Conversation

Remember this thread? twitter.com/DanielMicay/st This exploit chain is a great example of what I was talking about there: defcon.org/html/defcon-27 blade.tencent.com/en/advisories/ Compare this to

@laginimaineb

's early research exploiting Broadcom Wi-Fi where the firmware had full control.

Quote Tweet

Daniel Micay

@DanielMicay

Jul 30, 2019

How does GrapheneOS defend against attacks on the cellular baseband, Wi-Fi baseband or other firmware / hardware? reddit.com/r/GrapheneOS/c By carefully choosing hardware targets since the OS is only part of what matters. OS mostly just needs to avoid screwing up IOMMU isolation.

Show this thread

Daniel Micay

@DanielMicay

Aug 6, 2019

They needed an exploit to compromise the Wi-Fi firmware, followed by a privilege escalation exploit to gain full control over the modem ("WLAN firmware is integrated into the Modem subsystem as an isolated userspace process") and then a kernel exploit to get control of the OS.

Daniel Micay

@DanielMicay

Additionally, take note of "multiple mitigations on Qualcomm baseband, including DEP, stack protection, heap cookie, system call constraint, etc.". This is not the case for most competing basebands. You get this isolation and hardening with a Qualcomm SoC, not so much elsewhere.

10:40 PM · Aug 6, 2019Twitter Web App

Replying to

and

Here's the kernel patch for the vulnerability used to break out of the modem isolation: android.googlesource.com/kernel/msm.git It's a perfect example of how kernel drivers need to avoid trusting hardware to maintain hardware-based isolation. Hard to come up with better examples for my thread.

Replying to

and

if SoftMAC( RING0 defense issue) not in case but FullMAC only being considered, the long exp chains should be like: Pwned SoC kernel( ThreadX or other RTOSes?)--> infoleak via DMA( identify kernsymbols)--> hijack the function by overwriting the code--> boom!

Replying to

and

thanks to

's previous research can leads us to figure the possible defense can be built against the attack path in each layer, e.g: RTOS: ???, HOST/SoC infoleak: restrict the access to *iomem while enabled SMMU to prevent infoleak

Show replies