start	end	text
28860	32780	It looks like there's actually an ad on Twitch right now.
44180	45300	We're on.
45300	46220	All right.
47660	56220	Hi everyone, thanks for joining us today in the Q&A for Pwn2Own, QAM's compute DSP for fun and profit.
56280	58720	Talk about a mouthful, right?
59500	64800	Hi everyone, thanks for joining us today in the Q&A for Pwn2Own.
64800	74820	I am a bit newer than you because this talk definitely went down into the weeds to a technical level that some of us might not be at.
74820	79560	So I was wondering, one, can you introduce yourself to everyone?
79560	86600	And two, can you give me a explain it like I'm five overview of the research that you did?
88080	90460	Okay, no problem.
90460	91740	Hello everyone.
91740	95420	So first of all, yes, you're right.
95420	98680	This talk is highly technical.
98680	100840	I tried to explain.
101560	108540	First of all, we found, we discovered several vulnerabilities.
108540	120020	And these vulnerabilities allow us to execute a custom malware code on a DSP processor of a mobile device.
120020	125120	I mean, the DSP processor of a Qualcomm-based Android phone.
125120	134400	This means it's about 50, I think, percent of all mobile phones.
134400	151580	And it means that regularly, you know, there is an Android operating system, including Linux kernel, that is run on a CPU, actually.
151580	164380	But there is another processor, DSP, on a mobile device, and we found a way to execute some codes on this processor.
164380	172160	And through this, gain some privileges and denounce service capabilities.
172160	185160	This means, actually, that I can, if you install my malware application, and I can just break your phone, for example.
185160	189420	Or I can steal some information from your phone.
189420	202820	And for this, I just need to use some API provided by Qualcomm that allows me to execute code on this processor.
203040	209040	That's all. So, several vulnerabilities for big things.
209040	218800	And actually, what I can get from this, I can hide my malicious code inside of the DSP processor.
218800	224320	And antiviruses don't expect to see here something.
224580	233640	And some execution, because all code that runs on the DSP processor is signed by Qualcomm.
233640	241000	This means that any third-party application can do nothing inside of this processor.
241000	252930	All other things, as I mentioned, denounce service, privilege escalation, and so on.
261450	265170	So, okay. Let's begin.
265990	272390	Actually, the major goal of the research was to execute the code in the kernel of the DSP processor.
272390	280050	But I need to use several exploits, several vulnerabilities in the chain to do this thing.
280050	286270	And the first thing, the first vulnerability, is to downgrade some code.
286270	294250	Actually, I need to downgrade some library, pre-installed on a mobile device, and start from this.
294250	305650	For example, I can pull some library from, I don't know, a Chinese Xiaomi or Sony device,
305650	313170	and then use its library to execute on the newest Samsung S20.
313860	328320	So it's some vulnerability that there is no version check inside of the operating system running in the DSP processor.
328710	342850	But after that, I need to use several other vulnerabilities and exploits to transfer my execution to the kernel of the DSP processor.
342850	345410	It means that downgrade is the first step.
345410	352810	After that, I need to use a vulnerability and a full exploit to execute the code in the user mode of the DSP processor.
352810	357170	And from the user mode, I can access to DSP drivers.
357170	367230	And I discovered several vulnerabilities in DSP drivers that gain privileges of kernel.
367230	378090	It gets the OS level of DSP operating system running on DSP.
382070	383630	Great, thank you.
383630	392730	So when I was reviewing the subject, I was wondering why you chose the DSP module.
392730	398270	I mean, I think when you mentioned the Qualcomm system as a chip, as a black box,
398270	401970	and the number of components and subcomponents built into it,
401970	407870	I didn't know if there was something you found or you suspected was specifically risky about the subcomponent,
407870	410590	or was it just a particular one you chose?
413740	426880	So, actually, you need to know that, for example, LG company uses some components implemented by Qualcomm.
426880	439900	And LG company, LG vendor, manufacturer, they know what is it, what is actually Qualcomm components.
442060	451200	Because there are a lot of libraries, a lot of ports that are prepared by Qualcomm and pushed to your device.
