Exploitation of a Modern Smartphone Baseband

In this talk, we will explore the baseband of a modern smartphone, discussing the design and the security countermeasures that are implemented. We will then move on and explain how to find memory corruption bugs and exploit them. As a case study, we will explain in details our 2017 Mobile Pwn2Own entry, where we gained RCE (Remote Code Execution) with a 0-day on the baseband of a smartphone, which was among the target of the competition. We exploited successfully the phone remotely over the air without any user interaction and won $100,000 for this competition target.

Transcript

1. 
   
   
   
   
   

   View Slide

2. 
   #!$##!
   !$
   "# '$#!
   & &"#$( ' ##
   $&
   "
   %!# ' #
   ' ##
   
   " #"
   $""
   

   View Slide

3. 
   )0&)562*!)1')17 )'85-7<%&*250)5/<
   .12:1%6))1!)%0
   %5'25%66-0%5'2+5%66
   • <0%-1*2'8612:-6,<3)59-625&%6)&%1(*-50:%5)87620)7-0)6+2&%'.72
   - 1(52-( 0%' %1(6%1(&2;)6)7'
   • 3:12:1
   %' $!)%02&-/)3:12:1
   - 7)%03:12:1
   "#%5)
   )6'%3)7)%02&-/)3:12:1
   - #--&%6)&%1(7)%0
   !-%1<-$-)
   • !3/%<)5'%37%-12*!!)%0)))%1(
   
   • ,%03-212*!!
   %60)0&)52*7)%0
   236
   • :1:1
   ":%5))6'%3)7)%02&-/):1:1
   &%6)&%1(7)%0
   84-1+-8
   • !3/%<)50)0&)52*!)%0)))%1(
   
   • 2&-/):1:1
   &%6)&%1(7)%0
   

   View Slide

4. 
   
   
   
   
   
   &'0#0#!1.'05#/#.!./
   #2#.)0'*#/-3+,3+3'++#./
   #.# /#"'+&+%&' &'+
   1. ),%'/&00-/ (##+) 0#+!#+0!,*#+
   3'00#.
   (##+)
   #/#.!& .#
   • /#!1.'05 .,3/#. +" ,4 #.+#) '+",3/ '+14
   !
   • , ')# /#!1.'05 , ')# .,3/#. , ')# /+" ,4
   , ')# (#.+#) +".,'" '
   • /# +"+"$'.*3.#
   • '.01)'60',+ .# 5-#.
   • . .#/#.!& #/)
   • -- /#!1.'05
   

   View Slide

5. 
   
   
   
   
   
   !
   
   
   
   
   
   
   !
   
   !
   
   
   
   
   
   !
   !
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   

   View Slide

6. 
   
   2.")+%4-4-
   4%13##%11&3++6%5/+.)2%$
   2(%3!4%)"!1%"!-$1..301(.4#!1%!-$!-!+61)1
   4)++"%.-2(!2"!1%"!-$
   2(%04.0*1.-"!1%"!-$1
   • .,1%#30)17 0%!*)-'!-$!,13-'(!--.-
   !1%"!-$
   • ,!2!,!7 !+*4)2((!--.-!,13-'(!--.-
   !1%"!-$
   • .,1%#30)1 (%0%1)&%)-2(%+$.' %2-2%+
   !1%"!-$
   • 367 0., 2.-&)-)26-2%+!1%"!-$
   • 3)030)02%-12%)-.0&,!-7 (%!1%"!-$!1)#1
   !1%"!-$
   • !+&()+)//%)-,!--7 !1%"!-$22!#*1!-$.2(%0
   4.0*3!+#.,,!1%"!-$
   • (%0%!0%!+1..2(%00%1.30#%1.,)22%$&.01/!#%
   #.-120!)-211.006
   

   View Slide

7. 
   
