Exploitation of a Modern Smartphone Baseband

A98925181b2256d38addf9c3f5bf4dea?s=47 Marco Grassi
August 09, 2018

Exploitation of a Modern Smartphone Baseband

In this talk, we will explore the baseband of a modern smartphone, discussing the design and the security countermeasures that are implemented. We will then move on and explain how to find memory corruption bugs and exploit them. As a case study, we will explain in details our 2017 Mobile Pwn2Own entry, where we gained RCE (Remote Code Execution) with a 0-day on the baseband of a smartphone, which was among the target of the competition. We exploited successfully the phone remotely over the air without any user interaction and won $100,000 for this competition target.

A98925181b2256d38addf9c3f5bf4dea?s=128

Marco Grassi

August 09, 2018
Tweet

Transcript

  1.          

    
  2.  #!$##! !$ "# '$#!  & &"#$( ' ##

    $& " %!# ' # ' ##  " #" $""
  3.  )0&)562*!)1')17 )'85-7<%&*250)5/< .12:1%6))1!)%0 %5'25%66-0%5'2+5%66 • <0%-1*2'8612:-6,<3)59-625&%6)&%1(*-50:%5)87620)7-0)6+2&%'.72 - 1(52-( 0%'

    %1(6%1(&2;)6)7' • 3:1 2:1 %' $!)%02&-/)3:1 2:1 - 7)%03:1 2:1 "#%5) )6'%3)7)%02&-/)3:1 2:1 - #--&%6)&%1(7)%0 !-%1<-$-) • !3/%<)5'%37%-12*!!)%0)))%1(  • ,%03-212*!! %60)0&)52*7)%0 236 • :1 :1 ":%5))6'%3)7)%02&-/):1 :1 &%6)&%1(7)%0 84-1+-8 • !3/%<)50)0&)52*!)%0)))%1(  • 2&-/):1 :1 &%6)&%1(7)%0
  4.       &'0#0#!1.'05#/#.!&#./ #2#.)0'*#/-3+,3+3'++#./ #.# /#"'+&+%&'

    &'+ 1. ),%'/&00-/ (##+) 0#+!#+0!,*#+ 3'00#. (##+) #/#.!& .# •  /#!1.'05 .,3/#. +" ,4 #.+#) '+",3/ '+14 ! • , ')# /#!1.'05 , ')# .,3/#. , ')# /+" ,4 , ')# (#.+#)  +".,'" ' • /# +"+"$'.*3.# • '.01)'60',+ .# 5-#.   • . .#/#.!& #/)  • -- /#!1.'05
  5.          

     !             !   !         !  !                                     
  6.    2.")+%4- 4- 4%13##%11&3++6%5/+.)2%$ 2(%3!4%)"!1%"!-$1..301(.4#!1%!-$!-!+61)1 4)++"%.-2(!2"!1%"!-$ 2(%04.0*1.-"!1%"!-$1 •

    .,1%#30)17 0%!*)-'!-$!,13-'(!--.- !1%"!-$ • ,!2!,!7 !+*4)2((!--.-!,13-'(!--.- !1%"!-$ • .,1%#30)1 (%0%1)&%)-2(%+$.' %2-2%+ !1%"!-$ • 367 0., 2.-&)-)26-2%+!1%"!-$ • 3)030)02%-12%)-.0&,!-7 (%!1%"!-$!1)#1 !1%"!-$ • !+&()+)//%)-,!--7 !1%"!-$22!#*1!-$.2(%0 4.0*3!+#.,,!1%"!-$ • (%0%!0%!+1..2(%00%1.30#%1.,)22%$&.01/!#% #.-120!)-211.006
  7.       %')&*%)+( '&!*&'+*!&$ /,+!&&&0%') -)$'+

    )()'**')*!&-'$-!&+  )!') • *&()'**') • !!&$,+''+ '  *& &$*+ )!' '%%,&!+!'&.!+ %&0+0(*' &+.')#*   +  '*)!''%('&&+*&++# )%'+$0 ',)  ++(* ''$()'"+1)'$'*('+'%  '-) !)/($'!+!&)''%*.!!  +%$
  8.          

