$30 off During Our Annual Pro Sale. View Details »

Exploitation of a Modern Smartphone Baseband

Marco Grassi
August 09, 2018

Exploitation of a Modern Smartphone Baseband

In this talk, we will explore the baseband of a modern smartphone, discussing the design and the security countermeasures that are implemented. We will then move on and explain how to find memory corruption bugs and exploit them. As a case study, we will explain in details our 2017 Mobile Pwn2Own entry, where we gained RCE (Remote Code Execution) with a 0-day on the baseband of a smartphone, which was among the target of the competition. We exploited successfully the phone remotely over the air without any user interaction and won $100,000 for this competition target.

Marco Grassi

August 09, 2018
Tweet

More Decks by Marco Grassi

Other Decks in Research

Transcript






  1. View Slide


  2. #!$##!
    !$
    "# '$#!
    & &"#$( ' ##
    $&
    "
    %!# ' #
    ' ##

    " #"
    $""

    View Slide


  3. )0&)562*!)1')17 )'85-7<%&*250)5/<
    .12:1%6))1!)%0
    %5'25%66-0%5'2+5%66
    • <0%-1*2'8612:-6,<3)59-625&%6)&%1(*-50:%5)87620)7-0)6+2&%'.72
    - 1(52-( 0%' %1(6%1(&2;)6)7'
    • 3:12:1
    %' $!)%02&-/)3:12:1
    - 7)%03:12:1
    "#%5)
    )6'%3)7)%02&-/)3:12:1
    - #--&%6)&%1(7)%0
    !-%1<-$-)
    • !3/%<)5'%37%-12*!!)%0)))%1(

    • ,%03-212*!!
    %60)0&)52*7)%0
    236
    • :1:1
    ":%5))6'%3)7)%02&-/):1:1
    &%6)&%1(7)%0
    84-1+-8
    • !3/%<)50)0&)52*!)%0)))%1(

    • 2&-/):1:1
    &%6)&%1(7)%0

    View Slide







  4. &'0#0#!1.'05#/#.!./
    #2#.)0'*#/-3+,3+3'++#./
    #.# /#"'+&+%&' &'+
    1. ),%'/&00-/ (##+) 0#+!#+0!,*#+
    3'00#.
    (##+)
    #/#.!& .#
    • /#!1.'05 .,3/#. +" ,4 #.+#) '+",3/ '+14
    !
    • , ')# /#!1.'05 , ')# .,3/#. , ')# /+" ,4
    , ')# (#.+#) +".,'" '
    • /# +"+"$'.*3.#
    • '.01)'60',+ .# 5-#.
    • . .#/#.!& #/)
    • -- /#!1.'05

    View Slide







  5. !






    !

    !





    !
    !
























    View Slide



  6. 2.")+%4-4-
    4%13##%11&3++6%5/+.)2%$
    2(%3!4%)"!1%"!-$1..301(.4#!1%!-$!-!+61)1
    4)++"%.-2(!2"!1%"!-$
    2(%04.0*1.-"!1%"!-$1
    • .,1%#30)17 0%!*)-'!-$!,13-'(!--.-
    !1%"!-$
    • ,!2!,!7 !+*4)2((!--.-!,13-'(!--.-
    !1%"!-$
    • .,1%#30)1 (%0%1)&%)-2(%+$.' %2-2%+
    !1%"!-$
    • 367 0., 2.-&)-)26-2%+!1%"!-$
    • 3)030)02%-12%)-.0&,!-7 (%!1%"!-$!1)#1
    !1%"!-$
    • !+&()+)//%)-,!--7 !1%"!-$22!#*1!-$.2(%0
    4.0*3!+#.,,!1%"!-$
    • (%0%!0%!+1..2(%00%1.30#%1.,)22%$&.01/!#%
    #.-120!)-211.006

    View Slide



  7. %')&*%)+( '&!*&'+*!&$
    /,+!&&&0%')
    -)$'+ )()'**')*!&-'$-!&+
    )!')
    • *&()'**')
    • !!&$,+''+ '
    *& &$*+ )!'
    '%%,&!+!'&.!+ %&0+0(*'
    &+.')#*
    +
    '*)!''%('&&+*&++#
    )%'+$0 ',)
    ++(*''$()'"+1)'$'*('+'%
    '-)
    !)/($'!+!&)''%*.!!
    +%$

    View Slide




  8. '*$(.%*'$&&( $'%

    ($'*$(
    .%##*$ ), )



    • '#%'.