   %')&*%)+( '&!*&'+*!&$
   /,+!&&&0%')
   -)$'+ )()'**')*!&-'$-!&+
   )!')
   • *&()'**')
   • !!&$,+''+ '
   *& &$*+ )!'
   '%%,&!+!'&.!+ %&0+0(*'
   &+.')#*
   +
   '*)!''%('&&+*&++#
   )%'+$0 ',)
   ++(*''$()'"+1)'$'*('+'%
   '-)
   !)/($'!+!&)''%*.!!
   +%$
   

   View Slide

8. 
   
   
   '*$(.%*'$&&( $'%
   
   ($'*$(
   .%##*$ ), )
   •
   
   •
   • '#%'.
   •
   • /
   &')(.()#(.%*) .%*'*$
   %%$)
   ($$%))
   
   ($("( $ $)'#(%
   # ) ) %$(%#&')%)
   $*, ,$%) )."!%
   $+$()!%%! (#! $)
   '#%)-&"% )) %$( '
   ("!%# ) ) %$( (, (&'
   ),$""#$*)*''(
   %*'))&(,,,+")%# $)'%*) %$(#')&%$
   ' ))*'
   

   View Slide

9. 
   
   
   #""%!%#"
   
   ""$!"#""$###"$!
   #' #!#(&#$#$"!
   #!# ##(!"#"
   ##" !#!
   
   ##%$#$!!"#%
   ""##"(#"(
   $##
   '#(
   

   View Slide

10. 
    
    
    ")*%"&!""% $&
    #$"( !&%&!%&"%"&)$!
    "%
    *")$%$$%&"" '!&)&
    %!%!%&'#%&&"!%
    *$"$
    +
    
    ")($"#!%"'$ # !&&"!%!"!*
    "($"&%!$"%&%)
    %&$)*&%)&'$!!&"#$" "$'%
    

    View Slide

11. 
    
    
    "#
    
    
    !
    
    
    
    
    
    
    
    
    

    View Slide

12. %"# '#%'
    # ) %
    $#$$ ''$
    #
    
    $ $($ %"$' "#*
    ) $ )#$"# "
    #& $#$$'
    ! ##$#*
    $'# !$$ )
    "$!"$ $' "
    " )) % ''$$#)')#
    ) %%#$
    

    View Slide

13. 
    
    '#'&'!!-! $,'&)###
    &"+&$#'%&(#'-$)&'"&(%$#
    -&'"!&($'$"$*'(-&)#!
    "%&(#-'("'+(!$($(' '
    &'%$#'!$&'$"!-&$&$"%$##(
    $"%!,(-')$)#(#-
    #('%($#'$-&
    +$#''('$)#&'$%'#$*&'$#!-
    !-&$&$#(+$&
    

    View Slide

14. 
    
    
    
    !
    !
    $ !
    !" %! &
    "!
    !#$ "
    
    
    !!
    "!!! !!
    #"" " "$
    !!#!
    !! $"
    ! ! $"
    "!
    "
    
    
    
    
    
    

    View Slide

15. 
    
    
    
    
    
    
    
    
    
    

    View Slide

16. 
    
    !!$! !!" !$
    # !!%!&"! #!
    $" ! "$$
    !' (! ! & !
    
    !!! !" !%"!
    #! !" !!! &
    &!&!! " !! $ !!!
    # !
    

    View Slide

17. 
    
    
    
    & % !#'#*"& %"#!$$
    &
    
    "#'!&$% %! +$,#& %$!
    %$
    * !(%$$! (#'#$! $
    !('#(!& !&%%%
    • %$ #$$%(!&%"&%$!
    ##!#$%!%
    ""%! #!$$!#
    #! !%
    ! %$*$%
    • %$"!$$%!#%$ !#*#!%
    
    #!# &" %"*$!#*#!
    )
    $"&$!%%!&$%!)"!%
    

    View Slide

18. 
    