    '*$(.%*'$&&( $'%   ($'*$( .%##*$ ), ) •  •   • '#%'. •   • / &')(.()#(.%*) .%*'*$ %%$) ($$%))   ($("( $ $)'#(% # ) ) %$(%#&')%)  $*, ,$%) )."!%  $+$()!%%! (#! $) '#%)-&"% )) %$( '  ("!%# ) ) %$( (, (&' ),$""#$*)*''( %*'))&(,,,+")%# $)'%*) %$(#')&%$ ' ))*'
  9.          #""%!%#"

     ""$!"#""$###"$!  #' #!#(&#$#$"! #!# ##(!"#"  ##" !#!   ##%$#$!!"#% ""##"(#"( $##   '#(
  10.      ")*%"&!""% $&  #$"( !&%&!%&"%"&)$!

    "% *")$%$$%&"" '!&)& %!%!%&'#%&&"!% *$"$    + ")($"#!%"'$ # !&&"!%!"!* "($ "&%!$"%&%) %&$)*&%)&'$!!&"#$" "$'%
  11.        "  #

              !                       
  12.  %"# '#%' # ) % $#$$  ''$ #

    $ $($ %"$' "#* )   $  )#$"# " #& $#$$'  ! ##$#* $'# !$$  )   "$!"$ $' " " )) % ''$$#)')# ) %%#$
  13.    '#'&'!!-! $,'&)### &"+&$#'%&( #'-$)&'"&(%$# -&'"!&($'$"$*'(-&)#! "%&(#-'("'+(!$($(' '

     &'%$#'!$&'$"!-&$&$"%$##( $"%!,(-')$)#(#-  #('%($#'$-&   +$#''('$)#&'$%'#$*&'$#!- !-&$&$#(+$& 
  14.       !   !

    $ ! !" %!  & "!     !#$ "   !! "!!! !!  #"" " "$  !!#!    !!  $" ! ! $" "! "              
  15.          

                   
  16.      !!$! !!" !$ # !!%!&"!

    #! $" ! "$$ !' (! ! & !   !!!  !  " !%"! #! !" !!! &  &!&!! " !! $ !!! # !
  17.       & % !#'#*"& %

    "#!$$  &  "#'!&$% %! +$,#& %$!  %$  * !(%$$!  (#'#$! $ !('#(!& !&%%% •  %$ #$$%(!&%"&%$! ##!#$%!% ""%! #!$$!# #! !% ! %$*$% • %$"!$$%!#%$ !#*#!% #!# &" %"*$!#*#! ) $"&$!%%!&$%!&#)"!%
  18.        ("'%+&!!%#&"!%$"  $

    !&"$+&"'!$%&!&%+%& % "'!"! & '"($%"!"#$&" &% %!%"'$" %)%($+#'!&$($%!!$! #$"%% $%%"*%&!#$"&"!&   "$ &&&#%&'" "$&"!!(&""
  19.        

  20.  !        

        !   
  21.       )&"$!%+#$+#*)!#&!(-+'#(  %&($('# #(!(+'#(

     ,&#'%$&( -&''#)#($#&'%$#'!$& "''' '"%!*&'$#$()$)! )(+(( '""%-'
  22.  %'!(%     !   &

    %"  &  &"! & &    % $    !& !!&  ! !%!%% !!  %%!#     %
  23.          

                                  
  24.        

  25.      !"$&'!&+&$%!"#'"#!%"'$ %"&)$&&")%+"'&"$'!#$"#$  *!&)"$)& 

    • $$ !+#$"&%&"%&'#'$!&)"$% • #! • #!  • #!$ !&$ • , • #!)&&%&&"%!$&$$+#+" "!"& % %&"%'##"$& * " ) ( &" '  !) #!  •  '#)&$!&%"'&"!
  26.     (!)!    $ 

    "%  "     !      !   " ! # "           ! " &  ' !
  27.     #!" "" %"  ' 

    """  !""'$" " "  $"!"# "  #"! " " %#!" ""%  " !!#!   " """ %""! !"&"!!! " 
  28.      & "' " " "'

