Root-proof Smartphonesand

Other Myths and Legends

Scott G. KellyMarch 8, 2012CanSecWest 2012

CSW 2012 2

Agenda• Smartphone tug of war

– Why we want control– Why providers want control

• The struggle for control – Rooting/jailbreaking– Provider responses– How/why of provider control failures

• New security technologies– What they are, how they work– Some potential implications

March 8, 2012

CSW 2012 3

Evolution

• Smartphones (SPs) are increasingly powerful– In some cases, can functionally replace PCs– Email, web, video, etc.

• But SPs and PCs differ in at least one subtle and important way:– By design, SP is multi-tenant environment; PC is

not

March 8, 2012

CSW 2012 4

What’s a multi-tenant environment?

• Computing environment where– Hardware/resources are shared– among multiple stakeholders– whose interests not necessarily aligned

• Cloud service (Amazon EC2) is good example– Provider: Amazon– Hardware: shared server, storage, network– Tenants

• Provider + VMs• VM owners may be mutually suspicious• At least 2 tenants: Amazon + VM owner

March 8, 2012

CSW 2012 5

PCs are single-tenant*• PC manufacturer may have configured system certain way,

but…

• You are free to change it– Add hardware– Replace OS– Replace pieces of OS– Install/remove applications– Etc.

*Enterprise PC or home PC with multiple users is multi-tenant, but to much lesser degree than cloud example, and in different way than SP

March 8, 2012

CSW 2012 6

SP has >=2 tenants• Tenant 1

– Service provider*– Similar to cloud provider example above

• Tenant 2– SP user (you)– Like VM owner in EC2 example

• DOH! But I OWN my SP, right?– Well… sort of.– Depends on what you mean by “own”

March 8, 2012

CSW 2012 7

Misaligned InterestsYou Provider

Want to customize• Install custom “ROM”• Install “unauthorized” apps• Remove/replace “bloatware”

Wants “Brand control”• Fixed OS• Limit/control app sources• Pre-installed, undeletable apps

Want to tether phone Wants to charge extra for tethering

Want to unlock SIM Wants to lock phone to network• Phone is loss-leader• Customer churn is bad• Phone exclusivity is valuable

Want to overclock Wants to charge more for un-throttling

Want to install custom baseband Wants to protect/control cellular network

Want to remove CarrierIQ ??? (ask Trevor )

March 8, 2012

CSW 2012 8

Whose pwn is it, anyway?

• Technically, it is yours.• As a practical matter (more often than not),

that’s an illusion.• Why?– Because you got it from the provider.– And the provider designed/configured the phone to

maintain control.– smart pwn.

• Solution: “rooting”/”jailbreaking”

March 8, 2012

CSW 2012 9

Rooting

• Basically, two ways to root phone:1. Install new firmware image (“rom”) using built-in

firmware update facility2. Exploit a system vulnerability, overwrite/replace

firmware image*

• The first way works if providers don’t prevent it– But providers are implementing barriers

• In fact, barriers may become the norm– So, some phones require sploitz

March 8, 2012

CSW 2012 10

SP Architecture Overview

• To understand rooting barriers, we need some background

• Following is a brief overview in two parts– Embedded systems architecture– Modern SP architecture

• Once we have that background, we can come back to attacker/defender discussion

March 8, 2012

CSW 2012 11

Embedded Systems 101

• Embedded systems generally include– NAND/NOR Flash

• non-volatile memory in which firmware is stored

– CPU/MCU• processor for OS/apps

– DRAM• random access memory

(just like your PC)– Interfaces

• Wifi, ethernet, etc.

March 8, 2012

CSW 2012 12

Embedded Systems 101 (2)• At power-on

– Processor comes out of reset– Begins running code from flash*

• Boot Loader (BL) is typically first code to run

• BL initializes HW (memory, etc.)

• BL usually copies itself into DRAM before continuing

March 8, 2012

CSW 2012 13

Embedded Systems 101 (3)

• BL continues hardware initialization from DRAM

• BL validates, loads, and jumps into OS

• OS finishes init, goes to runtime steady state

March 8, 2012

CSW 2012 14

Terminology

• SoC– A System on Chip packages all or most necessary system elements

into a single Integrated Circuit (IC) package

• Application CPU/processor/core– SPs typically utilize a multi-core SoC. The application CPU runs the

user interface and apps

• Baseband processor– The baseband (aka modem/radio) processor handles cellular

communications.

