Monday, July 22, 2024

Snowblind Abuses Android seccomp Sandbox To Bypass Security Mechanisms

A new Android banking trojan named Snowblind was discovered that exploits the Linux kernel feature seccomp, traditionally used for security, which installs a seccomp filter to intercept system calls and bypasses anti-tampering mechanisms in apps, even those with strong obfuscation and integrity checks. 

The novel attack vector allows the malware to steal login credentials, bypass 2FA, and exfiltrate data, making it highly versatile and dangerous, as it is believed that this technique has the potential to be used in many different ways to compromise apps. 

Android malware traditionally exploits accessibility services to steal user input or control applications, but apps can now detect malicious accessibility services, prompting attackers to use repackaging attacks to bypass detection. 

Working of Snowblind

Snowblind, a new malware, leverages seccomp, a Linux kernel security feature, to create a more sophisticated repackaging attack.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

Unlike FjordPhantom, which uses virtualization, Snowblind injects a native library with a seccomp filter before the app’s anti-tampering code runs, which redirects system calls, making the app unable to detect tampering and allowing malicious accessibility services to operate undetected.  

Seccomp is a Linux kernel functionality that allows user processes to define policies for system calls and acts as a sandboxing mechanism to reduce attack surfaces.

Introduced with two modes, strict mode only allows limited system calls, while seccomp-bpf offers fine-grained control through Berkeley Packet Filters. 

While traditionally fragmented across device manufacturers’ custom kernels, seccomp gained traction in Android 8 (Oreo), where Google implemented seccomp in Zygote to restrict apps’ system calls and added tests to the CTS (Compatibility Test Suite) to ensure broader adoption, which suggests that the seccomp-bpf is likely available on most devices running Android 8 and later, potentially even on earlier versions. 

Seccomp-bpf is a Linux kernel feature that allows processes to restrict the system calls they can make, which can be used to improve security by preventing processes from making unauthorized system calls. 

struct is defined

To use seccomp-bpf, a developer first defines a BPF (Berkeley Packet Filter) program that specifies which system calls are allowed, which can be based on the system call number, the arguments to the system call, or the calling process.

Once the BPF program is defined, it is applied to the process using the prctl() system call. 

Putting everything together

According to Promon, the prctl() system call with the PR_SET_SECCOMP option allows the process to install a seccomp filter, which is a pointer to a BPF program that defines which system calls are allowed. 

When a process tries to make a system call, the kernel first checks the seccomp filter, and if the filter allows the system call, the kernel makes the system call.

The kernel returns an error to the process if the filter does not allow the system call.

example of doing on arm64

Apps have adopted countermeasures like implementing their own system calls and obfuscation.

Snowblind injects a native library that installs a seccomp filter, allowing all system calls except open(). 

When the targeted anti-tampering library tries to open a file, the filter triggers a SIGSYS signal.

A custom signal handler injects the original app’s file path into the open() call before it’s re-executed, effectively bypassing the anti-tampering check.

Stay in the loop with the latest cybersecurity by following us on Linkedin and X for daily updates!


Latest articles

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....

Hackers Registered 500k+ Domains Using Algorithms For Extensive Cyber Attack

Hackers often register new domains for phishing attacks, spreading malware, and other deceitful activities. Such...

Hackers Claim Breach of Daikin: 40 GB of Confidential Data Exposed

Daikin, the world's largest air conditioner manufacturer, has become the latest target of the...

Emojis Are To Express Emotions, But CyberCriminals For Attacks

There are 3,664 emojis that can be used to express emotions, ideas, or objects...

Beware Of Fake Browser Updates That Installs Malicious BOINC Infrastructre

SocGholish malware, also known as FakeUpdates, has exhibited new behavior since July 4th, 2024,...

Data Breach Increases by Over 1,000% Annually

The Identity Theft Resource Center® (ITRC), a nationally recognized nonprofit organization established to support...

UK Police Arrested 17-year-old Boy Responsible for MGM Resorts Hack

UK police have arrested a 17-year-old boy from Walsall in connection with a notorious...

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles