Snowblind Abuses Android seccomp Sandbox To Bypass Security Mechanisms

A new Android banking trojan named Snowblind was discovered that exploits the Linux kernel feature seccomp, traditionally used for security, which installs a seccomp filter to intercept system calls and bypasses anti-tampering mechanisms in apps, even those with strong obfuscation and integrity checks. 

The novel attack vector allows the malware to steal login credentials, bypass 2FA, and exfiltrate data, making it highly versatile and dangerous, as it is believed that this technique has the potential to be used in many different ways to compromise apps. 

Android malware traditionally exploits accessibility services to steal user input or control applications, but apps can now detect malicious accessibility services, prompting attackers to use repackaging attacks to bypass detection. 

Snowblind, a new malware, leverages seccomp, a Linux kernel security feature, to create a more sophisticated repackaging attack.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

Unlike FjordPhantom, which uses virtualization, Snowblind injects a native library with a seccomp filter before the app’s anti-tampering code runs, which redirects system calls, making the app unable to detect tampering and allowing malicious accessibility services to operate undetected.  

Seccomp is a Linux kernel functionality that allows user processes to define policies for system calls and acts as a sandboxing mechanism to reduce attack surfaces.

Introduced with two modes, strict mode only allows limited system calls, while seccomp-bpf offers fine-grained control through Berkeley Packet Filters. 

While traditionally fragmented across device manufacturers’ custom kernels, seccomp gained traction in Android 8 (Oreo), where Google implemented seccomp in Zygote to restrict apps’ system calls and added tests to the CTS (Compatibility Test Suite) to ensure broader adoption, which suggests that the seccomp-bpf is likely available on most devices running Android 8 and later, potentially even on earlier versions. 

Seccomp-bpf is a Linux kernel feature that allows processes to restrict the system calls they can make, which can be used to improve security by preventing processes from making unauthorized system calls. 

To use seccomp-bpf, a developer first defines a BPF (Berkeley Packet Filter) program that specifies which system calls are allowed, which can be based on the system call number, the arguments to the system call, or the calling process.

Once the BPF program is defined, it is applied to the process using the prctl() system call. 

According to Promon, the prctl() system call with the PR_SET_SECCOMP option allows the process to install a seccomp filter, which is a pointer to a BPF program that defines which system calls are allowed. 

When a process tries to make a system call, the kernel first checks the seccomp filter, and if the filter allows the system call, the kernel makes the system call.

The kernel returns an error to the process if the filter does not allow the system call.

Apps have adopted countermeasures like implementing their own system calls and obfuscation.

Snowblind injects a native library that installs a seccomp filter, allowing all system calls except open(). 

When the targeted anti-tampering library tries to open a file, the filter triggers a SIGSYS signal.

A custom signal handler injects the original app’s file path into the open() call before it’s re-executed, effectively bypassing the anti-tampering check.

Stay in the loop with the latest cybersecurity by following us on Linkedin and X for daily updates!