register color
saved and then you have R29
or 31, which also
have symbolic names, namely
the link register the
the frame point in a stack pointer.
And these are clearly
saved and their use by frame
and dialog frame, which are these are the
things that are used for setting up
an unwinding of the stack.
And then you have the process of state.
If you want to pass
things through function,
you feel left to right are just registers
are zero, two or four or five.
If it's a parameter
that is larger than 32 bits,
you can use register pairs if it's up to
64 bits.
However, the pair must always be even
odd. So if you have,
for instance, your register
are three, you have to skip this if
you have a 64 bit quantity,
so you go to our for an hour
five and the rest goes onto
the stack.
OK.
You also have the
these two
functions,
Alex Frame and dialog frame,
which basically
manage the register of
the register.
Yeah, well, the the local data window
basically on the stack.
So what these do is they pushed the link
register and the frame pointer onto
the stack and they subtract
a size quantity.
So you give our frame a size quantity
from the stack pointer and
then they assign
the frame pointer with the address
of the old frame pointer that was on the
stack.
And the dialog frame is the inverse
of this procedure that you use
upon return. There's also now a dialog
return, which is not on the slide,
which is basically a dialog frame
followed by a jump to the link register
so you can go out of the
all of the the instructions in back to
the previous function.
OK, so let's have a look
at four simple snippets.
Actually, in terms of time,
I might skip this because we're looking
at something a little bit more complex
later.
So.
There's also the question of
the security of the chip fabric.
So the last time I spoke about Qualcomm
CPUs at a
chaos Congress,
what was the case was that you have
the baseband CPU that was the master
of the system on a chip.
So this basically overruled all of the
other components on this chip.
So this was a very scary thing because it
meant that if you had a successful
baseband attack could basically exploit
and you could basically persist on the
whole chip.
In the current generation
of these systems ownership, it's a much,
much more complex story because
the current generation is
contains a lot of armed force.
They actually have a dedicated
armed core and armed seven for the bring
up of the ships.
This is the
so-called r.p.m.
chips and
the modem from where now is loaded
by the highly operating system, for
instance, Android or iOS, and not the
other way around.
There is, if you look at some of these
leaked documentations, you will see that
they paint little yellow
boxes that they call hardware
firewalls.
There is no full documentation about
this.
I don't. I don't know what exactly
they do.
I'm just a
little bit skeptical because as far
as I know, this has been untested
externally.
So at the moment, it's not clear whether
these new chipsets based
application process, the escalation is
possible.
For instance, I don't know
whether you can do funny things with the
emails.
So, for instance, you can if you have
access to either registers of another
core, whether you
can trigger a transfer to help you,
for instance, into the application
processors memories.
This is something that needs further
research.
I will also tell you how to do this
research later.
OK, but more changes,
the old chips used the very, very
old chips to proprietary
operating system called Rex.
Later, this Real-Time excessive use
of force prop onto something called Oak
Hill for, which is the commercial
microkernel based on L4.
And in the
accident baseband Frommer's, they've now
abandoned this okl form.
They have their
own
Real-Time Operating System, which is
called Blast.
Sometimes it's also called Q Our.
And this apparently was redesigned from
scratch.
You will see some of the remnants from
wrecks
for compatibility reasons.
And funnily enough, you'll also find
an ARM 11 core that
runs for still.
But it's not running
the actual baseband.
It's just another core
on the SLC.
For some reason.
Security mitigations were
now looked at this three years ago, there
were no security mitigations.
Now it's a lot better, so they have
stuck well, maybe it depends
on the vendor. They have set cookies that
are generated by the built toolchain
visa on by default,
and they also have a non executable
stack and heap.
And they also have criminal and user
mode separation in blast,
except for
the fact that in 2012
they had an advisory about this.
Were it became
so this in retrospect, it became clear to
me that they only enabled this
with the release in May 2012.
So this is when that enabled that.
And this is when that enabled the
separation between the user and the
kernel mode.
And the interesting
thing about this is that they
state that the customer
must very find that the performance
impact of these changes
is acceptable.
So what this means is not everyone
necessarily has these things enabled.
For the major vendors, however, I found
them to be enabled, so for instance, I've
looked at a mass for for
for the S4.
For me, I looked at all
these things were enabled and I guess
similar story for
for
all the big vendors.
Hopefully
they
have safe. I'm thinking for the heap.
There are tricks that you can do to
get around this, obviously, but it's
become harder to heap exploitation.
