Jump to content

Firmware Risks: Difference between revisions

From postmarketOS Wiki
link to binwalk
Components: add links
Line 14: Line 14:
=== Bootloaders ===
=== Bootloaders ===
* [https://github.com/ucsb-seclab/BootStomp BootStomp] "a bootloader vulnerability finder" (also check the references at the bottom of README.md!)
* [https://github.com/ucsb-seclab/BootStomp BootStomp] "a bootloader vulnerability finder" (also check the references at the bottom of README.md!)
** [https://www.youtube.com/watch?v=ThXQ4oTowUQ 34c3 talk]


==== hboot (HTC) ====
==== hboot (HTC) ====
Line 20: Line 21:
* [https://github.com/unrevoked/hboot-tools hboot-tools]
* [https://github.com/unrevoked/hboot-tools hboot-tools]
* [https://github.com/andreiw/nexus9_demo Nexus 9: Low level boot process analysis and demo] ''nvtboot -> tos -> hboot -> demo code''
* [https://github.com/andreiw/nexus9_demo Nexus 9: Low level boot process analysis and demo] ''nvtboot -> tos -> hboot -> demo code''
==== sboot (Samsung) ====
* [https://hexdetective.blogspot.lt/2017/02/exploiting-android-s-boot-getting.html Arbitrary Code Exec in the Samsung Bootloader]
* [https://www.youtube.com/watch?v=JrsJvlij6V4 34c3 - eMMc hacking, or: how I fixed long-dead Galaxy S3]


=== Cellular modems ===
=== Cellular modems ===

Revision as of 05:30, 2 January 2018

There are closed source components (like firmware and bootloaders) in every phone, and they are dangerous. It seems next to impossible to replace them with open source components, and it won't be feasible any time soon for postmarketOS. Yet, this is an interesting topic, so this page provides links for deeper insight into the topic.

What can we do?

  • Document whether firmware is partially based on open source code and try to reverse engineer the proprietary bits, like @McBitter does for his Mediatek device!
  • Document which firmware components exist in your devices
  • Document which of these have known security issues
  • Learn more about the circumstances, in which the security bugs can be exploited. Example: Possibly an exploit in the wifi module can only be exploited, after we loaded the wifi firmware.
  • Use alternative components, that are plugged in via USB, and therefore do not have access to the device's memory
  • Connect to people who know more about this topic to get more help
  • Consider bricking insecure components through firmware security holes on purpose, just to make sure that they aren't a risk anymore.

Components

Bootloaders

  • BootStomp "a bootloader vulnerability finder" (also check the references at the bottom of README.md!)

hboot (HTC)

sboot (Samsung)

Cellular modems

Wi-Fi modems

Security risks

  • Coolreaper (PDF report), discovered in 2014, is a backdoor software that Coolpad (sixth larger manufacturer of smartphones in the world) operated and installed in their stock Android ROMs.

CoolReaper can perform the following tasks:

  • Download, install, or activate any Android application without user consent or notification
  • Clear user data, uninstall existing applications, or disable system applications
  • Notify users of a fake over-the-air (OTA) update that doesn’t update the device, but installs unwanted applications
  • Send or insert arbitrary SMS or MMS messages into the phone.
  • Dial arbitrary phone numbers
  • Upload information about device, its location, application usage, calling and SMS history to a Coolpad server

See also