Slashdot Mirror
Vulnerabilities Discovered In Mobile Bootloaders of Major Vendors (bleepingcomputer.com)
An anonymous reader writes: Android bootloader components from five major chipset vendors are affected by vulnerabilities that break the CoT (Chain of Trust) during the Android OS boot-up sequence, opening devices to attacks. The vulnerabilities were discovered with a new tool called BootStomp, developed by nine computer scientists from the University of California, Santa Barbara. Researchers analyzed five bootloaders from four vendors (NVIDIA, Qualcomm, MediaTek, and Huawei/HiSilicon). Using BootStomp, researchers identified seven security flaws, six new and one previously known (CVE-2014-9798). Of the six new flaws, bootloader vendors already acknowledged five and are working on a fix. "Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks," the research team said (PDF). "Our tool also identified two bootloader vulnerabilities that can be leveraged by an attacker with root privileges on the OS to unlock the device and break the CoT."
Am I the only one that thinks that this information should have been released to the people making rootkits, and not the vendors?
Time has shown that the vendors cannot be trusted and are far more evil than the people allowing people root access on their own machines. Bloatware, regressions through updates (often forced or nagged into acceptance), pushing their own branded crapware, removing options from the user, *preventing* the user from making the machine work the way they want it to, and so forth. You want to *not* have the screen turn on automatically when it starts charging? Sorry, you don't have permissions to do that on your own machine. They're evil. They should get the second look at these vulnerabilities after everyone who wants to root their devices has done so.
Never thought I'd be a switcher.
"damn it"
We get to root our phones.
This perpetual motion machine Lisa made is a joke, it just keeps getting faster and faster. - Homer
I have a lot of older devices that I want this for.
Furthermore it just proves the NSA/FBI/your local spooks and kooks, probably have had this shit for years, or had agents ensure the same field of exploits were inserted into each company's bootloaders.
This is why they want keys THEY control in place, and why they don't want end users able to program the devices in a way that makes it difficult or impossible for them to compromise.
captcha was 'travesty'. Indeed, indeed it is.
Once you break into the boot process you can launch any type of attack and perform any type of action.
From replacing firmware and recovery code to whatever else you can imagine.
Even install a better custom ROM.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
you can see the future of IoT. Tons of phones will never get any security updates. I don't think IoT manufacturers will do better than that. Internet of Things = Internet of Vulnerabilities.
How does one gain access to bootloader code without an ICE? And if you have that access, what difference do security holes make?
Eg., I would used memcpy to move the OS and application from ROM to RAM, then jump to the RAM start address. How would you attack this?
The source of this evil is simple: That "chain of trust" isn't about security, but it's about control. Whether the control buys you security is something else again. But it is clear that the signed boot rigmarole puts the control firmly in the hands of the vendor, and not of the customer. For the customer is a consumer and therefore not to be trusted. See how this works?
Let me spell it out: Because the consumer is not to be trusted he cannot have control, therefore the signing is control over the device in the hands of the vendor and thereby security against the consumer. It's entirely logical. It's also literally the reason all those things talk about "trust": It means the vendor can "trust" you haven't installed your own firmware. It does not mean the firmware is fault-free nor does it mean other actors, like certain state actors well-known for this trick, haven't injected code of their own into the signed code chain.
More like Chain of No Trust! Am I right, guys?!
Oh c'mon, it was hardly worse than the ladyboy we have now.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I have this mental image of a noose around my neck and someone yanking the attached chain. I think they mean that chain of trust? Trusting the chain to keep the user in reign?
It's a chain of treachery. If anything, this is GOOD news. It may allow people to actually own their devices, at least for a while.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
BootStomp's code:
https://github.com/ucsb-seclab...
UCSB's team site:
https://seclab.cs.ucsb.edu/aca...
Don't ever reboot your phone?
3 of the 4 don't come from China. NVIDIA and Qualcomm are US companies and Mediatek is based in Taiwan.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Was there a divorce and wedding I missed hearing about? Reggie changed his name to Michael?
Technically NVIDIA is run by a Taiwanese guy, who does his manufacturing in Taiwan and China but lives and went to school in the US. Plus, half of this is probably just the Chinese government being involved over the vendor; mandatory backdoors and all that.
we can finally install Windows on our locked down android phones?
You think the boot process is as follows:
1. Use memcpy to move the OS and application from ROM to RAM
2. Jump to the RAM start address
This is not the case. In fact, the boot process is more similar to the following:
1. Use memcpy to move the OS and application from ROM to RAM
2. Calculate the hash value of the OS and application
3. Decrypt the previously stored hash value of the OS and application using the OS publisher's hardcoded public key
4. If the hash values differ, hang
5. Jump to the RAM start address
The attacks are on steps 2 through 4. The summary mentions a "chain of trust"; this is so-called because the bootloader verifies the kernel in this manner, the kernel the userspace, and the userspace the apps.
3 of the 4 don't come from China. NVIDIA and Qualcomm are US companies and Mediatek is based in Taiwan.
To what extent does Taiwan, Republic of China, have more practical autonomy from the PRC than, say, Hong Kong SAR?
I think they actually mean:
Some of these vulnerabilities would allow a user to execute arbitrary code as part of the bootloader (thus allowing users to have some control over their devices), or to perform installations of custom Android versions with better security than the one that the vendor still hasn't updated after 4 years," the research team said (PDF)
This was the most useful information that most people were looking for after skimming this article :)