BROADPWN
Remotely Owning Android and iOS

Nitay Artensteinwhoami• Twitter: @nitayart• Reverse engineer andvulnerability researcher• Focusing on Android, WiFiand basebands

AGENDA• Are fully remote exploits still viable?
• How we found an attack surface suitable forremote exploitation• The story of a powerful WiFi bug, and how it

was leveraged into a fully remote exploit

REMOTE EXPLOIT != BROWSER EXPLOIT
If the victim has to click, it’s not a true remote“New secrets about torture ingovernment prisons”“Facebook alerts that attempts havebeen made to access your account”

THE THREE LAWS OF REMOTE EXPLOITSA REMOTE MAY NOT REQUIRE HUMAN INTERACTIONTO TRIGGER. LIMITED ATTACK SURFACEA REMOTE MAY NOT REQUIRE COMPLEXASSUMPTIONS ABOUT THE SYSTEM’S STATE.
IMPOSSIBLE WITH ASLRA REMOTE MUST LEAVE THE SYSTEM IN A STABLE
STATE. CRASHING == FAILURE

THE THREE LAWS OF REMOTE EXPLOITSA REMOTE MAY NOT REQUIRE HUMAN INTERACTION
TO TRIGGER. LIMITED ATTACK SURFACEA REMOTE MAY NOT REQUIRE COMPLEXASSUMPTIONS ABOUT THE SYSTEM’S STATE.
IMPOSSIBLE WITH ASLRA REMOTE MUST LEAVE THE SYSTEM IN A STABLE
STATE. CRASHING == FAILURE

NOT AN EASY TASKATTACKING ANDROID/IOSDEPASLR
PXN/PAN

Application
Processor

ATTACKING ANDROID/IOS
WiFi Chip

BasebandApplication
Processor

BASEBANDSiPhoneSamsung Galaxy and Note
Google Nexus
Some LGs and HTCsWIFI CONTROLLERS
iPhoneSamsung Galaxy and Note
Google Nexus
Some LGs and HTCsWIFI BONUS
Broadcom chips have no DEP or ASLR, and all
memory is RWX!!!

DIVING INTO THE WIFI SOC

PREVIOUS WORKS ABOUT BCM• Gal Beniamini of P0, “Exploiting Broadcom’s Wi-FiStack”• The Nexmon project by SEEMOO Labs
• “Wardriving from your Pocket”, Recon 2013 (OmriIldis, Yuval Ofir and Ruby Feinstein)• Andrés Blanco, “One Firmware to Monitor ‘em All”

THE BCM ARCHITECTURE

THE BCM ARCHITECTURE
RAMROM

900K

900K

ARM Cortex R4

BACKPLANE
D11 (PHY)

PCIeSDIO

Main processor

REVERSING THE BCM FIRMWARE• The firmware is loaded from the main OS, so it’s

stored in the filesystem (/etc/wifi/ on Samsungs)• Chip runs a proprietary RTOS known as HNDRTE• Fortunately, a large part of its source code

leaked online

github.com/elenril/VMG1312-B

FINDING THE RIGHT ATTACK SURFACE

Remember the First Law of Remotes?
A REMOTE MAY NOT REQUIREHUMAN INTERACTION TO TRIGGER

802.11: AN UNAUTHENTICATED ASSOCIATION PROCESS
Probe Request
Probe Response
Auth Open Seq (obsolete)
Association Request
Association Response
DATA - real auth (WPA2) comes here

802.11: AN UNAUTHENTICATED ASSOCIATION PROCESS
Probe Request
Probe Response
Auth Open Seq (obsolete)“Hey, are you
BOB_HOME?”Association Request
Association Response

DATA - real auth (WPA2) comes here

“Sure Iam!”802.11 ASSOCIATION SEQUENCE PACKETS
Basic Header
Frame Type Duration ID Addresses
2 Bytes

Basic Header

2 Bytes18 Bytes

Seq Cont.