And at the moment, there's no SLR,
which is nice for attackers, obviously,
but also Asal are embedded devices
generally is hard.
OK, so let's rock and roll.
So initially,
I and other people as well thought
that
exploitation on this architecture with
Depp enabled
would become tricky because
of the the
way that Alex came into our framework
and because of the fact that you have to
find, you have to then
find a place of function that do things
for you.
And oftentimes this has prevented
us things useful things
are prevented by our friends.
But then you note that
this dialog frame sets
the FP and this is a very SILVERBEET
behavior. If you had something
that would pop, the point to
off the stack on are the architecture.
This is a very similar thing.
And
as long as the instructions packers are
not in the case, they can be split.
Now,
we didn't talk about this because
I skipped over the code examples, the
so-called compound instructions.
So this means that it's actually one
for by words that does two instructions
in parallel.
These are very annoying for return on
programing because they do all digits
these two things together.
They also sometimes in documentation
called Duplex.
It's not clear they use both.
However, you can deal with this.
They just create constraint constraints
for gadgets.
So mostly what this boils down to is
that you need automation.
You will not be able to easily do drop
by hand anymore.
What we did in 2010
was
Tim Cornell.
However, Flake and I,
we wrote a paper about
this problem how to use S.A.
solvers to handle the constraints,
to build up payloads.
And there's a Black Hat
2010 talk in a wood paper on the subject.
And basically, the same things apply with
some variations for this.
There's still some way to go, because
back then we used rail, which
is the reverse engineering intermediate
language for
this toolchain.
And while there's no
real translator for Hexagon at the
moment. But if
you
are,
if you're comfortable with
not having complete coverage, what you
just do is to write something that
translates all the basic instructions
into some type of syntax for you.
And you ignore all the rest and you say,
OK, I will not care about this in
terms of gadgets.
And then you can automate this.
You can also do manual gadgets search,
but this is very labor intensive.
I've done that two weeks
ago. It was not fun.
But if you do that manually, you will
also see that what to
build a pillow? What you will do is you
will alternate gadgets ending in Jump
31, which is the
i3 one, which is the link register and
the yellow frame. So you will build the
rough chain that alternates between these
two.
OK, but now you probably want to know,
how do you do this yourself?
And the problem is that most smartphones
have modern features that are checked at
boot times.
So for use, be
modems, this is different.
So most of the spindles that
you find, I have freely modifiable
rumor. There may be exceptions that I
haven't seen them yet.
Also, there are Samsung Galaxy
S Force, where there's no
signature check in the modem firmer.
It's not clear exactly because
I have one of these handsets
and
I've talked to other people and they
haven't been able to verify this.
This depends on the Fuze configuration
in
the chip that you cannot actually read
out without.
Well, I understand nobody, but Qualcomm
can read it out there.
Not even if you have. Kernel level
access, you can read this out because
of trust level shenanigans.
Trust them shenanigans.
I have one of these phones I I
can built a
I am a tool to test
if people are interested.
So then many other people can run
this on their S4 if they have it rooted
and they can test whether or not
they can modify their their modem firmer.
According to the leaked docs,
the modem
bring up and signature check is done by
a credit court.
And the way I understand is this is done
in trust, in a trust them compartment.
So it's not clear, but
bootloader hacks me may help you get
around this problem.
I've been talking to someone who had some
ideas about that
in terms of tools for analysis.
There's the curious six version
five ToolChain Now, which is released by
the Qualcomm Innovation Center, which is
based on CC four four, and I
forgot which version of pin utils it was.
This can be used to compile since C++
code and for actually inspected
using object.
It doesn't
build cleanly. You have to remove some
stuff. I had to remove Gadhafi from the
bin utils and have to tweak.
I had to tweak the, um
uh,
the just the C compiler process a little
bit. But you can get it working
for the modem from here that you get
in firmware archives,
you have an empty shelf section headers,
so you cannot just assemble that with
object and you have to first populate
that manual with your write a tool for
that. There is also
a hexagon plugin
for either pro that was written by the
gentleman here in the front row
and was released by just in case.
This is also based on a
bunch of tools. It's for the version
four at the moment I have
last week. I've done some, some, some
things so that it runs with version five.
I will contribute that back as a push
to your master,
and it still crashes on some frameworks.
For instance, on the iPhone five from
where I haven't quite figured out what
the problem there is,
but it it works.
It works for analysis, as you will see.
So as an
example, we will look at one of the
bugs that is a classic stack overflow
patch in May 2012
on the LTE error interface, I picked
this particular bug, even though some
people might find it, find it
uninteresting because it's not easily
exploitable.
