1 00:00:28,860 --> 00:00:32,780 It looks like there's actually an ad on Twitch right now. 2 00:00:44,180 --> 00:00:45,300 We're on. 3 00:00:45,300 --> 00:00:46,220 All right. 4 00:00:47,660 --> 00:00:56,220 Hi everyone, thanks for joining us today in the Q&A for Pwn2Own, QAM's compute DSP for fun and profit. 5 00:00:56,280 --> 00:00:58,720 Talk about a mouthful, right? 6 00:00:59,500 --> 00:01:04,800 Hi everyone, thanks for joining us today in the Q&A for Pwn2Own. 7 00:01:04,800 --> 00:01:14,820 I am a bit newer than you because this talk definitely went down into the weeds to a technical level that some of us might not be at. 8 00:01:14,820 --> 00:01:19,560 So I was wondering, one, can you introduce yourself to everyone? 9 00:01:19,560 --> 00:01:26,600 And two, can you give me a explain it like I'm five overview of the research that you did? 10 00:01:28,080 --> 00:01:30,460 Okay, no problem. 11 00:01:30,460 --> 00:01:31,740 Hello everyone. 12 00:01:31,740 --> 00:01:35,420 So first of all, yes, you're right. 13 00:01:35,420 --> 00:01:38,680 This talk is highly technical. 14 00:01:38,680 --> 00:01:40,840 I tried to explain. 15 00:01:41,560 --> 00:01:48,540 First of all, we found, we discovered several vulnerabilities. 16 00:01:48,540 --> 00:02:00,020 And these vulnerabilities allow us to execute a custom malware code on a DSP processor of a mobile device. 17 00:02:00,020 --> 00:02:05,120 I mean, the DSP processor of a Qualcomm-based Android phone. 18 00:02:05,120 --> 00:02:14,400 This means it's about 50, I think, percent of all mobile phones. 19 00:02:14,400 --> 00:02:31,580 And it means that regularly, you know, there is an Android operating system, including Linux kernel, that is run on a CPU, actually. 20 00:02:31,580 --> 00:02:44,380 But there is another processor, DSP, on a mobile device, and we found a way to execute some codes on this processor. 21 00:02:44,380 --> 00:02:52,160 And through this, gain some privileges and denounce service capabilities. 22 00:02:52,160 --> 00:03:05,160 This means, actually, that I can, if you install my malware application, and I can just break your phone, for example. 23 00:03:05,160 --> 00:03:09,420 Or I can steal some information from your phone. 24 00:03:09,420 --> 00:03:22,820 And for this, I just need to use some API provided by Qualcomm that allows me to execute code on this processor. 25 00:03:23,040 --> 00:03:24,100 That's all. 26 00:03:24,100 --> 00:03:29,040 So, several vulnerabilities for big things. 27 00:03:29,040 --> 00:03:38,800 And actually, what I can get from this, I can hide my malicious code inside of the DSP processor. 28 00:03:38,800 --> 00:03:44,320 And antiviruses don't expect to see here something. 29 00:03:44,580 --> 00:03:53,640 And some execution, because all code that runs on the DSP processor is signed by Qualcomm. 30 00:03:53,640 --> 00:04:01,000 This means that any third-party application can do nothing inside of this processor. 31 00:04:01,000 --> 00:04:12,930 All other things, as I mentioned, denounce service, privilege escalation, and so on. 32 00:04:21,450 --> 00:04:23,970 So, okay. 33 00:04:24,170 --> 00:04:25,170 Let's begin. 34 00:04:25,990 --> 00:04:32,390 Actually, the major goal of the research was to execute the code in the kernel of the DSP processor. 35 00:04:32,390 --> 00:04:40,050 But I need to use several exploits, several vulnerabilities in the chain to do this thing. 36 00:04:40,050 --> 00:04:46,270 And the first thing, the first vulnerability, is to downgrade some code. 37 00:04:46,270 --> 00:04:54,250 Actually, I need to downgrade some library, pre-installed on a mobile device, and start from this. 38 00:04:54,250 --> 00:05:13,170 For example, I can pull some library from, I don't know, a Chinese Xiaomi or Sony device, and then use its library to execute on the newest Samsung S20. 39 00:05:13,860 --> 00:05:28,320 So it's some vulnerability that there is no version check inside of the operating system running in the DSP processor. 40 00:05:28,710 --> 00:05:42,850 But after that, I need to use several other vulnerabilities and exploits to transfer my execution to the kernel of the DSP processor. 41 00:05:42,850 --> 00:05:45,410 It means that downgrade is the first step. 42 00:05:45,410 --> 00:05:52,810 After that, I need to use a vulnerability and a full exploit to execute the code in the user mode of the DSP processor. 