start	end	text
1410	5070	Hello everyone. Thank you for attending this talk.
5510	9090	I'm Slava. I'm a security researcher at CheckPoint.
9430	12710	Security research is my daily work.
12930	16190	Today I'm going to show how an Android application
16190	20050	can attack the digital signal processor of a mobile device
20430	24890	and thereby gain privileges and denial-of-service capabilities.
29600	31880	Let's begin with a question.
31880	36360	Do you know how many processors are on your mobile phone?
36400	38640	The answer is many.
38660	42720	As a single Snapdragon system on a chip embedded in Pixel,
42720	46640	Samsung, Xiaomi, LG, OnePlus, Sony and other devices
46640	50180	may include multiple CPU cores,
50180	52920	an Adreno graphic processor unit,
53000	55040	a Snapdragon wireless module,
55160	57340	a Hexagon digital signal processor,
57340	60240	and Spectro image signal processor.
60240	63580	Snapdragon product tiers are differentiated
63920	69680	by scalable computing resources for the CPU, GPU and DSP.
69680	74900	The lowest tiers might contain only a single Hexagon DSP,
74900	77240	whereas the premium tier contains
77980	80580	up to four Hexagon DSP processors
80860	83580	dedicated for specific use cases.
84300	90000	These are modem DSP, known as baseband audio DSP,
90000	93020	compute DSP, and sensor DSP.
93040	100620	In this research, I turned my attention to ADSP and CDSP subsystems.
101420	105580	ADSP and CDSP processors are intended for such cool tasks
105580	109460	as processing of audio and voice data,
109460	112580	computer vision, machine learning calculations,
112580	117280	camera streaming, artificial intelligence, etc.
117280	122480	On some devices, such as the Sony Xperia XZ,
122480	127860	only the ADSP processor is responsible for all these tasks.
127860	132240	But on other devices, such as the Pixel 4,
132240	137680	these tasks are shared between ADSP and CDSP.
138680	141460	Let's take a look at the communication scheme
141460	146100	between an Android application and a DSP running library.
147620	151650	FasterPC is a Qualcomm proprietary RPC mechanism
151940	155620	used to enable remote code function calls
155620	161220	between application processor, where Android is run, and DSP.
161220	167140	On Android side, user mode process initiates the remote invocation.
167140	169980	In our case, an Android application calls
169980	173630	one of the stub functions in its native code.
173630	181990	Stub is auto-generated code that converts the function call to an RPC message.
181990	188450	Generally, the stub code is compiled as a separate native library.
188690	195910	The stub code loads libADSP-RPCSO and libCDSP-RPCSO built-in libraries
195910	198870	to invoke Android drivers.
198870	204850	DSP-RPC drivers send the queued message to the DSP side
204850	210150	through the shared memory channel, and then wait for the response.
211510	217270	On DSP side, a framework presented by the FasterPC shell binary
217870	223950	dequeues the messages and dispatches them for processing by a skeleton.
223950	230170	And again, skeleton is auto-generated library that unmashes parameters
230170	234370	and calls the target method in the object library.
234370	239230	The object library is some logic provided by Qualcomm or OEMs
239230	242810	and designed to run on a DSP.
245070	248250	Who can run their own code on DSP?
248650	253350	Any third-party developer can implement its own DSP library.
253950	259170	Because the Hexagon SDK, which is responsible for compiling C++ code
259170	263130	into Hexagon bytecode, is publicly available.
263510	268850	But it's impossible to run a third-party library on DSP.
268930	274170	For security reasons, DSP is licensed for programming by OEMs
274590	279030	and code running on the DSP is signed by Qualcomm.
281060	283760	Who manages the DSP?
283760	289960	It's Qt, a Qualcomm proprietary multi-threaded real-time operating system.
289960	293980	Integrity of the Qt is trusted by the trust zone.
293980	299540	Qt executable binary, different for ADSP and CDSP,
299540	305200	is assigned and split into several files in the same way
305200	309800	as any other trusted application on Qualcomm devices.
310740	315280	For each Android process initiating the remote invocation,
315280	320280	Qt creates a separate faster PC shell process on the DSP.
320640	326320	The DSP architecture provides different protection domains, PD.
326540	331020	Kernel PD has access to all memory of all domains.
331020	334740	Guest OS PD has access to the memory of its own PD
334740	339780	and memory of the user PD and some system registers.
340580	345000	User PD has access only to its own memory.
