Android patching From a Mobile Device Management perspective Cedric - - PowerPoint PPT Presentation

▶
android patching
SMART_READER_LITE
LIVE PREVIEW

Android patching From a Mobile Device Management perspective Cedric - - PowerPoint PPT Presentation

Sep 09, 2023 263 likes •472 views

Introduction Background information SNE Research Project 2 Kernel patching Evaluation Android patching from the MDM Proof of concept Android patching From a Mobile Device Management perspective Cedric Van Bockhaven cbockhaven@os3.nl

slide-1
SLIDE 1

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Android patching

From a Mobile Device Management perspective Cedric Van Bockhaven

cbockhaven@os3.nl

System and Network Engineering – RP2 University of Amsterdam

July 2nd, 2014

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 1 / 20

slide-2
SLIDE 2

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Outline

Introduction Background information Kernel patching Evaluation Proof of concept

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 2 / 20

slide-3
SLIDE 3

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Introduction

  • 80% of smartphones run Android
  • Yet only 26% of devices in a BYOD setting run Android
  • Different Android versions, ROMs, kernels, hardware

BYOD – Bring your own device Numbers by Joost Kremers [2], TechCrunch http://goo.gl/FJKHC6, and Fjmustak’s Android version history

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 3 / 20

slide-4
SLIDE 4

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Introduction

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 4 / 20

slide-5
SLIDE 5

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Introduction

  • Older Android versions 2.3+ still omnipresent
  • Responsibility of the vendors to push updates
  • Many devices remain unpatched and vulnerable

→ Out-of-band update mechanism needed that doesn’t rely on the vendor.

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 5 / 20

slide-6
SLIDE 6

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Research question

Main research question: Is it possible to patch security vulnerabilities in Android devices through the MDM?

MDM – Mobile Device Management solution

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 6 / 20

slide-7
SLIDE 7

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Related work

PatchDroid: Scalable Third-Party Security Patches for Android Devices.

Collin Mulliner, Jon Oberheide, William Robertson, and Engin Kirda. In Proceedings of the 29th Annual Computer Security Applications Conference, pages 259–268. ACM, 20143.

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 7 / 20

slide-8
SLIDE 8

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Architecture

  • Kernel vulnerabilities
  • E.g. Towelroot1
  • Framework vulnerabilities
  • E.g. Master Key exploit

1Towelroot uses CVE-2014-3153 only, by George Hotz Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 8 / 20

slide-9
SLIDE 9

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Runtime hooking

  • Available for Dalvik VM
  • DDI toolkit (Dynamic Dalvik Instrumentation) [1]
  • Xposed framework
  • No hooks yet for ART

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 9 / 20

slide-10
SLIDE 10

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Patching the kernel

  • Kernel module
  • Hooking with Kprobes
  • Kernel sources are needed
  • Kpatch / Kgraft / Ksplice
  • Easy patch creation with unified diff
  • Kernel sources are needed
  • Dynamic patching: expatting
  • Universal, cross-device solution
  • Using exploit or other kernel memory access technique
  • Slightly unorthodox

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 10 / 20

               Needed for each vuln and device

slide-11
SLIDE 11

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Dynamic patching

How to modify kernel memory and hook/patch vulnerable functions?

1 Find the kernel symbols 2 Get read/write access to kernel 3 Conduct patches

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 11 / 20

slide-12
SLIDE 12

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

1 Finding the kernel symbols

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 12 / 20

  • Read /proc/kallsyms or /proc/ksyms
  • kptr restrict nullifies kernel pointers %pK in user space
  • Scanning the memory for the correct addresses
  • Using /dev/mem, /dev/kmem, or /proc/kcore
  • Using exploit to read kernel memory
  • E.g. locate %pK %c %s and replace with %p

%c %s

slide-13
SLIDE 13

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

2 Get read/write access to kernel

  • Using exploit or /dev/(k)mem
  • mmap: map devices or files into memory
  • Backdoor original mmap system call
  • Allows to r/w arbitrary kernel memory from user space

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 13 / 20

slide-14
SLIDE 14

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

3 Conduct patches

Use the mmap backdoor to:

  • Hook vulnerable kernel functions in-memory
  • Patch Dalvik/ART framework functions as root

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 14 / 20

slide-15
SLIDE 15

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Evaluation

  • Kernel patches become device independent
  • Still need to make the patch work for different architectures...
  • Quasi all Android devices are ARM
  • Tricky: an error can cause kernel panic
  • Needs some fault tolerance
  • Expat lives only in memory, non-permanent
  • Gone after reboot

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 15 / 20

slide-16
SLIDE 16

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Conclusion

  • Patches can be made in a universal way
  • For both the kernel and the runtime
  • Basis for an MDM setup to provide patches

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 16 / 20

slide-17
SLIDE 17

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Proof of concept

DEMO!

  • Expat MDM, consists of agent and server module
  • Exploiting and patching a kernel vulnerability

Many thanks to Deloitte!

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 17 / 20

slide-18
SLIDE 18

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

References

PatchDroid: Scalable Third-Party Security Patches for Android Devices.

Collin Mulliner, Jon Oberheide, William Robertson, and Engin Kirda. In Proceedings of the 29th Annual Computer Security Applications Conference, pages 259–268. ACM, 2013.

Security Evaluation of Mobile Device Management Solutions.

Joost Kremers. Master’s thesis, Radboud Universiteit Nijmegen, 2014.

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 18 / 20

slide-19
SLIDE 19

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Appendix: Boot hooking

Pros Cons init script

+ cross-platform

– dm-verity – init.rc overwritten on boot app process binary

+ always in the same

place – dm-verity – architecture specific broadcast receiver

+ cleanest

– allows race condition

Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 19 / 20

slide-20
SLIDE 20

Introduction Background information Kernel patching Evaluation Proof of concept

SNE Research Project 2

Android patching from the MDM

Appendix: Exploiting

  • E.g. PTMX device2 as stepping stone: ptmx fops->fsync

Open /dev/ptmx and call fsync

  • Transfer kernel execution to payload in user space:
  • Use commit creds to run as fully privileged root user

2Doesn’t reside in read-only kernel memory Cedric Van Bockhaven July 2nd, 2014 UvA · SNE 20 / 20