43 00:05:52,810 --> 00:05:57,170 And from the user mode, I can access to DSP drivers. 44 00:05:57,170 --> 00:06:07,230 And I discovered several vulnerabilities in DSP drivers that gain privileges of kernel. 45 00:06:07,230 --> 00:06:18,090 It gets the OS level of DSP operating system running on DSP. 46 00:06:22,070 --> 00:06:23,630 Great, thank you. 47 00:06:23,630 --> 00:06:32,730 So when I was reviewing the subject, I was wondering why you chose the DSP module. 48 00:06:32,730 --> 00:06:47,870 I mean, I think when you mentioned the Qualcomm system as a chip, as a black box, and the number of components and subcomponents built into it, I didn't know if there was something you found or you suspected was specifically risky about the subcomponent, 49 00:06:47,870 --> 00:06:50,590 or was it just a particular one you chose? 50 00:06:53,740 --> 00:07:06,880 So, actually, you need to know that, for example, LG company uses some components implemented by Qualcomm. 51 00:07:06,880 --> 00:07:19,900 And LG company, LG vendor, manufacturer, they know what is it, what is actually Qualcomm components. 52 00:07:22,060 --> 00:07:31,200 Because there are a lot of libraries, a lot of ports that are prepared by Qualcomm and pushed to your device. 53 00:07:33,660 --> 00:07:46,400 And one main thing that I mentioned in the talk was that the reason for a lot of security issues, which we discovered, was in Hexagon SDK. 54 00:07:46,400 --> 00:07:59,400 Actually, Qualcomm provided some SDK for development and compilation and debugging of code that could be run on a DSP processor. 55 00:07:59,400 --> 00:08:07,240 And this Hexagon SDK contains serious bugs. 56 00:08:07,240 --> 00:08:15,940 And these bugs lead to code execution, actually. 57 00:08:15,940 --> 00:08:29,300 Hexagon SDK invokes, injects some vulnerabilities inside of all libraries that could be compiled. 58 00:08:29,300 --> 00:08:32,080 So, for example, you are a developer, you are a vendor. 59 00:08:32,080 --> 00:08:39,300 You prepared your code, C++ code, and going to compile it using Hexagon SDK. 60 00:08:39,300 --> 00:08:47,200 And you don't know that SDK will generate some code to help you, actually. 61 00:08:47,200 --> 00:08:50,300 But this code contains bugs. 62 00:08:50,300 --> 00:09:00,080 And an attacker can use these bugs to crash your library and execute code through your library. 63 00:09:00,700 --> 00:09:05,060 Yeah, I'm actually glad you brought that up. 64 00:09:05,060 --> 00:09:13,660 There was a speaker yesterday talking about a vulnerable TCP IP tech that was used in IoT systems. 65 00:09:13,660 --> 00:09:19,600 And he mentioned how we don't think of these as supply chain risks, but they are. 66 00:09:19,600 --> 00:09:22,480 And it seems that very much the case in this, right? 67 00:09:22,680 --> 00:09:40,500 A company includes a library that gets put into a piece of hardware that gets wrappered into a phone, which gets deployed, which a third-party app can now load up another copy of that library and exploit it. 68 00:09:40,500 --> 00:09:52,540 So I didn't know if you wanted to talk about the supply chain impact on this and what phone manufacturers should take as a lesson from your analysis. 69 00:09:54,540 --> 00:09:56,820 Yeah, good question. 70 00:09:56,820 --> 00:10:02,920 Actually, I just want to say that Qualcomm is going to do well. 71 00:10:02,920 --> 00:10:14,680 As I know, it's impossible to fix all these vulnerabilities. 72 00:10:14,680 --> 00:10:20,860 Actually, I reported to Qualcomm 400 unique issues. 73 00:10:20,860 --> 00:10:25,520 And this means that the problem is not just in one piece of code. 74 00:10:25,520 --> 00:10:28,340 The problem is actually in the architecture. 75 00:10:28,340 --> 00:10:35,140 In the architecture of the operating system running in this processor. 76 00:10:35,140 --> 00:10:50,700 And as I know, Qualcomm now works on some new feature, Sandbox, actually, that will prevent execution out of Sandbox inside of these processors. 77 00:10:50,700 --> 00:11:15,980 So if you find a vulnerability and gain privileges to execute some unsigned code inside of processor on your phone, it can provide you some permissions to steal user data or to gain some special privileges or deny service. 78 00:11:15,980 --> 00:11:18,880 So it's an architecture issue. 79 00:11:18,880 --> 00:11:29,240 And I hope and I think that in the future, we will see a new architecture of Qualcomm DSP operating system. 