    
    
    
    
    ("'%+&!!%#&"!%$"
    $
    !&"$+&"'!$%&!&%+%& %
    "'!"!
    &'"($%"!"#$&"
    &% %!%"'$"
    %)%($+#'!&$($%!!$!
    #$"%%
    $%%"*%&!#$"&"!&
    "$ &&%&'" "$&"!!(&""
    

    View Slide

19. 
    
    
    
    
    

    View Slide

20. 
    !
    
    
    
    !
    
    
    

    View Slide

21. 
    
    
    )&"$!%+#$+#*)!#&!(-+'#(
    
    %&($('#
    #(!(+'#(
    ,&#'%$&(
    -&''#)#($#&'%$#'!$&
    "'''
    
    '"%!*&'$#$()$)!
    )(+(( '""%-'
    

    View Slide

22. 
    %'!(%
    !
    &
    %" & &"!
    & &
    
    % $
    !& !!&
    ! !%!%%
    !! %%!#
    %
    

    View Slide

23. 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    

    View Slide

24. 
    
    
    
    
    
    

    View Slide

25. 
    
    
    
    !"$&'!&+&$%!"#'"#!%"'$
    %"&)$&&")%+"'&"$'!#$"#$
    *!&)"$)&
    • $$ !+#$"&%&"%&'#'$!&)"$%
    • #!
    • #!
    
    • #!$!&$
    • ,
    • #!)&&%&&"%!$&$$+#+"
    "!"& % %&"%'##"$& *
    " ) ( &" ' !) #!
    • '#)&$!&%"'&"!
    

    View Slide

26. 
    
    (!)!
    $ "%
    "
    
    
    !
    
    
    ! "
    ! #
    "
    
    
    
    ! "
    & ' !
    

    View Slide

27. 
    
    #!" "" %"
    ' """
    !""'$" "
    " $"!"# "
    #"!
    
    "" %#!"
    ""% " !!#!
    
    " """
    %""!
    !"&"!!! "
    

    View Slide

28. 
    
    
    & "'
    " " "'
    
    # ''#"
    "#
    !&&
    &&!
    
    $ "'*'
    &("'
    • "#%
    • )')"#)& * "&'
    %"'#$'#" " " % #%&
    $ ("!"#%
    • &" "%)%
    •
    *&" "("'
    

    View Slide

29. 
    
    
    &("'
    • "#%
    • )')"#)& * "&'
    %"'#$'#" " " % #%&
    $ ("!"#%
    • &" "%)%
    •
    *&" "("'
    & "'
    " " "'
    
    # ''#"
    "#
    !&&
    &&!
    
    $ "'*'
    
    
    

    View Slide

30. 
    
    
    
    ! #" ! #" "
    %! &
    ! ! !
    ! " !
    "! #"
    $ !
    !'
    " " " # ""
    ! !! " !
    #"
    

    View Slide

31. 
    
    •
    ! ## !
    #! " # #
    " $# " !
    ""
    • " & # #"!%
    #!
    • $# # #! $ !! #
    • #" $!#!
    • & #
    • ! # " $# #
    $ !
    

    View Slide

32. 
    
    
    
    05/& 51)2#&' (5/%4+0/#-+49 0(4*'
    5/+4
    • 1)2#&' 0%%523 7*'/ 3'-(%*'%, (#+-3
    • 05/& (+2.7#2' 1#%,#)'
    "!!
    • '%06'2 4*' (02.#4
    • 4+3 $#3'& 0/ 8!02,3(0207'2
    #)+%5.
    8
    -0$ &&2
    $94'3
    -0$ +:'
    94'3
    -0$ #4#
    -0$
    &&2
    94'3
    -0$
    +:'
    94'3
    -0$
    #4#
    
    
    $94'3
    -0%,+:'
    $94'3
    '23+0/
    $94'3
    

    View Slide

33. 
    
    
    
    
    •
    
    •
    •
    
    
    
    
    
    

    View Slide

34. 
    
    
    
    
    " "
    
    !
    
