Slashdot Mirror

← Back to Stories (view on slashdot.org)

Vulnerabilities Discovered In Mobile Bootloaders of Major Vendors (bleepingcomputer.com)

Posted by msmash on from the security-woes dept.

An anonymous reader writes: Android bootloader components from five major chipset vendors are affected by vulnerabilities that break the CoT (Chain of Trust) during the Android OS boot-up sequence, opening devices to attacks. The vulnerabilities were discovered with a new tool called BootStomp, developed by nine computer scientists from the University of California, Santa Barbara. Researchers analyzed five bootloaders from four vendors (NVIDIA, Qualcomm, MediaTek, and Huawei/HiSilicon). Using BootStomp, researchers identified seven security flaws, six new and one previously known (CVE-2014-9798). Of the six new flaws, bootloader vendors already acknowledged five and are working on a fix. "Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks," the research team said (PDF). "Our tool also identified two bootloader vulnerabilities that can be leveraged by an attacker with root privileges on the OS to unlock the device and break the CoT."

8 of 76 comments (clear)

  1. Free the Bootloaders by ShakaUVM · · Score: 4, Insightful

    Am I the only one that thinks that this information should have been released to the people making rootkits, and not the vendors?

    Time has shown that the vendors cannot be trusted and are far more evil than the people allowing people root access on their own machines. Bloatware, regressions through updates (often forced or nagged into acceptance), pushing their own branded crapware, removing options from the user, *preventing* the user from making the machine work the way they want it to, and so forth. You want to *not* have the screen turn on automatically when it starts charging? Sorry, you don't have permissions to do that on your own machine. They're evil. They should get the second look at these vulnerabilities after everyone who wants to root their devices has done so.

    1. Re:Free the Bootloaders by Anonymous Coward · · Score: 2, Insightful

      > Time has shown that the vendors cannot be trusted and are far more evil than the people allowing people root access on their own machines.

      Yah, but people will stop buying the bad ones, thus bankrupting those evil vendors. The Invisible Hand and Ponies will surely fix that!

      Oh, wait...

      Yes, all a bit tongue-in-cheek, but I think we're seeing a failure of the maxim "market forces for the benefit of all" dogma here.

    2. Re:Free the Bootloaders by admin7087 · · Score: 3, Insightful

      No, you're not the only one. This so-called "chain of trust" is ridiculous. People are forced to trust binary blobs of various nebulous business entities with a long history of nefarious business practices, bad security, and unnecessary collusion with sometimes shady government entities. That's pretty much the opposite of trustworthiness.

    3. Re:Free the Bootloaders by Opportunist · · Score: 3, Insightful

      The ultimate sad realization is that the person who bought the device isn't the one who gets to decide who to trust. I trust myself by default. But I am not the one who gets to trust. The manufacturer of the device I pay for gets to say who the device that (again) I PAID FOR trusts.

      THAT is what's ultimately wrong here. The fundamental aspect of ownership is to have total control over something. I own my living room table. I can, if I so please, turn it into firewood. Or sell it. I may put a different coat of paint on it or convert it into a workbench. And nobody, not the government or the carpenter that made it has any right to keep me from doing so.

      Why the FUCK is this different as soon as "on a computer" is added to the mix?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:Free the Bootloaders by Sloppy · · Score: 3, Insightful

      It's an even sadder realization that the person who bought the device is NOT considered to be trusted by default, and that said person must hack the device they own to get that trust back.

      Never buy any hardware until after you have at least asked who is its master. Whose interests does that computer serve?

      And if the master isn't you, then instead of asking how much you pay for it, ask how much you're being paid to use it.

      --
      As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
  2. Re: iOS really is more secure. by Anonymous Coward · · Score: 1, Insightful

    Hey, remember that Ma c virus tbat remained undetected for 2 years?

    Nobody reports anything to APL anymore because why would they?

    Time and again, it's blacklisted researchers demonstrating their apps... Plus they can make more money selling too the black market (sadly).

  3. From what manufacturers do to your phones by lwmv · · Score: 5, Insightful

    you can see the future of IoT. Tons of phones will never get any security updates. I don't think IoT manufacturers will do better than that. Internet of Things = Internet of Vulnerabilities.

  4. Re:For the next few weeks.... by drinkypoo · · Score: 4, Insightful

    Most devices won't receive any updates even if they are totally compromised, because that's how much of a shit the vendors give about their customers. Only devices getting updates anyway will get locked back down.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"