What actually is QuadRooter and how does it work on Android devices?
It is currently in the news that 900 millions Android devices are vulnerable:
Serious security flaws that could give attackers complete access to a phone's data have been found in software used on tens of millions of Android devices.
The bugs were uncovered by Checkpoint researchers looking at software running on chipsets made by US firm Qualcomm.
Qualcomm processors are found in about 900 million Android phones, the company said.
The article also said that it is something at the chipset level.
Is this true?
And how does this work internally?
Answer
What is QuadRooter?
Quadrooter is a name for a set of security vulnerabilities including
These are weaknesses in Linux/Android system software provided by chipset manufacturer Qualcomm.
They could be exploited by an app that you download, even one that does not ask for any special privileges. Such an app could exploit these vulnerabilities to gain higher level control of your phone, including access to any private data you have stored on it.
The US National Vulnerability Database gives the following description for the vulnerabilities listed above
2059
The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows attackers to gain privileges or cause a denial of service (race condition and list corruption) by making many BIND_CONTROL_PORT ioctl calls.
2504
The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28026365 and Qualcomm internal bug CR1002974.
2503
The Qualcomm GPU driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28084795 and Qualcomm internal bug CR1006067.
5340
The is_ashmem_file function in drivers/staging/android/ashmem.c in a certain Qualcomm Innovation Center (QuIC) Android patch for the Linux kernel 3.x mishandles pointer validation within the KGSL Linux Graphics Module, which allows attackers to bypass intended access restrictions by using the /ashmem string as the dentry name.
You can download an app named "Quadrooter Scanner" from the Google Play store - it will tell you if your phone is vulnerable. The app was written by Checkpoint Software Technologies Ltd. I have installed it, ran it and uninstalled it. Other than that, I cannot say if it is reliable in any way.
Qualcomm have issued software fixes to manufacturers
Google have addressed a couple of these in their security bulletins for July and August
Issue CVE Severity Affects
Nexus?
Elevation of privilege vulnerability in CVE-2016-2503, Critical Yes
Qualcomm GPU driver (Device specific) CVE-2016-2067
...
Elevation of privilege vulnerability in CVE-2016-2504, Critical Yes
Qualcomm GPU driver CVE-2016-3842
...
Elevation of privilege vulnerability in Qualcomm GPU driver
An elevation of privilege vulnerability in the Qualcomm GPU driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as Critical due to the
possibility of a local permanent device compromise, which may require
reflashing the operating system to repair the device.
CVE References Severity Updated Nexus devices Date reported
CVE-2016-2504 Critical Nexus 5, Nexus 5X, Apr 5, 2016
A-28026365 Nexus 6, Nexus 6P,
QC-CR#1002974 Nexus 7 (2013)
I suspect owners of vulnerable phones have a number of options including some or all of
- wait for manufacturer to provide an over the air update to fix this.
- don't download any new apps
- prevent apps from being updated until vulnerabilities are fixed
- uninstall all superfluous apps
- power down the phone until sure a fix is ready
I guess many people would regard at least the last item as overkill.
Are 900 million Android devices vulnerable?
Worldwide sales of smartphones are of the order of 1 billion each year.
Qualcomm are a major manufacturer of integrated circuits used in smartphones. They sell a variety of ICs including the popular "Snapdragon" range of ARM-based CPUs. Their annual revenues are of the order of USD 25 billion.
According to Forbes
According to ABI Research, leading chipset maker Qualcomm remained a leader in the LTE baseband chipsets in 2015. The company held a massive 65% of the LTE baseband chipset market in the year.
There may be 2 billion smartphones in use in 2016. Of course, a lot of these will be IOS devices. There may still be one or two Windows phone users out there :-).
The average lifetime of a smartphone might be two years or might be four years. There is certainly a market in second hand smartphones. It seems plausible that many smartphones older than one year are still in use.
Of course, there are Android devices that are not smartphones. Google estimates there are 1.4 billion active Android devices worldwide. 65% of 1.4 billion is 910 million. This might be how journalists arrived at this figure. If so, it isn't at all accurate.
However, assuming that the vulnerable drivers have existed for several years, it seems plausible that hundreds of millions of devices might be affected. 900 million seems to be the extreme upper end of possible estimates.
No comments:
Post a Comment