Researchers Defeat Android OEMs' Security Mitigations

It's getting harder and harder to exploit vulnerabilities in Android, thanks to a combination of Google-enabled security mechanisms and additional protections from individual smartphone manufacturers. However, as two researchers discovered, it's still possible to break in.

Over the past few years, Google has buckled down on Android device security with new protections to reduce the number and impact of kernel-level bugs. Some of its mitigations include Stack Guard, SELinux, privileged execute never (PXN), hardened user-copy, privileged access never (PAN) emulation, and kernel address space layout randomization (KASLR).

"As far as we know, mainly mitigations are currently applied on Android kernel," explains Jun Yao, security researcher with the C0re team. "However, these mechanisms are difficult to apply to every phone due to Android fragmentation issues."

To fill the security gaps, smartphone manufacturers integrate additional mitigations into the devices they produce. Attackers need to meet certain conditions to complete an exploit on an Android phone and OEMs' extra mitigations make these conditions difficult to meet, he says.

In the second quarter of 2017, Samsung, Huawei, Oppo, and Vivo accounted for 47.2 percent of the global smartphone market share, the researchers report. Despite their standing as the world's top four Android OEMs, deep research on their security mitigations has been limited to the Samsung Knox. Yao and Lin decided to put more manufacturers' protections to the test.

At this year's Black Hat Asia conference, being held March 20-23 in Singapore, Yao and fellow Core security researcher Tong Lin will share the details of these mitigations and demonstrate how they can be stably bypassed in ways that have not been made public. One of the implementations they broke was the addr_limit checking protection on Vivo devices.

"Usually, to get root privilege on [a] target device, attackers need to be able to overwrite kernel memory," Yao explains. "The most popular way to do it is to modify the process' addr_limit."

Because the kernel checks addr_limit before the system call returns, it cannot be modified directly. The researchers had to find another way to overwrite the kernel without changing addr_limit, and they successfully did so.

"We use gadgets to overwrite the kernel without changing addr_limit," says Yao. "When we control PC in kernel mode, we force it to point to a gadget. When the gadget runs, it will overwrite a victim function pointer. And we can read or write kernel memory by calling this victim function pointer with different arguments."

They report this mitigation can be easily bypassed on a target device depending on the security mechanisms already in place.

[Learn more about breaking Android security in the Black Hat Asia session "Prison Break Season 6: Defeating the Mitigations Adopted by Android OEMs" in which Yao and Lin will demonstrate how they bypassed security protections built into Android phones.]

"It depends on specific devices," says Yao. "If PAN is enabled on a target device, I think it's difficult to bypass it. If it's not, it's easy to defeat it."

PAN emulation works with hardened usercopy, which adds bounds checking to usercopy functions that the kernel uses to transfer data from user space to kernel space memory and back. Missing or invalid bounds checking has often caused kernel vulnerabilities in the past.

Hardened usercopy functions help detect and mitigate security issues in developers' code, but they can only help if developers use them, explains Sami Tolvanen, senior software engineer for Android Security, on the Android developer blog. Features like PAN in ARM 8.1 and Supervisor Mode Access Prevention (SMAP) in x86 prevent the kernel from accessing user space directly, and ensure developers go through usercopy functions.

"I think mitigations fall into two categories," says Yao. "One is to reduce the attack surface, and the other is to make exploits harder. The mitigations we are talking about belong to the latter one." Fewer vulnerabilities lessen the chances of defeating these mitigations, he adds.

The most important thing for OEMs to do is promptly patch kernel flaws, Yao continues. He also advises using a combination of mitigations, as single mitigation is easier to bypass.

Related Content:

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.