345820	350640	Skeleton and object libraries, as well as the fast RPC shell,
350640	353200	are running in the user PD.
355650	362310	The stub code provided by Qualcomm or OEMs can be skipped from the fast RPC chain.
363010	368130	As was mentioned, libADSP-RPC and libCDSP-RPC libraries
368130	373430	are responsible for communication with DSP-RPC drivers.
373810	378570	Each library exports two major functions.
378570	383470	Remote handle open function opens a remote session between the client
383470	389490	on application processor and new fast RPC shell process on the DSP.
389970	394150	The skeleton library name is provided as the first argument.
394150	401770	Remote handle invoke function is able to invoke methods exported by the skeleton library.
401930	409070	Using these two functions, an Android application can request to execute any skeleton method
409070	412330	without using a stub code.
413730	418730	Now we have enough information to state the downgrade vulnerability.
419010	423610	DSP libraries are signed and cannot be patched.
423610	429430	However, any Android application can bring a signed by Qualcomm skeleton library
429430	433810	in its assets and then open a remote session.
433910	439730	The library will be successfully loaded on the DSP because its signature is correct.
441070	445850	The fact that there is no version check of loading skeleton libraries
445850	449790	opens the possibility to run a very old skeleton lib
450660	454050	with known one-day vulnerabilities on the DSP.
454050	459470	Even if the patched skeleton library already exists on the device,
459470	463730	it is possible to load the old version of this library.
464070	470070	Any DSP code fix can be simply bypassed by an attacker.
471070	475750	Due to the lack of leads of the skeleton libraries permitted for the device,
475750	479670	it is possible to run a library intended for one device,
479670	484990	for example, Chinese Xiaomi, on any other device, for example, Samsung.
485010	491270	This means that a vulnerability discovered in one of OEM libraries
492070	495390	compromises all Snapdragon-based Android devices.
497710	503730	The major goal of the research was to find a way to execute custom code on a DSP
503730	506830	bypassing Qualcomm's signature.
507030	514650	To do so, we had to discover and exploit a vulnerability in a DSP-running library.
516270	520270	DSP libraries are proprietary hexagon ELFs.
520390	523130	The easiest way to instrument a hexagon executable
523130	527610	is to use the open-source QUIC emulator, QEMU.
528190	535790	Hexagon instruction set support was added in QEMU only in the end of 2019.
536030	543050	We fixed a lot of bugs to be able to run real DSP libraries in the user mode of the emulator.
543970	551490	To fast leaps on Ubuntu PC, we used American Fuzzy Loop, AFL, in combination with QEMU.
551490	557310	A skeleton library is primarily a library, and we had to prepare a simple program,
557590	561270	a scale loader, that loads and invokes the one.
561630	568430	Moreover, most skeleton libraries widely use DSP framework and system calls.
568430	571750	Our simple program cannot handle such requests.
572010	579870	Therefore, we had to load the cured OS on the emulator before execution of the REST call.
579870	584530	The easiest way to do so is not to use a real cured OS,
584530	592970	but its light version, Run-ELF-PBM, adopted by Qualcomm for execution on a hexagon simulator,
592970	595950	and included in the hexagon SDK.
596570	602710	That's it. The IFR permutates the content of a data file
602710	607830	and triggers execution of Run-ELF-PBM on the emulator.
607830	614270	QEMU returns the code coverage matrix to the AFL after execution of the test case.
615590	622210	On this slide, you can see the data format that we used to fuzz skeleton libraries.
622430	628750	The first word is the second argument of the remote handle invoke function.
628830	636750	The index on the invoked method, number of input and number of output arguments are encoded there.
636750	641410	Next several words we take as the size of arguments,
641410	646150	then we expect to see a value of input arguments.
647270	651050	We were surprised by the fuzzing result.
651050	656090	Crashes were found in all DSP libraries that we choose to fuzz.
656090	662210	Besides, most issues were discovered exactly in skeleton libraries.
662210	667290	This means that hexagon SDK reduces vulnerable code.
668970	678530	Hexagon SDK automatically generates stub and scale code for marshalling and unmarshalling of function arguments.
678650	682710	Let's take a look at an example of such code.
685150	695510	Stub and scale code based on interface definition language modus, IDL modus, prepared by the developer.
695510	704670	Here you can see an example of the IDL declaration of two functions in the neural network library, HexagonNN.