March 8, 2012

CSW 2012 15

Terminology (2)

• System firmware– Collection of system code controlled by provider

• System image– System firmware and file systems are packaged for

distribution.

• OTP/eFuse– One Time Programmable memory, typically implemented

with eFuse technology

March 8, 2012

CSW 2012 16

SP Architecture (1)• Embedded systems are all around

us– Variations depending on application

• But core components are essentially the same– CPU(s)– NVRAM– DRAM– I/O

• And so are development procedures

http://wiki.openmoko.org/wiki/Neo_FreeRunner_Hardware

March 8, 2012

CSW 2012 17

SP Architecture (2)

March 8, 2012

CSW 2012 18

SP Architecture (3)

March 8, 2012

http://www.arm.com/images/processor/Mobile_Computing_Diagram_550.jpg

CSW 2012 19

SP Architecture (4)

March 8, 2012

http://www.ti.com/general/docs/wtbu/wtbuproductcontent.tsp?templateId=6123&navigationId=12843&contentId=53243

CSW 2012 20

Important Observations• SPs have multiple processors/cores

– application processor (may be SMP)– Baseband (a.k.a. modem) processor– Others

• These cores run distinct instruction streams– They are not all controlled by the OS that is running on the

application processor (and they are not all running the same OS)– What resources they share (e.g. memory, buses, etc.) are design

choices that may or may not be informed by security concerns

March 8, 2012

CSW 2012 21

Important Observations (cont.)

• Inter-processor communication requires protocols, interconnects, protocol handlers, etc.– These are all part of the system attack surface

• The complexity of the code running on the baseband and other cores is a design choice– QCOM MSM6280 runs 32MB+ of code on baseband

• http://events.ccc.de/congress/2011/Fahrplan/events/4735.en.html• http://tjworld.net/wiki/Android/HTC/Vision/RadioAnalysis

– P(bugs|32MB) >> 0? Seems highly likely.

March 8, 2012

CSW 2012 22

Going back…

• So, how did that first approach to rooting work, again?– SPs support firmware upgrade

• Firmware is stored in flash– Provider (or someone) creates image file– Image is delivered to SP

• OTA (over the air)• OTN (over the network)• SD/MMC (download)• USB (fastboot)

– write new image to flash

March 8, 2012

CSW 2012 23

Image upgrades (2)

• To use the first approach, need to– Reverse engineer image format– Assemble tool chain, source code*– Recreate working facsimile of system image, with

your mods added• NOTE: can re-use binary pieces of existing images (!)

– Construct new image file– Flash new image

March 8, 2012

CSW 2012 24

Why the second rooting method?

• Providers often want to ensure that only authorized images run on SPs– Initially, some assumed that creating a firmware image

is sufficiently “hard”• Security through obscurity• But they were wrong.

– Many available “roms”, “rom kitchens”, etc. prove this is not hard

• Plan B: implement secure boot

March 8, 2012

CSW 2012 25

Secure Boot?

• Put simply, means that only authorized (system) code runs

• If image is corrupted, or you try to install your own (unauthorized) code, system will not run.

• Neat! Why don’t they have that for Windows yet?– D’oh! UEFI is coming. – But that’s another presentation.

March 8, 2012

CSW 2012 26

Secure Boot Overview

• Based on “chain of trust”

• Requires trusted root– Trusted code (RoT) with

ability to verify next link in chain

• Verification mechanism– Typically, digital

signatures– Public key(s) protected

(in ROM/OTP) Source: www.trustedcomputinggroup.org

March 8, 2012

CSW 2012 27

Secure Boot Overview (2)• Chain of trust, cont.

– RoT verifies BL– BL verifies kernel, rootfs– Kernel may be configured to

validate applications (e.g., iOS)

• Trick is to ensure public keys are protected

• Can use multiple public keys:– BL key is in ROM/OTP– Kernel key is in BL– rootfs key is in kernel/BL

Source: www.trustedcomputinggroup.org

March 8, 2012

CSW 2012 28

Is this “bootloader locking”?

