No Apology Required Deconstructing BB10 CanSecWest 2014 - PowerPoint PPT Presentation

No Apology Required Deconstructing BB10 CanSecWest 2014

Introduction • Presentation is exploratory • Research is on-going • Body Level One • Focused mostly on methodology, less on • Body Level Two findings • Body Level Three • Feel free to chat after • Body Level Four (since we may run out of time) • Body Level • Title is because stereotypical Canadians apologize for everything

Introduction • Presentation is exploratory • Research is on-going • Body Level One • Focused mostly on methodology, less on • Body Level Two findings • Body Level Three • Feel free to chat after • Body Level Four (since we may run out of time) • Body Level • Title is because stereotypical Canadians apologize for everything

Introduction Presentation foul: 
 <--- mixing memes ---> Zach Lanier 
 Ben Nell 
 quine 
 bNull 
 Sr. Security Researcher 
 Sr. Security Consultant 
 Duo Security Accuvant Labs

Why this matters

Why this matters

Why this matters You’re an appsec consultant and your customer asks you if BlackBerry Balance solves BYOD

Agenda • Previous Research • Platform Overview • Methodology • Attack Surface • Future Work

Previous Research

Our PlayBook stuff Targeted predecessor of BB10 • — TabletOS on BB PlayBook Discovered AuthZ token • disclosure for Bridge/Balance (steal all the corporate data) RE’d firmware • Mirrored all of AppWorld (steal • all the premium apps) And more... •

Our PlayBook stuff (cont’d) Discovered that native apps • can exec*() / spawn*() and open AF_INET sockets unfettered (no perm’s req’d) Still true in BB10, but (even • detached) child procs killed when app/parent ends “Headless Apps” allow for • background services, but special perms required Granting of perms is • contingent upon approval from RIM/BB signing service

Others • Julio Cesar Fort’s QNX research • SEC Consult BB10 paper • RPW’s BB10 preso (BH USA ’13) • Tim Brown’s various QNX/TabletOS/BB10 works

Platform Overview

Overview ARM-based SoCs (Z10, Q10, and Z30 • all Snapdragon S4 SoC) BB10 (based on QNX Neutrino RTOS • 8.0.0) Major components (as of 10.2.1.1925): • WebKit (537.10 / 10.2.1.66) • Adobe Flash (11.1.121.199) • Adobe AIR (3.1.0.230) • BlackBerry Balance (isolated, • corporate PIM)

QNX • Microkernel, only truly trusted component • Userspace kernel and process manager - procnto • Separation of network, 
 I/O, HMI, etc. into separate components • Messaging layer provides IPC (QNX message passing + POSIX IPC abstraction) • Prev. public bugs disclosed by Ilja van Sprundel, Tim Brown, Julio Cesar Fort, cenobite, and others

Security Controls / Mitigations • OpenBSD NetBSD pf • POSIX (filesystem) ACLs • Compiler & linker protections for native apps • Usual suspects: XN, ASLR, ProPolice, PIE + full RELRO

QDE/Momentics default build options

Security Features • Blackberry Balance • Encrypted, FACL’d “container” • a.k.a. “perimeter” • BES policy enforcements • DISA STIGs guide these

authman & permissions • authman service - maps app permissions to system resources • Filesystem permissions + POSIX ACLs, PF rules • Shell script and Python glue to bind it all together

authman & permissions • /dev/authman: resource manager “dispatch” path (QNX IPC endpoint) • /etc/authman: configs • Pair of files (".res" & ".acl"), named for profile type

authman & permissions • Controls access to app permissions (allow, prompt, deny) • Sets FACLs on filesystem objects based on app permission requested • Also sets process capabilities for certain permission types (e.g. “Headless apps”)

authman & pf • authman handles setting up (app) GID:rule mapping • Ex: limiting access to SapphireProxy (for BB Bridge) on 127.0.0.2

