Slashdot Mirror
TrustZone Downgrade Attack Opens Android Devices To Old Vulnerabilities (bleepingcomputer.com)
An anonymous reader writes from a report via Bleeping Computer: An attacker can downgrade components of the Android TrustZone technology -- a secure section of smartphone CPUs -- to older versions that feature known vulnerabilities. The attacker can then use previously published exploit code to attack up-to-date Android OS versions. The research team proved their attack in tests on devices running the ARM TrustZone technology, such as Samsung Galaxy S7, Huawei Mate 9, Google Nexus 5, and Google Nexus 6. They replaced updated versions of the Widevine trustlet with an older version that was vulnerable to CVE-2015-6639, a vulnerability in Android's Qualcomm Secure Execution Environment (QSEE) -- Qualcomm's name for its ARM TrustZone version that runs on Qualcomm chips. This vulnerability allows attackers root level access to the TrustZone OS, which indirectly grants the attack control over the entire phone. The research paper is available here, and one of the researcher's authors explains the attack chain in an interview here.
Hack the planet!
So you can downgrade your phone to remove bugfixes and ilet it be exposed to known issues? Is there a point here I am missing?
Security is an illusion and nothing is secure
Wait, I see Attack in the heading, as in some other entity forces the downgrade.
Windows Phone could not have been this bad.
I thought commonly used TrustZone firmwares do have revocation/rollback protection but the OEMs doesn't use it when upgrading the OS. E.g. they bundle a new Widevine version in the update but they don't actually revoke old vulnerable ones.
As explored in depth by Google's Project Zero here:
https://googleprojectzero.blog...
Or is this a real bypass that allows installing a revoked trustlet? The article was light on details.
/ greger47
DACA....is CACA
From TFA:
"We have already reported this vulnerability to the affected mobile vendors, and they have integrated patches in their latest updates, as well as fixes for newer device versions," Yue told Bleeping via email.
Who? Which devices?
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
This theoretically opens a way to Root ANY android phone. That could be Great.
The main dangers to you as a smartphone user are your cellphone network carrier and the manufacturer of your phone. Both both of them have a direct interest in invading your privacy for money or to keep you captive to their machinery.
Fortunately, Android is built on open source foundations, so Google must publish the source and a build chain. Rooting your phone and installing a 3rd party Android build ( such as LineageOS ) goes a long way toward foiling this kind of carrier or OEM fuckery. It won't keep your carrier from examining your packet stream. but at least he won't be able to surveil you directly or install programs on your phone which you cannot remove. Because of this, many smartphone providers take steps to make rooting their devices difficult or impossible -- but this vulnerability might provide a way around all of them.
Not a web designer.
And some things are less secure than others, sometimes fundamentally much less secure.
The cesspool just got a check and balance.
Anyone who uses one of these devices -- designed from the get-go to spy on the user -- is a patsy, a mark, a fool. Free software, and free hardware, exists for a reason. Think about it.
Android is so much more secure than iPhone!
NOT! /Borat
I realise the above post is flamebait, but I wish these posts would stop using the word Android.
The vulnerability in this case has nothing to do with Android.
It's an exploit targeting ARM hardware/firmware - nothing to do with Android.
When you exploit the hardware of a platform, it doesn't matter what OS the platform is running - it is no longer secure.
The same would be true of iOS or any other OS running on this Qualcom chipset.
It's just a happenstance that most open devices run Android.
if iOS was allowed to be run on third party hardware, many of these same exploits would apply.
if iOS was allowed to be run on third party hardware, many of these same exploits would apply.
If my aunt had balls, she'd be my uncle. "Ifs" are meaningless here: in the security arena Android is failing, iOS wins.
Android is so much more secure than iPhone!
NOT! /Borat
I realise the above post is flamebait, but I wish these posts would stop using the word Android.
The vulnerability in this case has nothing to do with Android.
It's an exploit targeting ARM hardware/firmware - nothing to do with Android.
When you exploit the hardware of a platform, it doesn't matter what OS the platform is running - it is no longer secure.
The same would be true of iOS or any other OS running on this Qualcom chipset.
It's just a happenstance that most open devices run Android.
if iOS was allowed to be run on third party hardware, many of these same exploits would apply.
Apple run Apple's ARM SoCs. Yet this vulnerability doesn't exist. That's because Apple knows how to develop an ARM SoC, and Qualcomm evidently, er, doesn't.
And ALL devices that run Qualcomm's ARM SoCs run Android.
And ALL devices that run Qualcomm's ARM SoCs run Android.
Which routers run Android? I was gonna ask which TVs, but there are actually some that do...
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
The real issue here is that this allows backdooring of the TrustZone OS that passes integrity checks.
Attacker replaces the Widevine trustlet with the old, vulnerable version, then leaves the rest of the phone and TrustZone OS alone. Now there's essentially a zero-footprint backdoor in the TrustZone OS that can be easily exploited later and nothing to show that the phone is vulnerable. Attacker can now repeatedly compromise it, take data and just reboot the phone to cover their tracks. Loads easier than developing a stealth implant that can pass integrity checks... :)
Here:
"To reproduce the procedure, the steps are as follows: /system”).
1. Root the device.
2. Remount the file system that contains the trustlets (e.g., “mount -o rw,remount
3. Replace the current trustlets with the corresponding (vulnerable) ones from an
older-version image.
4. Use the device as normal."
My point is you are blaming by name a part of the stack for a security issue seemingly arbitrarily. So you are either ignorant or a shill.
You could just as well be saying Linux is failing, iOS wins.
And ALL devices that run Qualcomm's ARM SoCs run Android.
Which routers run Android? I was gonna ask which TVs, but there are actually some that do...
Ok, most Routers run Embedded Linux, I assume.
Didn't give that enough thought, obviously! ;-)
I really need to start looking at who I'm replying to before submitting comments. That's twice this week I've replied to you without realizing it! ;)
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
I really need to start looking at who I'm replying to before submitting comments. That's twice this week I've replied to you without realizing it! ;)
LOL!
No worries! I do the same thing almost ALL the time... ;-) ...or does that mean that you would IGNORE my idiocy if you saw it was me? ;-P
I'd just be less confused when I got email notification of your reply, I suppose.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.