Jump to content

Firmware Risks: Difference between revisions

From postmarketOS Wiki
link to binwalk
Andi (talk | contribs)
brcm link to outdated firmware is from 2017, there were updates even for old devices in 2021, so things are probably not tha out of date
 
(7 intermediate revisions by 5 users not shown)
Line 1: Line 1:
There are closed source components (like firmware and bootloaders) in every phone, and [https://ollieparanoid.github.io/post/security-warning/ they are dangerous]. It seems next to impossible to replace them with open source components, and it won't be feasible any time soon for postmarketOS. Yet, this is an interesting topic, so this page provides links for deeper insight into the topic.
There are closed source components (like firmware and bootloaders) in every phone, and [https://ollieparanoid.github.io/post/security-warning/ they are dangerous]. It seems next to impossible to replace them with open source components, and it won't be feasible any time soon for postmarketOS. Yet, this is an interesting topic, so this page provides links for deeper insight into the topic. For packaging instructions, see [[Device_specific_package#Proprietary_firmware_or_userland_blobs]]


== What can we do? ==
== What can we do? ==
* '''Binary patch security holes in firmware''' (e.g. with [https://github.com/seemoo-lab/nexmon nexmon]). This seems to be the best approach we have since there won't be open firmware for all these components any time soon.
* Document whether firmware is partially based on open source code and try to reverse engineer the proprietary bits, like @McBitter does for his [[Mediatek]] device!
* Document whether firmware is partially based on open source code and try to reverse engineer the proprietary bits, like @McBitter does for his [[Mediatek]] device!
* Document which firmware components exist in your devices
* Document which firmware components exist in your devices
Line 14: Line 15:
=== Bootloaders ===
=== Bootloaders ===
* [https://github.com/ucsb-seclab/BootStomp BootStomp] "a bootloader vulnerability finder" (also check the references at the bottom of README.md!)
* [https://github.com/ucsb-seclab/BootStomp BootStomp] "a bootloader vulnerability finder" (also check the references at the bottom of README.md!)
** [https://www.youtube.com/watch?v=ThXQ4oTowUQ 34c3 talk]


==== hboot (HTC) ====
==== hboot (HTC) ====
Line 20: Line 22:
* [https://github.com/unrevoked/hboot-tools hboot-tools]
* [https://github.com/unrevoked/hboot-tools hboot-tools]
* [https://github.com/andreiw/nexus9_demo Nexus 9: Low level boot process analysis and demo] ''nvtboot -> tos -> hboot -> demo code''
* [https://github.com/andreiw/nexus9_demo Nexus 9: Low level boot process analysis and demo] ''nvtboot -> tos -> hboot -> demo code''
==== sboot (Samsung) ====
* [https://hexdetective.blogspot.lt/2017/02/exploiting-android-s-boot-getting.html Arbitrary Code Exec in the Samsung Bootloader]
* [https://www.youtube.com/watch?v=OY7OlY0OW2Q 34c3 - eMMc hacking, or: how I fixed long-dead Galaxy S3]


=== Cellular modems ===
=== Cellular modems ===
Line 26: Line 32:


=== Wi-Fi modems ===
=== Wi-Fi modems ===
 
* [https://www.blackhat.com/us-17/briefings.html#broadpwn-remotely-compromising-android-and-ios-via-a-bug-in-broadcoms-wi-fi-chipsets Broadpwn: Remotely Compromising Android and iOS via a Bug in Broadcom's Wi-Fi Chipsets] <small>(note: [http://boosterok.com/blog/broadpwn/ doesn't affect] necessarily older firmware/chips versions)</small>
* [https://www.blackhat.com/us-17/briefings.html#broadpwn-remotely-compromising-android-and-ios-via-a-bug-in-broadcoms-wi-fi-chipsets Broadpwn: Remotely Compromising Android and iOS via a Bug in Broadcom's Wi-Fi Chipsets]
* [https://github.com/seemoo-lab/nexmon nexmon]: "Firmware Patching Framework for Broadcom/Cypress WiFi Chips that enables Monitor Mode, Frame Injection and much more"
* [https://github.com/seemoo-lab/nexmon nexmon]: "Firmware Patching Framework for Broadcom/Cypress WiFi Chips that enables Monitor Mode, Frame Injection and much more"
* Please be careful "mainline" linux-firmware brcm blobs might be [https://bugzilla.kernel.org/show_bug.cgi?id=196541 outdated]. These files often link to cypress (cyfw) files since 2021. E.g. CVE-2019-15126 is fixed nowadays. Make sure to check [https://android.googlesource.com/platform/hardware/broadcom/wlan/+/master/bcmdhd/firmware Google's tree] if handling such hardware.


== Security risks ==
== Security risks ==
Line 45: Line 51:
== See also ==
== See also ==
* [https://github.com/ReFirmLabs/binwalk binwalk (firmware analysis tool)]
* [https://github.com/ReFirmLabs/binwalk binwalk (firmware analysis tool)]
[[Category:Technical Reference]]

Latest revision as of 19:47, 17 January 2023

There are closed source components (like firmware and bootloaders) in every phone, and they are dangerous. It seems next to impossible to replace them with open source components, and it won't be feasible any time soon for postmarketOS. Yet, this is an interesting topic, so this page provides links for deeper insight into the topic. For packaging instructions, see Device_specific_package#Proprietary_firmware_or_userland_blobs

What can we do?

  • Binary patch security holes in firmware (e.g. with nexmon). This seems to be the best approach we have since there won't be open firmware for all these components any time soon.
  • Document whether firmware is partially based on open source code and try to reverse engineer the proprietary bits, like @McBitter does for his Mediatek device!
  • Document which firmware components exist in your devices
  • Document which of these have known security issues
  • Learn more about the circumstances, in which the security bugs can be exploited. Example: Possibly an exploit in the wifi module can only be exploited, after we loaded the wifi firmware.
  • Use alternative components, that are plugged in via USB, and therefore do not have access to the device's memory
  • Connect to people who know more about this topic to get more help
  • Consider bricking insecure components through firmware security holes on purpose, just to make sure that they aren't a risk anymore.

Components

Bootloaders

  • BootStomp "a bootloader vulnerability finder" (also check the references at the bottom of README.md!)

hboot (HTC)

sboot (Samsung)

Cellular modems

Wi-Fi modems

Security risks

  • Coolreaper (PDF report), discovered in 2014, is a backdoor software that Coolpad (sixth larger manufacturer of smartphones in the world) operated and installed in their stock Android ROMs.

CoolReaper can perform the following tasks:

  • Download, install, or activate any Android application without user consent or notification
  • Clear user data, uninstall existing applications, or disable system applications
  • Notify users of a fake over-the-air (OTA) update that doesn’t update the device, but installs unwanted applications
  • Send or insert arbitrary SMS or MMS messages into the phone.
  • Dial arbitrary phone numbers
  • Upload information about device, its location, application usage, calling and SMS history to a Coolpad server

See also