453660	461280	And one main thing that I mentioned in the talk was that the reason for a lot of security issues,
461280	466400	which we discovered, was in Hexagon SDK.
466400	479400	Actually, Qualcomm provided some SDK for development and compilation and debugging of code that could be run on a DSP processor.
479400	487240	And this Hexagon SDK contains serious bugs.
487240	495940	And these bugs lead to code execution, actually.
495940	509300	Hexagon SDK invokes, injects some vulnerabilities inside of all libraries that could be compiled.
509300	512080	So, for example, you are a developer, you are a vendor.
512080	519300	You prepared your code, C++ code, and going to compile it using Hexagon SDK.
519300	527200	And you don't know that SDK will generate some code to help you, actually.
527200	530300	But this code contains bugs.
530300	540080	And an attacker can use these bugs to crash your library and execute code through your library.
540700	545060	Yeah, I'm actually glad you brought that up.
545060	553660	There was a speaker yesterday talking about a vulnerable TCP IP tech that was used in IoT systems.
553660	559600	And he mentioned how we don't think of these as supply chain risks, but they are.
559600	562480	And it seems that very much the case in this, right?
562680	573980	A company includes a library that gets put into a piece of hardware that gets wrappered into a phone, which gets deployed,
573980	580500	which a third-party app can now load up another copy of that library and exploit it.
580500	592540	So I didn't know if you wanted to talk about the supply chain impact on this and what phone manufacturers should take as a lesson from your analysis.
594540	596820	Yeah, good question.
596820	602920	Actually, I just want to say that Qualcomm is going to do well.
602920	614680	As I know, it's impossible to fix all these vulnerabilities.
614680	620860	Actually, I reported to Qualcomm 400 unique issues.
620860	625520	And this means that the problem is not just in one piece of code.
625520	628340	The problem is actually in the architecture.
628340	635140	In the architecture of the operating system running in this processor.
635140	641840	And as I know, Qualcomm now works on some new feature, Sandbox, actually,
641840	650700	that will prevent execution out of Sandbox inside of these processors.
650700	663060	So if you find a vulnerability and gain privileges to execute some unsigned code inside of processor on your phone,
663060	675980	it can provide you some permissions to steal user data or to gain some special privileges or deny service.
675980	678880	So it's an architecture issue.
678880	689240	And I hope and I think that in the future, we will see a new architecture of Qualcomm DSP operating system.
691580	693960	We had a question come into the chat.
693960	700160	And it says, in the talk, you mentioned recompiling on the latest version of Hexagon SDK.
700160	706060	Are there other steps app developers can take to lower the risk of bugs like this?
708160	722280	Okay. First of all, I think that it should be mentioned that SDK bug that actually invoked vulnerabilities to dozens of libraries,
722280	729040	it will be patched just in Hexagon SDK 4.0.
729040	737940	But now third-party developers can't download this new version of SDK.
737940	750140	As I know, just mobile vendors now can ask Qualcomm to provide this new version without vulnerability.
750140	768390	But if we are talking about something general, no one can promise that the new version of SDK or any other SDK will be clear from bugs and from vulnerabilities.
769160	775780	You always have a risk, but nothing we can do.
775780	798280	So Hexagon SDK now is one in the world, actually, that can provide you ability to build your code, to write code of Hexagon architecture.
798280	810680	So it means that you don't have a choice. You have to execute Hexagon SDK to build your code, to write code of Hexagon.
811320	817440	So use it and I will try to find something new for you.
818220	829280	We were talking earlier, though, you were mentioning that there was, I guess, a little bit more news coming out after you released your research and the patch was implemented.
829280	834140	Could you go into a little bit of the other vulnerabilities that are kind of still out in the wild?
837140	850240	For now, as I mentioned, we have a lot of issues and for now only maybe just several of them have been fixed.
850240	861060	For example, issues in Hexagon SDK, but a lot of vulnerabilities have not been patched.
861060	891040	We are waiting for this and for now, as I know, Qualcomm just asked software developers and vendors, actually, OEM vendors and mobile manufacturers to close an ability of a third-party Android application to ask something from these big processors.
892500	897000	That's it. So we are waiting for the patch still.
