Tuesday, July 23, 2024

Vulnerability in Qualcomm Chip Let Hackers Steal Sensitive Data From Android Devices

A vulnerability in Qualcomm’s Secure Execution Environment(QSEE) implementation of the Trusted Execution Environment(TEE) used in a number of devices especially in Android devices lets attackers to steal sensitive data from the isolated secure area of the processor.

Qualcomm implementation used in number of devices such as Pixel, LG, Xiaomi, Sony, HTC, OnePlus, Samsung.

The trusted apps running in TEE is an isolated environment and the security extension backed by an ARM processor is an integral part of every modern mobile device.

What TEE Implementation Consists

The TEE implementation consists of the following trusted operating system, drivers, Normal and Secure world’s libs, trusted apps and other components.

It is the main core area of the processor which guarantees that code and data executed within TEE are protected. Security research in these areas are difficult as it has proprietary code

A vulnerability in TEE may leads to leakage of protected data, device rooting, bootloader unlocking, execution of undetectable APT, and more.

Checkpoint researchers conducted fuzzing-based research in TEE implementations, the fuzzing test is the method to find implementation bugs by providing invalid or random data through automated methods.

“Researchers noted that all data related to a trustlet is concentrated in one place. It is its data segment region.”

Trusted Apps loaded in Normal World

After four months of research, they found a hole to execute the trusted app in the Normal world by detecting the detect the start addresses of the trustlet’s code and data segments in the Secure world and dump them.

The following problems arise when loading the command handler function that calls for cmnlib and syscall during the execution.

  • Detect base addresses of a trustlet and cmnlib in the Secure world.
  • Dump data segments of a trustlet and cmnlib.
  • Execute a trustlet’s syscall in the Normal world.

“All of these problems can be resolved if we can patch a chosen trustlet before loading it into the Secure world. In this case, we can extend its command handler function for one more supported command ID.”

Trustlet emulation scheme

This provides an ability to request the base address and data segment memory block of the trustlet from the Normal world.

Trusted app in the Secure World

The primary target of the attack is the trustlet verification algorithm. “We want to “nop” the QSEOS code responsible for calculating the hash block’s signature or for comparing the actual hashes of the segments with the verified ones.”

The next step is loading the trusted app in the Secure world without breaking the chain of trust.

In the process, they used two exploits CVE-2015-6639 and CVE-2016-2431 that give them “a possible way to patch the QSEOS data segment on a Nexus 6 device with an Android of up to MOB30D build.”

QSEOS patching scheme

By executing the command researchers gained the ability ” to replace a trustlet’s hash block after verification but before using it to validate the segments.”

The research said that the trustlet will successfully pass the verification. An interesting fact is that we can load trustlets from another device as well.”

According to researchers, vulnerability lets an attacker run the trusted app in the normal world, patched trusted app in the secure world, breaking Qualcomm’s Trust chain and more.

The vulnerability affects several Android and IoT devices, Checkpoint reported the vulnerability to Qualcomm in June and it has been patched.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

QualPwn – Vulnerabilities in Qualcomm chips Allows Attackers to Compromise Android Devices Remotely

9 Android Zero-day Vulnerabilities Affects Billions of Android Devices – Hackers Perform DOS, RCE, Make, Deny & Spoof Calls


Latest articles

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....

Hackers Registered 500k+ Domains Using Algorithms For Extensive Cyber Attack

Hackers often register new domains for phishing attacks, spreading malware, and other deceitful activities. Such...

Hackers Claim Breach of Daikin: 40 GB of Confidential Data Exposed

Daikin, the world's largest air conditioner manufacturer, has become the latest target of the...

Emojis Are To Express Emotions, But CyberCriminals For Attacks

There are 3,664 emojis that can be used to express emotions, ideas, or objects...

Beware Of Fake Browser Updates That Installs Malicious BOINC Infrastructre

SocGholish malware, also known as FakeUpdates, has exhibited new behavior since July 4th, 2024,...

Data Breach Increases by Over 1,000% Annually

The Identity Theft Resource Center® (ITRC), a nationally recognized nonprofit organization established to support...

UK Police Arrested 17-year-old Boy Responsible for MGM Resorts Hack

UK police have arrested a 17-year-old boy from Walsall in connection with a notorious...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles