kernel hacker - Online Cyber Security News

Kernel Backdoor found in Gadgets Powered by Popular Chinese ARM Maker

Wednesday, May 11, 2016 Mohit Kumar

How to Hack an Android device?

It is possibly one of the most frequently asked questions on the Internet.

Although it's not pretty simple to hack Android devices and gadgets, sometimes you just get lucky to find a backdoor access.

Thanks to Allwinner, a Chinese ARM system-on-a-chip maker, which has recently been caught shipping a version of Linux Kernel with an incredibly simple and easy-to-use built-in backdoor.

Chinese fabless semiconductor company Allwinner is a leading supplier of application processors that are used in many low-cost Android tablets, ARM-based PCs, set-top boxes, and other electronic devices worldwide.

Simple Backdoor Exploit to Hack Android Devices

All you need to do to gain root access of an affected Android device is…

Send the text "rootmydevice" to any undocumented debugging process.

The local privileges escalation backdoor code for debugging ARM-powered Android devices managed to make its way in shipped firmware after firmware makers wrote their own kernel code underneath a custom Android build for their devices, though the mainstream kernel source is unaffected.

The backdoor code is believed to have been left by mistake by the authors after completing the debugging process.

For exploiting this issue, any process running with any UID can be converted into root easily by simply using the following command:

echo "rootmydevice" > /proc/sunxi_debug/sunxi_debug

The Linux 3.4-sunxi kernel was originally designed to support the Android operating system on Allwinner ARM for tablets, but later it was used to port Linux to many Allwinner processors on boards like Banana Pi micro-PCs, Orange Pi, and other devices.

At the forum of the Armbian operating system, a moderator who goes by the name Tkaiser noted that the backdoor code could remotely be exploitable "if combined with networked services that might allow access to /proc."

This security hole is currently present in every operating system image for A83T, H3 or H8 devices that rely on kernel 3.4, he added.

This blunder made by the company has been frustrating to many developers. Allwinner has also been less transparent about the backdoor code. David Manouchehri released the information about the backdoor through its own Github account (Pastebin) and then apparently deleted it.

More than a Billion Snapdragon-based Android Phones Vulnerable to Hacking

Wednesday, March 16, 2016 Mohit Kumar

More than a Billion of Android devices are at risk of a severe vulnerability in Qualcomm Snapdragon chip that could be exploited by any malicious application to gain root access on the device.

Security experts at Trend Micro are warning Android users of some severe programming blunders in Qualcomm's kernel-level Snapdragon code that if exploited, can be used by attackers for gaining root access and taking full control of your device.

Gaining root access on a device is a matter of concern, as it grants attackers access to admin level capabilities, allowing them to turn your device against you to snap your pictures, and snoop on your personal data including accounts’ passwords, emails, messages and photos.

The company’s own website notes that Qualcomm Snapdragon SoCs (systems on a chip) power more than a Billion smart devices, including many Internet of Things (IoTs) as of today. Thus, the issue puts many people at risk of being attacked.

Although Google has pushed out updates after Trend Micro privately reported the issues that now prevents attackers from gaining root access with a specially crafted app, users will not be getting updates anytime soon.

The security update rolls out to your device through a long chain:

Qualcomm → Google → Your device's manufacturer → Your network carrier → Your handheld over the air

"Given that many of these devices are either no longer being patched or never received any patches in the first place," said Trend engineer Wish Wu, "they would essentially be left in an insecure state without any patch forthcoming."

Unfortunately, what’s more concerning is the fact that the same vulnerable chips are used in a large number of IoT devices, which are no longer in line for security updates. This makes it possible for hackers to gain root access to these connected devices, which is more worrying.

"Smartphones aren't the only problem here," said Trend's Noah Gamer. "Qualcomm also sells their SoCs to vendors producing devices considered part of the Internet of Things, meaning these gadgets are just as at risk."

"If IoT is going to be as widespread as many experts predict, there needs to be some sort of system in place ensuring these devices are safe for public use. Security updates are an absolute necessity these days, and users of these connected devices need to know what they're dealing with."

Whatever be the reason: if security patches are not available for your device model or take too long to arrive, in both the cases it gives miscreants time to exploit the security holes to gain control of your device.

However, some users are lucky to choose Google’s handsets that get their patches direct from the tech giant automatically, making them safe from the vulnerabilities. The handsets include Nexus 5X, Nexus 6P, Nexus 6, Nexus 5, Nexus 4, Nexus 7, Nexus 9, and Nexus 10.

All of the smart devices using the Qualcomm Snapdragon 800 series, including the 800, 805 and 810 and running a 3.10-version kernel are affected by the vulnerabilities.