    • /
    &')(.()#(.%*) .%*'*$
    %%$)
    ($$%))

    ($("( $ $)'#(%
    # ) ) %$(%#&')%)
    $*, ,$%) )."!%
    $+$()!%%! (#! $)
    '#%)-&"% )) %$( '
    ("!%# ) ) %$( (, (&'
    ),$""#$*)*''(
    %*'))&(,,,+")%# $)'%*) %$(#')&%$
    ' ))*'

    View Slide




  9. #""%!%#"

    ""$!"#""$###"$!
    #' #!#(&#$#$"!
    #!# ##(!"#"
    ##" !#!

    ##%$#$!!"#%
    ""##"(#"(
    $##
    '#(

    View Slide




  10. ")*%"&!""% $&
    #$"( !&%&!%&"%"&)$!
    "%
    *")$%$$%&"" '!&)&
    %!%!%&'#%&&"!%
    *$"$
    +

    ")($"#!%"'$ # !&&"!%!"!*
    "($"&%!$"%&%)
    %&$)*&%)&'$!!&"#$" "$'%

    View Slide




  11. "#


    !








    View Slide

  12. %"# '#%'
    # ) %
    $#$$ ''$
    #

    $ $($ %"$' "#*
    ) $ )#$"# "
    #& $#$$'
    ! ##$#*
    $'# !$$ )
    "$!"$ $' "
    " )) % ''$$#)')#
    ) %%#$

    View Slide



  13. '#'&'!!-! $,'&)###
    &"+&$#'%&(#'-$)&'"&(%$#
    -&'"!&($'$"$*'(-&)#!
    "%&(#-'("'+(!$($(' '
    &'%$#'!$&'$"!-&$&$"%$##(
    $"%!,(-')$)#(#-
    #('%($#'$-&
    +$#''('$)#&'$%'#$*&'$#!-
    !-&$&$#(+$&

    View Slide





  14. !
    !
    $ !
    !" %! &
    "!
    !#$ "


    !!
    "!!! !!
    #"" " "$
    !!#!
    !! $"
    ! ! $"
    "!
    "





    View Slide











  15. View Slide



  16. !!$! !!" !$
    # !!%!&"! #!
    $" ! "$$
    !' (! ! & !

    !!! !" !%"!
    #! !" !!! &
    &!&!! " !! $ !!!
    # !

    View Slide





  17. & % !#'#*"& %"#!$$
    &

    "#'!&$% %! +$,#& %$!
    %$
    * !(%$$! (#'#$! $
    !('#(!& !&%%%
    • %$ #$$%(!&%"&%$!
    ##!#$%!%
    ""%! #!$$!#
    #! !%
    ! %$*$%
    • %$"!$$%!#%$ !#*#!%

    #!# &" %"*$!#*#!
    )
    $"&$!%%!&$%!)"!%

    View Slide







  18. ("'%+&!!%#&"!%$"
    $
    !&"$+&"'!$%&!&%+%& %
    "'!"!
    &'"($%"!"#$&"
    &% %!%"'$"
    %)%($+#'!&$($%!!$!
    #$"%%
    $%%"*%&!#$"&"!&
    "$ &&%&'" "$&"!!(&""

    View Slide






  19. View Slide


  20. !



    !


    View Slide




  21. )&"$!%+#$+#*)!#&!(-+'#(

    %&($('#
    #(!(+'#(
    ,&#'%$&(
    -&''#)#($#&'%$#'!$&
    "'''

    '"%!*&'$#$()$)!
    )(+(( '""%-'

    View Slide


  22. %'!(%
    !
    &
    %" & &"!
    & &

    % $
    !& !!&
    ! !%!%%
    !! %%!#
    %

    View Slide



























  23. View Slide







  24. View Slide





  25. !"$&'!&+&$%!"#'"#!%"'$
    %"&)$&&")%+"'&"$'!#$"#$
    *!&)"$)&
    • $$ !+#$"&%&"%&'#'$!&)"$%
    • #!
    • #!

    • #!$!&$
    • ,
    • #!)&&%&&"%!$&$$+#+"
    "!"& % %&"%'##"$& *
    " ) ( &" ' !) #!
    • '#)&$!&%"'&"!

    View Slide



  26. (!)!
    $ "%
    "


    !


    ! "
    ! #
    "



    ! "
    & ' !

    View Slide



  27. #!" "" %"
    ' """
    !""'$" "
    " $"!"# "
    #"!

    "" %#!"
    ""% " !!#!