Not many people have an LTE capability
to send these messages, and also
the stack protector
prevents you from using that.
On this, I also have
a memory, a memory disclosures,
which there also are many
off in the um, if you
look at the leaked documents.
But I'll just talk
about this part.
And the interesting thing is, this just
again takes one message
a test loop back message, which is larger
than 100 bytes.
And it's I
found it very surprising to see such
straightforward bugs.
And the only explanation I have was that
at the time, the LTE stack was still very
young.
And when I tried to,
um,
to verify this, this
is what disassembly for this
particular function looks
like. I have
I
have not posted. I first want to post a
screenshot of the actual bug, but
I'll just I'll just
posted this show this summer here.
So what you will see this is actual
hexagon code. So the first thing is this
the algorithm, which basically sets up
the stack.
Then you will have a call
to a function which states these colli
registers are 16
to our 19.
Then you have our
three, which is set to the stack canary.
Then you have a little bit of shuffling
around the registers to save them for
later. Then you have a call
to arms a trampoline.
This is interesting.
So most of the calls to these functions
to the often just functions are actually
trampolines.
So they go to a function where you have
an immediate extend and then a
direct jump to that function.
So it probably would be useful to call
this into one function by
or have an option to call us this so that
it's more condensed.
And then
in the same instruction package, you also
have a right to the stack
for the Stack Canary and you set
the
one to zero. And the way it works is that
basically the call is done there.
So this is one instruction package,
but basically the registers set first
and the memory is written first and only.
On the coldest month
after
that. There's some insulation for this
message, rowdier.
Again, this is a trampoline function
and then you will see this P0, which
is the predicate which basically
comes from the comparison of this
Register 017 and
this register or something.
If you look up here it is.
The register that is it
comes from our once it's identical to our
one. This was the length that was passed
on. And here this basically checked with
the till. The message length is greater
than 100.
If it's greater than 100, it basically
errors out.
And at the
end, what it does it
so are
all basically means that a message is
written and it goes to the to the
to the end of the function, which
basically is the check and everything
and the check in or just fetches the
canary again from the check from the
stack and compares to this
to this global value.
And if it's if it's equal, then
it's good. If it's not, then the stack
has been smashed and it's an error
condition.
So this is
the latest version of the
baseband that you will get if you
have all the OTERE, all the updates
for the Galaxy S4, but the
analyst here.
So this is fixed there.
But I mean, also the bulk of the buck has
been
made public into, well, not made public,
but the advisory has been given in 2012.
So it's of course it should be fixed
now.
There are also other baseband versions
and other phones for this is not fixed,
but I'm not telling you which
one these are now.
It's just
I wanted to give you an exact positive
example for this talk.
If you want to analyze more complex bugs,
what you realize, I mean this this
backwards, shallow, it was in one
function and it was this one
parameter that came in
and
a copy. So this is
simple. For more complex bugs,
you will often need to trace
messages across the tasks.
This already became obvious when I did
research for
a talk
at Blackhearts 2011, where we looked at
a protocol called Simple that is
sometimes also processed
in the baseband.
If you don't have source code, you don't
know where and how these messages are
about it.
However, if you have a malleable
baseband, you can perform dynamic
analysis, and
the idea that I use here is basically
I hook into the message rotor.
Was this just this message or send
routine
and
then I can trace where the messages are
going? And this message
really has used this to for the
different things and this you structure,
which is not publicly disclosed
at the moment.
It also seems to be different between
different
OEMs, so it seems to be auto generated.
But I have a table that I have extracted
for the S4 that I will also
put on my block.
It doesn't, doesn't fit here.
I should finish soon, so I will close
with two things, namely the way
forward.
I will talk about the way forward for the
offense side and a way forward for the
defense side.
So takeaway lessons here are
the new architecture that we have
on the Qualcomm chipsets has raised the
bar of entry significantly.
A lot of people can reverse and work
with arm code there decompose form.
This is not the case for Hexagon,
and I
haven't met many people who've done
analysis of Hexagon code.
However, Qualcomm
dominates this market at the moment, and
attackers will have an
interest, and they do have an interest in
their chips, so they will adapt and
learn well-funded adversaries,
at least.
Moreover, public weeks of vulnerability
information obviously makes the attackers
task much easier because
they can use those
for testing, whether they're basically
they have, they don't have to find a
vulnerability anymore.
They can just use the public
vulnerabilities either for training
or maybe they're all they're still
unfixed in the targets they're attacking.