Addr. 4

2 Bytes

6 Bytes

Information Elements, variable length802.11 INFORMATION ELEMENTS
TLVType

LengthData

1 Byte1 ByteVariable length

802.11 Packet
Basic Header

IE

IE

IE

FINDING THE CODE: FOLLOW THE MODULES

FINDING THE CODE: FOLLOW THE MODULES
void wlc_iem_add_parse_fn(iem_info *iem,
uint32 subtype_bitfield,
Frame typeuint32 iem_type,
IE Typecallback_fn_t fn,void *arg);

FINDING THE CODE: FOLLOW THE MODULES

THE BUGWIRELESS MEDIA EXTENSIONS (WME)• A Quality-of-Service extension to the 802.11

standard• Enables an AP to prioritize traffic of video, VoIP,etc.

• Protocol information is parsed from Information

Elements in Probe Request, Probe Response
and Association Response packets

WLC_BSS_PARSE_WME_IE
if ( frame_type == FC_ASSOC_RESP ) {...
if ( wlc->pub->_wme ){cfg->flags |= 0x100u;
memcpy(current_wmm_ie, ie->data, ie->len);DO WE HAVE AN OVERFLOW? CHECK THE ALLOC FUNC
wlc_bsscfg *wlc_bsscfg_malloc(wlc_info *wlc){...
pm = wlc_calloc(0x78);
wlc->pm = pm;
current_wmm_ie = wlc_calloc(0x2C);
wlc->current_wmm_ie = current_wmm_ie;

Max IE length: 255 bytes
Overflow: 211 bytes

IS THIS BUG REMOTELY EXPLOITABLE?

Remember the Second Law of Remotes?
A REMOTE MAY NOT REQUIRECOMPLEX ASSUMPTIONS ABOUTTHE SYSTEM’S STATEAN EXPLOITABLE REMOTE• What we don’t want: An overflow into dynamic

memory regions (we’ll need to makeassumptions about the program’s state)• What we do want: To overwrite a pointer in static

memory consistently and deterministically• And, the program needs to do something usefulwith the pointer we overwriteTHE OVERFLOW: MEMORY LAYOUT

Overflow
current_wmm_ie

psssidAllocated at startup (deterministic address)

THE OVERFLOWED STRUCT
typedef struct wlc_pm_st {uint8 PM;..
struct wl_timer *pspoll_timer;
struct wl_timer *apsd_trigger_timer;..
bool send_pspoll_after_tx;
wlc_hwtimer_to_t *pm2_rcv_timer;
wlc_hwtimer_to_t *pm2_ret_timer;} wlc_pm_st_t;

Timers allocated at startup with deterministic addressesUSING THE TIMER FOR A WRITE PRIMITIVE
int timer_func(struct wl_timer *t){...
v7 = t->field_18;...
v9 = t->field_1c;
v7->field_14 = v9;...
j_restore_cpsr(prev_cpsr);

Full write-what-whereWHERE SHALL WE WRITE?

PROBLEM: WHERE DO WE PUT OUR PAYLOAD?

Overflow
current_wmm_iepsssidOnly 24 bytes available for shellcode

THE PACKET RING BUFFER

packetpacketpacketpacketpacketpacketSpray with beacon probes - packets are RWX!!

24 BYTES - JUST ENOUGH FOR AN EGGHUNT!
void egghunt(uint arg) {uint *p = (uint *) RING_BUFFER_START;
void (*f)(uint);
loop:
p++;
if (*p != 0xc0deba5e)
goto loop;f = (void (*)(uint))(((uchar *) p) + 5);f(arg);
return;}EXPLOIT BUFFER - FINAL STRUCTURE

DON’T FORGET TO CLEAN UP

Remember the Third Law of Remotes?
A REMOTE MUST LEAVE THE
SYSTEM IN A STABLE STATE

THE NEXT STAGE: THE FIRST WIFI WORMBUILDING A WORM
• Hook the function which handles incomingpackets• Whenever a probe request comes in, start a fakeassociation process• Reach the association request phase, thendeliver the exploit (might need several attempts
to match the target firmware)

DEMOA NOTE ABOUT PRIVILEGE ESCALATION• This project does not include running code in the mainkernel• However, research by Project Zero shows that it ispossible to directly write to kernel memory using PCIe

• Also possible to intercept traffic from the chip, thenredirect the user to a malicious link (requires browser
exploit chain)QUESTIONS?