    " """
    %""!
    !"&"!!! "

    View Slide




  28. & "'
    " " "'

    # ''#"
    "#
    !&&
    &&!

    $ "'*'
    &("'
    • "#%
    • )')"#)& * "&'
    %"'#$'#" " " % #%&
    $ ("!"#%
    • &" "%)%

    *&" "("'

    View Slide




  29. &("'
    • "#%
    • )')"#)& * "&'
    %"'#$'#" " " % #%&
    $ ("!"#%
    • &" "%)%

    *&" "("'
    & "'
    " " "'

    # ''#"
    "#
    !&&
    &&!

    $ "'*'


    View Slide





  30. ! #" ! #" "
    %! &
    ! ! !
    ! " !
    "! #"
    $ !
    !'
    " " " # ""
    ! !! " !
    #"

    View Slide




  31. ! ## !
    #! " # #
    " $# " !
    ""
    • " & # #"!%
    #!
    • $# # #! $ !! #
    • #" $!#!
    • & #
    • ! # " $# #
    $ !

    View Slide





  32. 05/& 51)2#&' (5/%4+0/#-+49 0(4*'
    5/+4
    • 1)2#&' 0%%523 7*'/ 3'-(%*'%, (#+-3
    • 05/& (+2.7#2' 1#%,#)'
    "!!
    • '%06'2 4*' (02.#4
    • 4+3 $#3'& 0/ 8!02,3(0207'2
    #)+%5.
    8
    -0$ &&2
    $94'3
    -0$ +:'
    94'3
    -0$ #4#
    -0$
    &&2
    94'3
    -0$
    +:'
    94'3
    -0$
    #4#


    $94'3
    -0%,+:'
    $94'3
    '23+0/
    $94'3

    View Slide















  33. View Slide






  34. " "

    !

    ! !

    View Slide


  35. View Slide






  36. % # &"$
    ! % !" !#
    &! ""
    #"
    $"#
    # ##
    #""

    View Slide






  37. !!!!"!
    "
    !%#!"!"# &
    " "$# #"
    • ! $ "
    • " !!

    View Slide










  38. View Slide






  39. ##%

    $"#$ %'& #
    & %!
    • % ! $$%$!!#%
    $

    %$!& %%$ $$
    %#!&"#!"#($% $

    View Slide






  40. ## #"'!






    %#$&



    %#$&

    View Slide




  41. &%" #)# "$#$#%
    !"$"#$"" $
    $%" &" '!!#"$"
    $##$"& "$"#$!"$ $(! $$

    (! $###$ &" '%#$$#
    • $")
    #$$"%

    View Slide

































  42. View Slide








  43. • !



    !

    !

    !

    View Slide






  44. % !! !!
    !"!
    • $"!!$ "
    • "!!!" "%""$#
    #"#"# "!"
    • "!!
    • ""!!"

    • "!!#"

    • "!! "%""$#
    #"# !"

    View Slide






















  45. View Slide





  46. ! !
    %
    "!&
    "!&
    !#$

    # "!!

    View Slide





  47. !'%%"#! !#
    %%(*
    !

    • !#' $&%%

    • $%)"! %!& %!
    !%%
    &"*!(!#$!##%##*'$!
    ! ! *
    %#!#% #$%#%$%
    %!*#$$%!$$%
    *%$

    View Slide





  48. ! $%#&% $&")!$ !%%#'&%
    "!$$
    !#!#%$"$##%!%(%""#
    "%%%!!
    • %)#!
    &$
    • %#%! !%!
    *! +

    View Slide








  49. $! "!$$
    !!!
    !&%'$$ !

    !!
    !#
    # "! " "%!
    !#$! !! !
    ! $#

    !!! !
    !!

    View Slide


  50. View Slide





















  51. View Slide









  52. -*#(!."-(1-().,+/#,3."
    )(.-.,/&--)1#(.)#.
    "#-#-().0,3*/&3-./#.)*#/..",,
    !))2'*&-) -#'#&,-(,#)-
    • "..*-!))!&*,)$.4,)&)!-*).)'
    )0,
    #,2*&)#.#(!,))'-1# #".'& /-#(!
    /(,-.,#..))0,1,#.''),3
    • "..*-)'-/,#-)'&)!*)-.-*.") &-.,-#-.(
    *.".,0,-&#(/-,'))'*)((.&&)1-(
    ..%,.)')# 3 #&-#(." #&-3-.'
    (..%,("#(-(-*.)
    $/-.%()2-*("#(.)
    ,)1-,
    #()'*&.)(.,)&) .".,!.0#
    "..%-/, #--#!(# #(.-#(&).)
    #( ),'.#)('/-.2"(!.1(."
    -((."

    View Slide


  53. $

    !$#""

    $"$
    $$!



    $
    $"
    $ "
    $
    $ $ $

    View Slide










  54. View Slide


  55. View Slide