    ! !
    
    

    View Slide

35. 
    

    View Slide

36. 
    
    
    
    
    % # &"$
    ! % !" !#
    &! ""
    #"
    $"#
    # ##
    #""
    

    View Slide

37. 
    
    
    
    
    !!!!"!
    "
    !%#!"!"# &
    " "$# #"
    • ! $ "
    • " !!
    

    View Slide

38. 
    
    
    
    
    
    
    
    
    

    View Slide

39. 
    
    
    
    
    ##%
    
    $"#$ %'& #
    & %!
    • % ! $$%$!!#%
    $
    •
    %$!& %%$ $$
    %#!&"#!"#($% $
    

    View Slide

40. 
    
    
    
    
    ## #"'!
    
    
    
    
    •
    
    %#$&
    •
    
    
    %#$&
    

    View Slide

41. 
    
    
    &%" #)# "$#$#%
    !"$"#$"" $
    $%" &" '!!#"$"
    $##$"& "$"#$!"$ $(! $$
    •
    (! $###$ &" '%#$$#
    • $")
    #$$"%
    

    View Slide

42. 
    
    
    
    
    
    
    
    •
    
    
    
    
    
    
    •
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    

    View Slide

43. 
    
    
    
    
    
    
    • !
    
    
    
    !
    
    !
    
    !
    

    View Slide

44. 
    
    
    
    
    % !! !!
    !"!
    • $"!!$ "
    • "!!!" "%""$#
    #"#"# "!"
    • "!!
    • ""!!"
    
    • "!!#"
    
    • "!! "%""$#
    #"# !"
    

    View Slide

45. 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    

    View Slide

46. 
    
    
    
    ! !
    %
    "!&
    "!&
    !#$
    
    # "!!
    
    

    View Slide

47. 
    
    
    
    !'%%"#! !#
    %%(*
    !
    
    • !#' $&%%
    
    • $%)"! %!& %!
    !%%
    &"*!(!#$!##%##*'$!
    ! ! *
    %#!#% #$%#%$%
    %!*#$$%!$$%
    *%$
    

    View Slide

48. 
    
    
    
    ! $%#&% $&")!$ !%%#'&%
    "!$$
    !#!#%$"$##%!%(%""#
    "%%%!!
    • %)#!
    &$
    • %#%! !%!
    *! +
    

    View Slide

49. 
    
    
    
    
    
    
    $! "!$$
    !!!
    !&%'$$ !
    
    !!
    !#
    # "! " "%!
    !#$! !! !
    ! $#
    
    !!! !
    !!
    

    View Slide

50. 
    

    View Slide

51. 
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    

    View Slide

52. 
    
    
    
    
    
    
    
    -*#(!."-(1-().,+/#,3."
    )(.-.,/&--)1#(.)#.
    "#-#-().0,3*/&3-./#.)*#/..",,
    !))2'*&-) -#'#&,-(,#)-
    • "..*-!))!&*,)$.4,)&)!-*).)'
    )0,
    #,2*&)#.#(!,))'-1# #".'& /-#(!
    /(,-.,#..))0,1,#.''),3
    • "..*-)'-/,#-)'&)!*)-.-*.") &-.,-#-.(
    *.".,0,-&#(/-,'))'*)((.&&)1-(
    ..%,.)')# 3 #&-#(." #&-3-.'
    (..%,("#(-(-*.)
    $/-.%()2-*("#(.)
    ,)1-,
    #()'*&.)(.,)&) .".,!.0#
    "..%-/, #--#!(# #(.-#(&).)
    #( ),'.#)('/-.2"(!.1(."
    -((."
    

    View Slide

53. 
    $
    
    !$#""
    
    $"$
    $$!
    
    
    
    $
    $"
    $ "
    $
    $ $ $
    

    View Slide

54. 
    
    
    
    
    
    
    
    
    

    View Slide

55. 
    

    View Slide