897000	921020	Therefore, I can't share technical information about those vulnerabilities and I can't open source a POC that I implemented to execute code in unsigned code.
921020	923500	It's not in the kernel of the DSP.
924720	926200	Sorry for this.
927120	933180	The next question that we have come up is, you mentioned using older libraries with known security issues.
933180	939520	Did you find during fuzzing exploitable bugs in the latest versions of some of these libraries?
941180	943520	It's a good question. Thank you.
943520	945760	And the answer is yes.
945760	969260	So I tried to fuzz a lot of libraries, a lot of drivers from many devices and I can say that a lot of all of them contains vulnerabilities.
970260	994120	It doesn't mean it's old or new, but I just use in my chain the really old library because to find something special that provides read-write permissions
994120	1003080	and read-write patterns to exploit exactly vulnerability, I just find in an old library.
1003080	1018160	But it doesn't mean that we can use another library and newest one and to fuzz it and to find something inside this library.
1018160	1031620	So as I mentioned, dozens of libraries in all mobile phones, news and old based on Snapdragon system on the chip contains libraries.
1034720	1045560	And we have an interesting follow-up, I think, and that's what are the chances that the best version of the skeleton would be updated before the next Android release?
1048160	1075380	I don't know. So it's a good question and I asked this question at Qualcomm and I don't know because you need to understand that the first page of the page, it will be some fix provided by Qualcomm.
1075380	1093120	After that, mobile vendors like Samsung, LG and Xiaomi and many others need to adopt this page to the actual devices and maybe just after that, we will see this page on our phones.
1093120	1112380	It means that maybe in the next month, we will see some page, for example, on Samsung devices, but it doesn't mean that all vendors and all mobile phones and manufacturers will update their phones in the same moment.
1115690	1140630	Yeah, so you described a problem with the whole Android infrastructure in general and the update, the chain and the delays. So aside from making sure they buy the newest phone to get the latest patches, is there really anything an end user can do to detect that such an exploit would be on their phone?
1143590	1164790	Okay, first of all, it's very difficult to detect such an attack and such an exploit. For example, in our company, I don't want to advertise, but you need to use some antivirals, actually, which expect to see code execution in this processor.
1164790	1186530	Just in this case, this antivirus will try to analyze all your applications installed on your phone and try to find you using some signature or machine learning and some suspicious code which could be used to attack this processor.
1186530	1208090	So for now, I see only one way to prevent attack your newest mobile phone is to use good antivirus. But I'm not sure. And I think that currently antiviruses expect to see some attacks like this on your phone.
1208090	1217250	But maybe in the next release of the antivirus, we will see.
1240510	1255110	My question was, did you find that they were attentive to that disclosure? And the question from the audience is, did you find vendors, did you find that the vendors didn't seem to care about the problems with the skeleton libraries?
1257550	1270210	Actually, no, I think that all vendors are trying to patch their code, but now vendors can do that.
1270210	1295930	So because we are waiting for the page from Qualcomm, because as I mentioned, the first stage of the page is to get a new page or a new SDK from Qualcomm. And just after that, you can... vendors will use it to inject this news and patch inside of their code.
1295930	1303910	But the interesting thing that I would mention is that Samsung, for example, was very good with this.
1303910	1326750	For example, Samsung sent to me a mail before this presentation and asked what I was talking about, how they can patch their phones from this type of attack.
1326750	1336430	So Samsung is pretty good with this type of situation. But now we are waiting for the page.
1338610	1352790	I think we are coming close to the end of time. Will you be hanging around Discord if people have follow-up questions? Slava, can you hear me?
1353550	1354470	I'm sorry.
1354470	1359870	I was asking if you will be sticking around Discord if people have follow-up questions for you?
1362010	1375190	No problem. I can ask. So first of all, in the end of my presentation of my slides, you can find my email. You always can ask all your questions.
1376790	1384050	Just send an email for me and I will try to explain and help you.
1386630	1394490	But if you want to continue, I can answer to your questions here in the text form.
1394490	1401090	Thanks guys for joining all of us, or should I say folks. And if you have any further questions, go ahead and reach out.
1401090	1407210	Until then, join us in a bit for detecting 4G base stations in real time. Bye!