The takedown is possible, in fact, like
this archive has been taken down a
couple of days after it has been posted
but has reappeared in different
locations, as the internet doesn't
forget. So you go after
these things, which you can't get them
back on if you've seen other things as
well.
But this means is you don't have to find
the box, you just have to find the bug
descriptions.
And sometimes OEMs
have slow patch cycles.
I hear that even new phones
shipped that still have
the bugs
from
the talk I gave in 2010.
So this is how slow some of the patch
cycles are. They're not
high end smartphones, but
more the medium to low end
for rough exploitation.
Forget about it if you don't automate,
but it's not as difficult as you would
first expect.
For the defensive side, I think that
killing bugs and hardening is only one
strategy
because
after three years, we still see the same
silly memory corruption problems.
I mean, you could say, OK, after 40
years, we still see memory corruptions.
Then you go to address books, talks and
he tells you how to kill the whole ball
class.
However, that is not entirely practical
in all cases.
However, what I think is possible are
architectural changes.
So the baseline you should assume
that things that
communicate to the outside world will
be compromised
and
minimized damage based on that
assumption. So why should the baseband
have access to microphones
on your smartphone or to the camera or
to receive?
I mean, this all already the the
application CPU that has that.
Why you why should you give that to both
sides?
You can report that to the applications.
In fact, they often do that, though that
do that
if you have a
short memory architecture.
It's somewhat harder, though, because
verifying that this short memory
separation is good
is is basically impossible without
giving up all of the internal
documentation. So
if you have designs
where you have a separate modem chipset,
you can.
As some compromise, you can
compartmentalize if you have the
ship memory approach, you can do that
as well, but you also have to trust the
vendor a little bit more
so.
That's it.
These are the references I wanted to give
you if you want to read up more on the
architecture.
I cannot give you a link to the two
leaked docs because they have
been moving again.
Thank you.
We have about five more minutes for
questions.
So if you have questions, just line
up, there are mikes there,
they're there and over
there, I think yes.
Anyone in the room
internet
knows nobody has questions.
OK, OK.
And thank
you. Please one question.
We have five more minutes.
Do you have a question?
Go ahead.
OK. I think he has a question.
His leaving on the tour
in your in your research, have you come
across any documentation for Q, KDM
or Q? Am I
can you? So would I have come across
a tax for Q my
and
yes, for any Qualcomm proprietary
protocols that the are based there?
Well, there are a lot of vulnerabilities
described in these and
these bulletins. I haven't seen
code for making use of them.
I've written some of that myself, but I
cannot share that.
Anyone else?
Yes. OK.
Three, please.
Yes. Hey, I wanted to ask
if you revised your
research on the Infineon baseband.
Have you tried that again to reevaluate
it if they actually patched everything?
Yes, I
did. I have.
Well, after I gave the talk,
I gave a talk again at Intel.
I used two different vulnerability there.
I didn't tell them about this
vulnerability.
After that, they patched.
So
I tried again.
But I cannot talk about this.
Sorry. All right.
Thanks.
That's the internet internet type of
question. Yeah, OK.
Yeah.
Sulu. Nice asking if you could
elaborate on the real life, real
life risk of these attack vectors,
how likely this is.
Some bad guy would actually go those
routes and
the real life?
Well, it depends on who you are.
I would say that
if people, if you're not worth at
least one to two million, if
the information that can be gained from
this attack is not worth at least want
one million to two million dollars,
nobody will bother with this kind of
attack.
However, if you
are discussing information that
is in this ballpark range or above,
you might have to worry about them.
This is the basically the market price
for this,
for the new instructions, the new
hardware instructions that you see come
along with what you said you made
all times. You don't know what they do
until you see documentation for them, but
presumably they're taking the place of
real code that is now.
Yes, you're
right. You can disappear.
That's correct. So I mean, still,
if I see it well,
I see the, for instance, the K0 lock
in a privileged remote
piece of code.
Still, I don't know what this does.
Same for set for the set.
I'm asking it right.
Some value.
I don't know what it does.
Do you see this in the same code?
Do they actually have capability
registers where they'll use the hardware
instruction?
If the revision
idea of the chip
is a certain level?
No, you see this in code
actually at least four keys, zero
lock and eye mask.
I've seen that in code, you'll see
both the software version and the
hardware, the new hardware and Touch ID,
or you have to go to previous versions of
the baseband for
this. I don't know if current current
versions
OK.
Anyone else
internet?
No. OK, then please give him another
round round of applause.
Thank you.