704670	708650	A vulnerable code will be generated for both of them.
710350	718870	HexagonNN SMP print function passes an input-output buffer argument to the DSP.
718870	726510	In the stub code this buffer will be split into two separate buffers, the input and the output.
726510	734370	The value of the buffer length will also be duplicated and therefore serialized twice.
735870	744690	The scale function copies the input of the output buffer before calling an objects function.
744690	751290	The size of data to be copied is one of the transmitted buffer lengths.
751310	753690	An attacker controls this value.
753690	761010	All verification checks can simply be bypassed by using a negative input buffer length.
761010	771090	Typecasting to the signed int type on checking buffer boundaries is a bug leading to heap overflow.
772070	788070	To summarize, the automatically generated code injects vulnerabilities into the libraries of Qualcomm, OEMs and all other third-party developers who use the Hexagon SDK.
788070	798570	Dozens of DSP skeleton libraries pre-installed on Android smartphones are vulnerable due to serious bugs in the SDK.
800050	806230	So, we discovered many vulnerabilities. Let's exploit one of them.
807410	813910	LibFastCV, a DSP-scale SO library, can be found on most Android devices.
813910	821110	In this example, I used the lib extracted from the Sony Xperia XZ Premium device.
821390	830150	A malicious Android application can cause this lib to crash by providing crafted arguments to the remote handling function.
831550	840230	The 3F method allows us to read and write everything that we want within the other space of the DSP process.
840230	849110	It's enough to implement an exploit and execute an unsigned payload in the user protection domain.
850230	854710	Ok, we got code execution. What can we do with it?
854710	863470	We can crash the DSP, we can hide malicious code, we can try to access camera sensors and more.
863590	868370	Besides, now we can communicate with secured drivers.
869490	878430	The next step of the research is to attack the Qt-privileged domains from the user protection domain.
878430	883330	And Qt drivers are the entry points for this.
885230	893430	QtOS implements its own device driver model, named Qt Driver Invocation, QD.
893430	900730	Like POSIX, Qt device drivers operate with higher privileges than user code.
900730	906650	Dozens of Qt drivers can be found in the Qt binary.
907670	915310	libQtA library, which is part of Hexagon SDK, contains the Qt infrastructure.
915310	919710	FasterPC shell is linked statically with the library.
922370	932430	QD provides a simple driver invocation API with the ability to access a device driver based only on the driver name.
932610	941250	Actually, only Qt QD handle invoke macro is the necessary user visible API.
941290	945570	It's responsible for all generic driver operations.
945910	950090	The Qt QD open is just a special case of this macro.
953890	965100	To fuzz Qt drivers on Ubuntu PC, we use the same combination of Hexagon QMU and AFM, as for fuzzing of user-mode DSP libraries.
966390	973850	Qt drivers were not included by Qualcomm in the run.elf.pdn version of Qt.
973850	978110	Therefore, we had to patch the run.elf file.
978110	980330	What did we do?
980330	996550	We appended program segments of Qt.elf from a real device and redirected malloc and memcpy kernel functions used by Qt drivers to their user-mode implementation.
997610	1006730	Our simple QD exec program is responsible for calling the driver invocation function by its address.
1008830	1015730	First of all, any failure in Qt drivers can be used to reboot the mobile device.
1015850	1026970	For example, each of the lines of this code will cause a DSP panic and can be used for a denial-service attack on the device.
1026970	1034810	For research purposes, we exploited one of the discovered vulnerabilities in glink-qt-driver.
1034870	1045170	Along with the user-pd exploit, it allows us to run a custom code in the context of the guest OS protection memory.
1047190	1052150	Now I'll show a simple demo to prove the full attack chain.
1052150	1060370	The payload will return a DSP internal data inaccessible from application processor.
1060370	1063510	The device is a Pixel 4.
1076510	1089790	Here you can see that using a DB shell, I'm executing some tool which can be used by any Android application.
1089790	1100590	This tool will trigger chain of vulnerabilities and return some inaccessible from application processor data.
1100590	1104150	For example, Qt OS data signal.
1104330	1109970	After that, I'm going to control the phone and, for example, I just reboot.
1119640	1131580	Instead of a conclusion, I just want to note that hexagon ADSP and CDSP subsystem are very promising areas for security research.
1131580	1141900	The DSP is accessible from Android application, has access to interesting data for an attacker, and has many security issues.
1143500	1145560	Thank you for your attention.