output from sloginfo (tool to print system log) Dec 06 01:53:04 5 41 0 authman: RX euid=89/egid=0, 'defapp ext __def personal dual 100001000 100001000 sys.browser.gYABgJYFHAzbeFMPCCpYWBtHAm0 "Browser" "Research In Motion Limited" "gYAAgNpMbwE-h W4khx0h8BidUeI" run_when_backgrounded manage_certificates access_location_services use_camera record_audio access_shared access_internet post_notification gain_oma_fl_group access_oma_fl_write_personal acce ss_oma_fl_write_enterprise access_bbjma_data access_carrier_browser access_cclagent_service use_certmgr_server access_wifi_limited run_native permanent access_perimeter_personal' Dec 06 01:53:04 5 41 0 authman: Requested caps: Dec 06 01:53:04 5 41 0 authman: req:Allow execute Dec 06 01:53:04 5 41 0 authman: Applying execute pf rule(s) Dec 06 01:53:04 5 41 0 authman: pf_remove_gid: scanning anchors for gid=100001000 Dec 06 01:53:04 5 41 0 authman: Requested caps: Dec 06 01:53:04 5 41 0 authman: req:Allow run_when_backgrounded Dec 06 01:53:04 5 41 0 authman: req:Allow manage_certificates Dec 06 01:53:04 5 41 0 authman: req:Allow access_location_services Dec 06 01:53:04 5 41 0 authman: req:Allow use_camera Dec 06 01:53:04 5 41 0 authman: req:Allow record_audio Dec 06 01:53:04 5 41 0 authman: req:Allow access_shared “Capabilities” based Dec 06 01:53:04 5 41 0 authman: req:Allow access_internet Dec 06 01:53:04 5 41 0 authman: req:Allow gain_oma_fl_group on permissions Dec 06 01:53:04 5 41 0 authman: req:Allow access_oma_fl_write_personal Dec 06 01:53:04 5 41 0 authman: req:Allow access_oma_fl_write_enterprise Dec 06 01:53:04 5 41 0 authman: req:Allow access_bbjma_data Dec 06 01:53:04 5 41 0 authman: req:Allow access_carrier_browser Dec 06 01:53:04 5 41 0 authman: req:Allow access_cclagent_service Dec 06 01:53:04 5 41 0 authman: req:Allow use_certmgr_server Dec 06 01:53:04 5 41 0 authman: req:Allow access_wifi_limited ACLs based on Dec 06 01:53:04 5 41 0 authman: req:Allow run_native Dec 06 01:53:04 5 41 0 authman: req:Allow permanent Dec 06 01:53:04 5 41 0 authman: req:Allow access_perimeter_personal permissions Dec 06 01:53:04 5 41 0 authman: Applying run_when_backgrounded Dec 06 01:53:04 5 41 0 authman: Applying manage_certificates Dec 06 01:53:04 5 41 0 authman: set_acl_group_perms: gid=100001000, perms=060, /pps/services/certmgr/control Dec 06 01:53:04 5 41 0 authman: Applying access_location_services Dec 06 01:53:04 5 41 0 authman: set_acl_group_perms: gid=100001000, perms=040, /pps/services/cellular/radioctrl/status_cell_cdma_private Dec 06 01:53:04 5 41 0 authman: set_acl_group_perms: gid=100001000, perms=040, /pps/services/cellular/radioctrl/status_cell_private Dec 06 01:53:04 5 41 0 authman: set_acl_group_perms: gid=100001000, perms=040, /pps/services/cellular/radioctrl/status_private Dec 06 01:53:04 5 41 0 authman: set_acl_group_perms: gid=100001000, perms=040, /pps/services/radioctrl/modem0/status_private Dec 06 01:53:04 5 41 0 authman: set_acl_group_perms: gid=100001000, perms=060, /pps/services/geolocation/geomonitor/control Dec 06 01:53:04 5 41 0 authman: set_acl_group_perms: gid=100001000, perms=050, /pps/services/geolocation/geomonitor Dec 06 01:53:04 5 41 0 authman: set_acl_group_perms: gid=100001000, perms=060, /pps/services/geolocation/control

PPS • “Persistent Publish / Subscribe” • Implemented by pps manager process • Simple interface for sharing data, notifications/eventing via filesystem objects

IPC IPC is key in QNX • “Message passing” & signals implemented • in microkernel Other IPC (POSIX-compatible) mechanisms • implemented by manager processes Typed memory Shared memory Pipes FIFOs Kernel Events Message copying Simple messages Channels (pulses, signals, Kernel Signals unblocks) Message passing External process/manager

Application Model Native • C/C++ WebWorks / Cordova • HTML/JS Adobe AIR Flash/AS/ • HTML/JS Android • Java/DEX 20 app perms documented 340 unique app & sys perms observed

Application Model App processes run with same UIDs, but separate • GIDs (incl. supplemental GIDs) � � Apps have separate data stores/”sandboxes” • With Balance/corporate separation, additional data • stores Production apps are signed by BB/RIM signing server •

Our Approach to the Platform ( ) meth · od · ol · o · gy / ˌ meTH əӚˈ däl əӚ j ē /

Testing Limitations

Testing Limitations • General lack of enthusiasm for BB10 as a target • General lack of public information about the system • Effective security controls • We’re left looking at a black box

OSINT Just ask the internet!

OSINT Existing previous work • Our PlayBook work • SEC Consult paper • Works by RPW, Tim Brown, Julio Cesar Fort, etc. • Not a ton of stuff out there https://www.sec-consult.com/fxdata/seccons/prod/downloads/sec_consult_vulnerability_lab_blackberry_z10_initial_analysis_v10.pdf

OSINT QNX Foundry • Man pages for QNXisms • Downloads • Forums • Wiki • Google dorks are golden…