• Bootloader locking is a form of secure boot– Protects against bootloader replacement– Ensures that bootloader policy is applied to kernel

• Bootloader locking typically prevents you from “flashing a rom” – it prevents full image replacement.*

• So, how does this “locking” work?

March 8, 2012

CSW 2012 29

BL Locking

• Multiple approaches to locking*– Permanently write-protect bootloader (e.g. by

storing it in ROM, or read-only flash)– Require signed bootloader (IPL code in ROM

verifies/loads)– Have some system element assert wp on BL flash

sector during boot process• Multiple HTC/QCOM phones have been known to do

this• Baseband asserts wp on EMMC during boot

March 8, 2012

CSW 2012 30

Subverting BL Locking

• If bootloader is signed– If symmetric key is used, may be able to obtain this key

somehow (examples to follow)– If public key can be replaced, you can load your own

image• This implies a fundamental security implementation error• SoC vendors typically know better

– If bootloader is verified in flash and then loaded into DRAM, a hardware attack is possible (let check succeed, then substitute your BL)

– Voltage glitching may cause bogus BL to seem “valid”

March 8, 2012

CSW 2012 31

Subverting BL Locking (2)

• If dynamic write-protect scheme is used–Defeat write-protect• By preventing wp operation from completing• By undoing wp operation after the fact

– Mutliple HTC phones have fallen to this approach– Power-cycling EMMC resets WP– http://forum.xda-developers.com/wiki/HTC_Vision

–Replace flash chip (modchip)–Others?

March 8, 2012

CSW 2012 32

Subverting BL Locking (3)

• Uh… – Hardware attacks?– Timing attacks?– Glitching?

• Isn’t there an easier way!?– Good question.– Lazy attackers work smart, look for weak links in chain– Hmmm….

March 8, 2012

CSW 2012 33

Finding a weak link

• ROM loads bootloader• Bootloader loads Linux• Linux loads

– UI– Network drivers– Browser– Apps

• Boot process looks secure

• Or is it?

March 8, 2012

CSW 2012 34

GTV recovery example• Sony GTV supports a “recovery” kernel

• Earlier version contained a subtle flaw– ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_”– Attacker controls filename (package_list_*.zip)!– “package_list_;cd /tmp;cd /mnt;cd /diskb1;sh t.sh;.zip” allows exec of t.sh on

USB (D’OH!)– Game over.

• TOCTTOU flaw allows downgrade– http://gtvhacker.com

• Secure boot FAIL.

March 8, 2012

CSW 2012 35

Weak Validation examples• Asus SBK

– Asus EEE Transformer Tablet uses symmetric AES key to validate bootloader, image (SBK)

– Key is well protected within system, but it was leaked by someone with access (they since changed SBK)

– Secure boot FAIL.

• Samsung CMAC key– Various Samsung DTV/BDP devices use symmetric key to validate

bootloader, image– Key is not well protected within system– Attackers root device, directly read key.– Secure boot FAIL.

March 8, 2012

CSW 2012 36

Attacking runtime system

• Even if secure boot method is robust, can still attack runtime– More features == more complexity– More complexity == more bugs– More bugs == more opportunity for sploitz

• So, how to find the openings?

March 8, 2012

CSW 2012 37

Attack Surface Analysis

• Need to do some recon– Figure out what’s running– Determine distribution of

security bugs in code– Each interface is an entry point– Each entry point exposes code

paths, data– Find path to exploitable bug

• Need to craft inputs in such a way as to gain control of the system

March 8, 2012

CSW 2012 38

Reconnaissance: Linux• Publicly reported Linux

vulnerabilities for last 12+ years– 2011: 85– 2010: 125– 2009: 100– (etc).

• Many of these yield full control of the system

• This looks promising.

Source: http://www.cvedetails.com

March 8, 2012

1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 20110

20

40

60

80

100

120

140

CSW 2012 39

IE Vulnerabilities

March 8, 2012

Source: http://www.accuvant.com/capability/accuvant-labs/security-research/browser-security-comparison-quantitative-approach

CSW 2012 40

Chrome looks no better

March 8, 2012

Source: http://www.accuvant.com/capability/accuvant-labs/security-research/browser-security-comparison-quantitative-approach

CSW 2012 41

What about Firefox?