The vulnerable code is present in Android version 4 to version 6. In the tests, researchers found Nexus 5, 6 and 6P, and Samsung Galaxy Note Edge using vulnerable versions of Qualy's code.

Though the researchers do not have access to every Android handset and tablet to test, the list of vulnerable devices is non-exhaustive.

Since the researchers have not disclosed full details about the flaws, the short brief about the vulnerabilities is as follows:

1. Qualcomm-related flaw (CVE-2016-0819): The vulnerability has been described by the researchers as a logic bug that allows a small section of kernel memory to be tampered with after it is freed, causing an information leakage and a Use After Free issue in Android.

2. The flaw (CVE-2016-0805) is in Qualcomm chipset kernel function get_krait_evtinfo: The get_krait_evtinfo function returns an index into an array used by other kernel functions. With the help of carefully crafted input data, it is possible to generate a malicious index, leading to a buffer overflow.

3. Gaining root access: Using both the flaws together on vulnerable devices, attackers can gain root access on the device.

The researchers will disclose the full details of exactly how to leverage the bugs at the upcoming Hack In The Box security conference in the Netherlands to be held in late May 2016.

Zero-Day Flaw Found in 'Linux Kernel' leaves Millions Vulnerable

Tuesday, January 19, 2016 Mohit Kumar

A new critical zero-day vulnerability has been discovered in the Linux kernel that could allow attackers to gain root level privileges by running a malicious Android or Linux application on an affected device.

The critical Linux kernel flaw (CVE-2016-0728) has been identified by a group of researchers at a startup named Perception Point.

The vulnerability was present in the code since 2012, and affects any operating system with Linux kernel 3.8 and higher, so there are probably tens of millions of computers, both 32-bit and 64-bit, exposed to this flaw.

However, the most bothersome part is that the problem affects Android versions KitKat and higher, which means about 66 percent of all Android devices are also exposed to the serious Linux kernel flaw.

Impact of the Zero-Day Vulnerability

An attacker would only require local access to exploit the flaw on a Linux server.

If successfully exploited, the vulnerability can allow attackers to get root access to the operating system, enabling them to delete files, view private information, and install malicious apps.

"It's pretty bad because a user with legitimate or lower privileges can gain root access and compromise the whole machine," Yevgeny Pats, co-founder and CEO at security vendor Perception Point, said in a blog post published today.
"With no auto update for the kernel, these versions could be vulnerable for a long time. Every Linux server needs to be patched as soon the patch is out."

Usually, flaws in Linux kernel are patched as soon as they are found; therefore, Linux-based operating systems are considered to be more secure than others. However, zero-day vulnerability recently discovered in the Linux kernel made its way for almost 3 years.

The Cause of the Critical Linux Kernel Vulnerability

The vulnerability is actually the result of a Reference Leak in the keyrings facility built into various flavors of Linux. The keyrings facility is primarily a way to encrypt and store login data, encryption keys and certificates, and then make them available to applications.

However, a reference leak could be abused by attackers to ultimately execute arbitrary code in the Linux kernel.

So far, the researchers said, no exploits have been discovered in the wild that take advantage of this vulnerability.

Perception Point has provided a technical analysis of the vulnerability and how one can exploit it, including proof-of-concept (PoC) exploit code published on its Github page.

Patch Expected to Roll Out Soon

The good news is that Perception Point has already reported the flaw to the Linux team, and patches are expected to roll out today to devices with automatic updates.

However, it may take a little longer on Android devices to receive the patch, given the fact that most updates aren’t pushed automatically by manufacturers and carriers.

How Patch Linux Kernel Vulnerability (CVE-2016-0728)

Type following commands as per your Linux distro:

Debian or Ubuntu Linux: sudo apt-get update && sudo apt-get upgrade
RHEL / CentOS Linux: sudo yum update

UPDATE — Kernel bug Not A Big Deal for Android Users

Now, Google has claimed, as expected, that Perception Point claims – about 66 percent of all Android devices are also exposed to the serious Linux kernel flaw – are not entirely accurate.

According to the search engine giant, the number of Android devices affected by this zero-day flaw is significantly smaller than initially reported by Perception Point.

"We believe that no Nexus devices are vulnerable to exploitation by 3rd party applications. Further, devices with Android 5.0 and above are protected, as the Android SELinux policy prevents 3rd party applications from reaching the affected code," said Adrian Ludwig, Android's lead security engineer.

"Also, many devices running Android 4.4 and earlier do not contain the vulnerable code introduced in Linux kernel 3.8, as those newer kernel versions not common on older Android devices."

The company also added that it has prepared a patch that has already been released to open source and provided to partners, and that "the patch will be required on all devices with a security patch level of March 1, 2016, or greater."