狠狠撸

Hanxiang Wen
C0RE Team 2017.06.03
Vulnerabilities In Android

About Me & C0RE Team
– Hanxiang Wen, 温瀚翔 (arnow117)
? Security researcher @ C0RE Team
? Focus on Android vulnerability research and exploit development
– C0RE Team
? A security-focused group started in mid-2015, with a recent focus on the
Android/Linux platform
? The team aims to discover zero-day vulnerabilities, develop proof-of-concept
and exploit
? 118 public CVEs for AOSP and Linux Kernel currently
? Android op researcher team for submitting high quality reports to
Google VRP.

Agenda
? Android Vulnerabilities Overview
? Common Vulnerabilities Type
? Some Examples
? AOSP
? Kernel
? How 2 Report
? More profit ?

Android Vulnerabilities Overview
Statistics by layer (2017/01-2017/05)

Common Vulnerabilities Type
? Heap/Stack Overflow (CVE-2017-0541)
? Integer Overflow (CVE-2017-0597)

? Type Confusion (CVE-2017-0546)
? NPD (Null Pointer Dereference) (CVE-2016-6765)

? TOCTOU (Time Of Check Time Of Use) (CVE-2017-0419)
? Missing Permission Check (CVE-2017-0490)

AOSP Vulnerabilities Overview
? Based on Vulnerabilities Position
? System services
? Frameworks libraries
? 3rd-party / Cross-platform libraries
? Vendor’s libraries
? Based on Trigger Path
? Local Binder IPC with privileged process
? Parsing file in privileged/unprivileged process

AOSP Vulnerabilities Overview
Statistics of remote problems in AOSP
(2017/01-2017/05)

Kernel Vulnerabilities Overview
? Based on vulnerabilities Position
? Subsystem (filesystem, network, memory)
? Drivers (Qualcomm, MediaTek, Nvidia)
? Based on Trigger Path
? Multiple file operations on a file descriptor which relates to a
device node.

Kernel Vulnerabilities Overview
Statistics of problems in Android Kernel
(2017/01-2017/05)

Binder
Looking into Source Code:
BpRefbase --- IInterface --- BBinder
Bpxxx --- Ixxx --- Bnxxx

? Elevation of Privilege Vulnerabilities in libstagefright
? Type: OOB (Out Of Boundary)
? Severity: High
CVE-2015-6620
Boom
!

? Elevation of privilege vulnerability in Realtek sound driver
? Type: UAF (Use After Free)
? Severity: High
CVE-2017-0444

? Heap/Stack Overflow (CVE-2017-0541)
? Integer Overflow (CVE-2017-0597)
? UAF (CVE-2017-0744)
? OOB (CVE-2015-6620)
? Type Confusion (CVE-2017-0546)
? TOCTOU (CVE-2017-0419)
? Missing Permission Check (CVE-2017-0490)
? NPD (CVE-2016-6765)

Crash Crash !
? Trigger Path
? POC/Exploit
? Internal Severity
? Target process
? Persistence of effect
? Crash logs on up-to-date device
? AOSP: logcat |grep “DEBUG”
? kernel: last_kmsg
? kernel: adb bugreport

How 2 Report
? Report Vulnerability
? Issue description
? Additional repro steps
? Crash dumps
? Attachment (buildable POC)
? Rewards Program
? Pixel and Pixel XL
? Pixel C
ASAP !!!
https://sites.google.com/site/bughunteruniversity/improve/ho
w-to-submit-an-android-platform-bug-report

Rating
Rating
Reduce
Rating
Reduce
Constrained
process
DOS
Arbitrary code
execution
Unprivileged
process
Remote
Unprivileged
process
Privileged
process
Trusted
Execution
Environment
Access data
Permission
bypass
Critical
High
Moderate
Low
TCB
Rating
Reduce
temporary
permanent
Vulnerability Severity

Rating
Rating
Reduce
Rating
Reduce
Constrained
process
Vulnerability Severity
https://source.android.com/security/overview/updates-resources
DOS
Arbitrary code
execution
Unprivileged
process
Remote
Unprivileged
process
Privileged
process
Trusted
Execution
Environment
Access data
Permission
bypass
Critical
High
Moderate
Low
TCB
Rating
Reduce
temporary
permanent

More Profit ?
https://www.google.com/about/appsecurity/android-rewards/
Severity Complete
Report* + PoC
Payment range (if report
includes an exploit leading to
Kernel compromise)**
Payment range (if report
includes an exploit leading to
TEE compromise)**
Critical Required Up to $150,000 Up to $200,000
High Required Up to $75,000 Up to $100,000
Moderate Required Up to $20,000 Up to $35,000
Low Required Up to $330 Up to $330
Severity Bug Report* + Proof of
concept + CTS + patch
Bug Report* + Proof of
concept + (CTS or patch)
Bug Report* + Proof of
concept
Critical $8,000 $7,000 $6,000
High $4,500 $3,500 $2,500
Moderate - - $1,000
Low - - $333
Patch and CTS tests submissions may qualify for a reward up to $1000 each

Security CTS
CTS (Compatibility Test Suite) :
?Path: cts/tests/tests/security
?Android's Code Style Guidelines
?AOSP's master branch
https://source.android.com/compatibility/cts/
~/$:make -j4 cts
~/$:out/host/linux-x86/bin/cts-tradefed
cts > run cts –m CtsSecurityTestCases -t android.security.cts.<YourTestCases>

CVE-2017-0564,CVE-2017-0483,CVE-2017-0526,CVE-2017-0527,CVE-2017-0333,CVE-2017-0479,CVE-2017-0480,
CVE-2016-2450,CVE-2016-2449,CVE-2016-2448,CVE-2016-2442,CVE-2016-2441,CVE-2016-2437,SVE-2016-5393,
CVE-2015-8089,CVE-2015-3869,CVE-2015-3868,CVE-2015-3865,CVE-2015-3862,CVE-2015-0573,CVE-2015-0568
Q&A
Thanks !

Response Speed
AOSP Kernel Vendors

狠狠撸

Android bug hunting from finding bugs to getting bounty 2017-06-03

More Related Content

Android bug hunting from finding bugs to getting bounty 2017-06-03

Editor's Notes