March 8, 2012

Source: http://www.accuvant.com/capability/accuvant-labs/security-research/browser-security-comparison-quantitative-approach

CSW 2012 42

Browser Vulnerability Summary

March 8, 2012

Source: http://www.accuvant.com/capability/accuvant-labs/security-research/browser-security-comparison-quantitative-approach

CSW 2012 43

Webkit/Opera public stats

• Apple Webkit vulnerabilities*– 2010: 94 (code execution >= 63)– 2011: 112 (code execution >= 96)

• Opera Browser vulnerabilities*– 2009: 16 (code execution >= 1)– 2010: 36 (code execution >= 5)– 2011: 56 (code execution >= 4)

Source: http://www.cvedetails.com

March 8, 2012

CSW 2012 44

Promising avenue: runtime

• Why?– OS’s have vulnerabilities

• Function of complexity, number of contributors, engineering decisions

– So do browsers/webkit

– App support• Android apps can include

*.so (!!)

March 8, 2012

CSW 2012 45

Surprise!

Wait: – The SP correctly implements secure boot, but I can still root it?– And if I can configure the exploit to run at boot time, this is

persistent!– Woohoo!

• The only way this can be fixed is if– Provider forces an OTA update*, or– You voluntarily download/install an update, and – Provider can (forcibly) prevent rollback

March 8, 2012

CSW 2012 46

So, what will they do?• The industry is struggling with this

• Things working against solution– SP ecosystem complexity– Vocal rooting community– Solution cost

• Things creating solution pressure– Providers want to prevent SIM unlocking, cloning, etc.– 3rd party providers need secure platform

• DRM, NFC, wallet apps, etc.– Malware is going to become a problem

March 8, 2012

CSW 2012 47

Emerging Solutions• Google’s (rumored) initiatives

– Lock down *.so usage– Add capabilities/LSM protections– Up to date patching strategy– All are helpful, but losing battle given provider mods?

• Trusted Computing Group (TCG) has been working on Mobile Trust Module (MTM)

• Global Platform has been working on Trusted Execution Environment (TEE) definitions/specifications

www.trustedcomputingroup.org, www.globalplatform.org

March 8, 2012

CSW 2012 48

Trusted Execution Environment

March 8, 2012

CSW 2012 49

Global Platform Vision of TEE

March 8, 2012

Source:GlobalPlatform_TEE_White_Paper_Feb2011.pdf

CSW 2012 50

Numerous ways to implement TEE

• Multiple cores (hardware TEE)– Sensitive operations run on “security” core– Security core controls (and isolates)• OTP/keys• Secure on-chip RAM• Crypto operations/processor• Secure boot, firmware integrity protection

– Application core runs untrusted code (e.g. UI, Android)

March 8, 2012

CSW 2012 51

Hardware TEE Example

March 8, 2012

CSW 2012 52

Numerous Ways to Implement TEE (2)

• With ARM TrustZone™– Normal/secure world abstraction

supported by hardware

– sensitive operations run in “secure world”

– secure world controls (and isolates)• OTP/keys and related crypto ops• internal SRAM• Other critical assets

– “normal world” runs untrusted code

March 8, 2012

*copied from “TrustZone: Integrated Hardware and Software Security”, Information Quarterly, Volume 3, Number 4, 2004

CSW 2012 53

TrustZone Hardware Example

March 8, 2012

Source: ARM, PRD29-GENC-009492C_trustzone_security_whitepaper.pdf

CSW 2012 54

Numerous Ways to Implement TEE (3)

• Virtualization– secure boot – robust hypervisor – MMU/MPU under hypervisor

control– functionally equivalent to HW TEE,

TrustZone

• Hypervisor + MMU/MPU enforces isolation of sensitive operations/keys

March 8, 2012

CSW 2012 55

Numerous Ways to Implement TEE (4)

• Software TEE– Challenge is in providing effective

isolation between trusted and untrusted elements

– Tools that can help:• rigorous obfuscation techniques• white-box cryptography• anti-debugging techniques• runtime tampering/integrity checks• policy/containment framework (e.g.