     #  ''#" "# !&& &&!     $ "'*' &("' • "#% •  )')"#)& * "&'  %"'#$'#" " " % #%& $ ("!"#% •  &" "%)% •    *&" "("'
  29.      &("' • "#% • 

    )')"#)& * "&'  %"'#$'#" " " % #%& $ ("!"#% •  &" "%)% •    *&" "("' & "' " " "'  #  ''#" "# !&& &&!     $ "'*'  
  30.         ! #"

    ! #"  "     %! & ! !  !         !     " ! "!  #"  $ ! !' " " "  #  "" ! !! " ! #"
  31.       •   

     ! ## ! #!   " # #  " $# " ! "" •   " & # #"!% #! • $# # #! $ !! # • #"  $!#! •  & #  • ! # " $# # $ !
  32.          05/&

    51)2#&' (5/%4+0/#-+49 0(4*'  5/+4 • 1)2#&' 0%%523 7*'/ 3'-(%*'%, (#+-3 • 05/& (+2.7#2' 1#%,#)' "!! • '%06'2 4*' (02.#4 • 4+3 $#3'& 0/ 8!02,3(0207'2 #)+%5. 8   -0$ &&2  $94'3 -0$ +:'  94'3 -0$ #4# -0$ &&2  94'3 -0$ +:'  94'3 -0$ #4#   $94'3 -0%,+:'  $94'3 '23+0/   $94'3
  33.          

      •     •      •          
  34.          

                   " "     !          !  !      
  35.  

  36.         % #

    &"$ ! % !" !# &! "" #"    $"# # ## #""
  37.         !!!!"! 

    "  !%#!"!"#  & " "$# #" • ! $ "     • " !!   
  38.          

           
  39.         ##% 

        $"#$ %'& # & %! •  %&# ! $$%$! !#%    $ • %$!& %%$  $$ %#!&"#!"#($%   $
  40.         ## #"'!

         •      %#$& •     %#$&
  41.       &%" #)# "$#$#% !"$"#$""

    $ $%" &" '!!#"$" $##$"& "$"#$!"$ $(! $$  • (! $###$ &" '%#$$# •   $") #$$"%
  42.          

       •          •                     
  43.          

           • !          !        !    ! 
  44.          %

    !! !! !"! • $"!!$ " • "!!!" "%""$#  #"#"# "!" • "!! •  ""!!"  • "!!#"   • "!! "%""$#  #"# !"
  45.          

                         
  46.      !   ! %

    "!&  "!&  !#$    # "!!  
  47.      !'%%"#! !# %%(* &#! •

       !#'  $&%%      •  $%)"! %!& %!   !%%    &"*!(!#$!##%##*'$! !  ! * &#%#!#%  #$%#%$%  %!*#$$%!$$%   *%$
  48.      ! $%#&% $&")!$ !%%#'&% "!$$

    !#!#%$"$##%!%(%""# "%%%!!    • %)#!     &$ • %#%! !%! *! +
  49.          $

    ! "!$$  !!! !&%'$$ !    !!  !# # "! " "%! !#$! !! !  ! $#    !!! ! !!
  50. 

  51.          

                                         
  52.          

      -*#(!."-(1-().,+/#,3." )(.-.,/&--)1#(.)#. "#-#-().0,3*/&#&3-./#.)*#/..",, !))2'*&-) -#'#&,-(,#)- • "..*-!))!&*,)$.4,)&)!-*).)'  )0, #,2*&)#.#(!,))'-1# # ".'& /-#(! /(,-.,#..))0,1,#.''),3 • "..*-)'-/,#-)'&)!*)-.-*.") &-.,-#-.(  *.".,0,-&#(/-,'))'*)((.&&)1-( ..%,.)')# 3 #&-#(." #&-3-.' (..%,("#(-(-*.) $/-.&#%()2-*("#(.) ,)1-, #()'*&.)(.,)&) .".,!.0# "..%-/, #--#!(# #(.-#(&).)  #( ),'.#)('/-.2"(!.1(." -((."
  53.    $   !$#""   

    $"$   $$!         $  $" $ "  $ $ $ $
  54.          

       
  55.