80 00:11:31,580 --> 00:11:33,960 We had a question come into the chat. 81 00:11:33,960 --> 00:11:40,160 And it says, in the talk, you mentioned recompiling on the latest version of Hexagon SDK. 82 00:11:40,160 --> 00:11:46,060 Are there other steps app developers can take to lower the risk of bugs like this? 83 00:11:48,160 --> 00:11:49,100 Okay. 84 00:11:49,100 --> 00:12:09,040 First of all, I think that it should be mentioned that SDK bug that actually invoked vulnerabilities to dozens of libraries, it will be patched just in Hexagon SDK 4.0. 85 00:12:09,040 --> 00:12:17,940 But now third-party developers can't download this new version of SDK. 86 00:12:17,940 --> 00:12:30,140 As I know, just mobile vendors now can ask Qualcomm to provide this new version without vulnerability. 87 00:12:30,140 --> 00:12:48,390 But if we are talking about something general, no one can promise that the new version of SDK or any other SDK will be clear from bugs and from vulnerabilities. 88 00:12:49,160 --> 00:12:55,780 You always have a risk, but nothing we can do. 89 00:12:55,780 --> 00:13:18,280 So Hexagon SDK now is one in the world, actually, that can provide you ability to build your code, to write code of Hexagon architecture. 90 00:13:18,280 --> 00:13:24,560 So it means that you don't have a choice. 91 00:13:24,560 --> 00:13:30,680 You have to execute Hexagon SDK to build your code, to write code of Hexagon. 92 00:13:31,320 --> 00:13:37,440 So use it and I will try to find something new for you. 93 00:13:38,220 --> 00:13:49,280 We were talking earlier, though, you were mentioning that there was, I guess, a little bit more news coming out after you released your research and the patch was implemented. 94 00:13:49,280 --> 00:13:54,140 Could you go into a little bit of the other vulnerabilities that are kind of still out in the wild? 95 00:13:57,140 --> 00:14:10,240 For now, as I mentioned, we have a lot of issues and for now only maybe just several of them have been fixed. 96 00:14:10,240 --> 00:14:21,060 For example, issues in Hexagon SDK, but a lot of vulnerabilities have not been patched. 97 00:14:21,060 --> 00:14:51,040 We are waiting for this and for now, as I know, Qualcomm just asked software developers and vendors, actually, OEM vendors and mobile manufacturers to close an ability of a third-party Android application to ask something from these big processors. 98 00:14:52,500 --> 00:14:54,020 That's it. 99 00:14:54,020 --> 00:14:57,000 So we are waiting for the patch still. 100 00:14:57,000 --> 00:15:21,020 Therefore, I can't share technical information about those vulnerabilities and I can't open source a POC that I implemented to execute code in unsigned code. 101 00:15:21,020 --> 00:15:23,500 It's not in the kernel of the DSP. 102 00:15:24,720 --> 00:15:26,200 Sorry for this. 103 00:15:27,120 --> 00:15:33,180 The next question that we have come up is, you mentioned using older libraries with known security issues. 104 00:15:33,180 --> 00:15:39,520 Did you find during fuzzing exploitable bugs in the latest versions of some of these libraries? 105 00:15:41,180 --> 00:15:42,940 It's a good question. 106 00:15:42,940 --> 00:15:43,520 Thank you. 107 00:15:43,520 --> 00:15:45,760 And the answer is yes. 108 00:15:45,760 --> 00:16:09,260 So I tried to fuzz a lot of libraries, a lot of drivers from many devices and I can say that a lot of all of them contains vulnerabilities. 109 00:16:10,260 --> 00:16:43,080 It doesn't mean it's old or new, but I just use in my chain the really old library because to find something special that provides read-write permissions and read-write patterns to exploit exactly vulnerability, I just find in an old library. 110 00:16:43,080 --> 00:16:58,160 But it doesn't mean that we can use another library and newest one and to fuzz it and to find something inside this library. 111 00:16:58,160 --> 00:17:11,620 So as I mentioned, dozens of libraries in all mobile phones, news and old based on Snapdragon system on the chip contains libraries. 112 00:17:14,720 --> 00:17:25,560 And we have an interesting follow-up, I think, and that's what are the chances that the best version of the skeleton would be updated before the next Android release? 113 00:17:28,160 --> 00:17:29,460 I don't know. 114 00:17:29,460 --> 00:17:55,380 So it's a good question and I asked this question at Qualcomm and I don't know because you need to understand that the first page of the page, it will be some fix provided by Qualcomm. 