SELinux, grsecurity)

• Can always be defeated with enough time/effort

• Don’t know of any real-world SP examples*

March 8, 2012

CSW 2012 56

Current TEE Implementations

• Rapidly gaining momentum– Texas Instruments M-Shield– ST-Ericsson– NVIDIA Tegra2– Marvell– Motorola– Intel (GTV, etc.)– Others

• GP membership is growing– http://www.globalplatform.org/membershipcurrentfull.asp

March 8, 2012

CSW 2012 57

Remember this?

March 8, 2012

CSW 2012 58

TEE is the future for SP

• ARM has significant lead in this market• Many (most?) SPs have ARM processors in

them already (including iPhone!)• Turning on TZ is a no-brainer for many SP

providers• Primary barriers are cost/complexity– But this should scale as TZ gets traction

March 8, 2012

CSW 2012 59

TEE/shmee• Even with a robust TEE and

secure boot, rooting can’t be stopped.– “There is no spoon.”

• As long as there are system vulnerabilities, control is up for grabs

• And this is really difficult to “fix” (impossible?)

March 8, 2012

1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 20110

20

40

60

80

100

120

140

CSW 2012 60

What prevents a fix?

• Fundamental problem– Vulnerabilities are a given– Ecosystem does not facilitate patching

• Fragmentation not enough security experts• Carrier certification requirements have scaling implications• Not always clear who’s on the hook (Google? Apple? IC

vendor? Handset manufacturer? Carrier?)

• Result– Sploitz have potentially long lifetime

March 8, 2012

CSW 2012 61

Providers and Rooting

• Providers have mixed feelings about this– Allowing rooting makes them more popular– With TEE, it doesn’t really hurt anything– Malware might change things

• If malware is using sploit, providers will need to respond• One possible answer: A/V in TEE

• HTC explicitly supports unlocking– http://htcdev.com/bootloader

March 8, 2012

CSW 2012 62

Other implications

• Probably would have ended here, but Carrier IQ raised some interesting questions

• Providers’ and users’ interests are often not aligned

• Providers may want access/control that users would rather not cede

• What are implications of TEE?

March 8, 2012

CSW 2012 63

Hypothetically…

• Unlockable HTC phones are based on QC SnapDragon– Supports TrustZone

• Is TZ disabled when BL is unlocked?

• What if it’s not?

March 8, 2012

CSW 2012 64

Hypothetically… (2)• Boot process starts in TZ

• HTC said they are unlocking bootloader

• But they didn’t say which bootloader.

• “Perhaps we are asking the wrong questions.”

– Agent Brown

My bet is here

March 8, 2012

This one?

CSW 2012 65

Hypothetically… (3)

• Unfortunately, no one can be told what The Matrix is. You have to see it for yourself.

• Blue pill, anyone?March 8, 2012

CSW 2012 66

Paranoia?

• You decide:– Provider has strong

incentives to maintain control

– Secure world code may be encrypted

– Normal world cannot see secure world*

• What if CarrierIQ were in the secure world?

Provider has complete control over this

March 8, 2012

CSW 2012 67

Winds of Change• We are gradually ceding control of our computing devices

• Many (most?) users don’t yet see this as an issue

• Recent Win8/ARM/UEFI flap should give us pause

• If we don’t resist, invasive provider controls may become De facto standard

“Do you hear that Mr. Anderson? That is the sound of inevitability.” –Agent Smith

March 8, 2012

CSW 2012 68

Some Observations• Without oversight, providers are not

accountable– Regulation might help, but is not a

panacea

• Some consolation– TEEs complexity will lead to bugs

• TEE sploitz will happen.– TEE reversing may provide our only

insights into some of these devices– H/W attacks are also possible (by those

with skilz)

• Openmoko suddenly looks a lot more appealing.

March 8, 2012

CSW 2012 69

Parting Thoughts

• Matrix Preloaded?– TEE provides ability to bare-metal virtualize

Application OS (AOS)– From safety of TEE, “agent” can monitor/modify AOS– Naïve implementations will not be “aware” of agent– With UEFI, this extends to the PC – Quis custodiet ipsos custodes?

• Red pill, please.

March 8, 2012