115 00:17:55,380 --> 00:18:13,120 After that, mobile vendors like Samsung, LG and Xiaomi and many others need to adopt this page to the actual devices and maybe just after that, we will see this page on our phones. 116 00:18:13,120 --> 00:18:32,380 It means that maybe in the next month, we will see some page, for example, on Samsung devices, but it doesn't mean that all vendors and all mobile phones and manufacturers will update their phones in the same moment. 117 00:18:35,690 --> 00:18:46,410 Yeah, so you described a problem with the whole Android infrastructure in general and the update, the chain and the delays. 118 00:18:46,890 --> 00:19:00,630 So aside from making sure they buy the newest phone to get the latest patches, is there really anything an end user can do to detect that such an exploit would be on their phone? 119 00:19:03,590 --> 00:19:10,810 Okay, first of all, it's very difficult to detect such an attack and such an exploit. 120 00:19:10,930 --> 00:19:24,790 For example, in our company, I don't want to advertise, but you need to use some antivirals, actually, which expect to see code execution in this processor. 121 00:19:24,790 --> 00:19:46,530 Just in this case, this antivirus will try to analyze all your applications installed on your phone and try to find you using some signature or machine learning and some suspicious code which could be used to attack this processor. 122 00:19:46,530 --> 00:19:54,550 So for now, I see only one way to prevent attack your newest mobile phone is to use good antivirus. 123 00:19:54,550 --> 00:19:56,650 But I'm not sure. 124 00:19:56,650 --> 00:20:08,090 And I think that currently antiviruses expect to see some attacks like this on your phone. 125 00:20:08,090 --> 00:20:17,250 But maybe in the next release of the antivirus, we will see. 126 00:20:40,510 --> 00:20:46,010 My question was, did you find that they were attentive to that disclosure? 127 00:20:46,010 --> 00:20:55,110 And the question from the audience is, did you find vendors, did you find that the vendors didn't seem to care about the problems with the skeleton libraries? 128 00:20:57,550 --> 00:21:10,210 Actually, no, I think that all vendors are trying to patch their code, but now vendors can do that. 129 00:21:10,210 --> 00:21:23,910 So because we are waiting for the page from Qualcomm, because as I mentioned, the first stage of the page is to get a new page or a new SDK from Qualcomm. 130 00:21:23,910 --> 00:21:35,930 And just after that, you can... vendors will use it to inject this news and patch inside of their code. 131 00:21:35,930 --> 00:21:43,910 But the interesting thing that I would mention is that Samsung, for example, was very good with this. 132 00:21:43,910 --> 00:22:06,750 For example, Samsung sent to me a mail before this presentation and asked what I was talking about, how they can patch their phones from this type of attack. 133 00:22:06,750 --> 00:22:14,090 So Samsung is pretty good with this type of situation. 134 00:22:14,090 --> 00:22:16,430 But now we are waiting for the page. 135 00:22:18,610 --> 00:22:21,570 I think we are coming close to the end of time. 136 00:22:21,570 --> 00:22:25,450 Will you be hanging around Discord if people have follow-up questions? 137 00:22:31,390 --> 00:22:32,790 Slava, can you hear me? 138 00:22:33,550 --> 00:22:34,470 I'm sorry. 139 00:22:34,470 --> 00:22:39,870 I was asking if you will be sticking around Discord if people have follow-up questions for you? 140 00:22:42,010 --> 00:22:43,430 No problem. 141 00:22:43,430 --> 00:22:45,390 I can ask. 142 00:22:45,390 --> 00:22:51,650 So first of all, in the end of my presentation of my slides, you can find my email. 143 00:22:51,750 --> 00:22:55,190 You always can ask all your questions. 144 00:22:56,790 --> 00:23:04,050 Just send an email for me and I will try to explain and help you. 145 00:23:06,630 --> 00:23:14,490 But if you want to continue, I can answer to your questions here in the text form. 146 00:23:14,490 --> 00:23:17,870 Thanks guys for joining all of us, or should I say folks. 147 00:23:17,870 --> 00:23:21,090 And if you have any further questions, go ahead and reach out. 148 00:23:21,090 --> 00:23:26,310 Until then, join us in a bit for detecting 4G base stations in real time. 149 00:23:26,310 --> 00:23:27,210 Bye!