Rooting Every Android From extension to exploitation

More documents

Recommendations

Info

WEXT Attack Surface Analysis (cont.) • Ioctl can be issued on socket file descriptors • Ioctl command range: SIOCIWFIRST – SIOCIWLAST • Typical range 0x8B00 ~ 0x8BFF • Odd (quote) rule for get/set commands /* Odd : get (world access), even : set (root access) */ #define IW_IS_SET(cmd) (!((cmd) & 0x1)) #define IW_IS_GET(cmd) ((cmd) & 0x1) • Merely any other access control • Before Google starting to take action • “These wireless extensions are not magic : each driver has to provide support for them...” ——/include/uapi/linux/wireless.h
WEXT Attack Surface Analysis (cont.) sys_ioctl do_vfs_ioctl vfs_ioctl socket_file_ops Driver wireless_process_ioctl security_file_ioctl (LSM Hook) Selinux Policy #ifdef CONFIG_WEXT_CORE if (cmd >= SIOCIWFIRST && cmd = SIOCIWFIRST && cmd
Page 1 and 2: Rooting Every Android : From extens
Page 3 and 4: Agenda • Overview • Wi-Fi chips
Page 5: WEXT Attack Surface Analysis • Wi
Page 11 and 12: Wait a Minute! • Don’t we have
Page 13 and 14: How to Exploit • Data flow is ver
Page 17 and 18: Case study 2 - The overflow • No
Page 19 and 20: Case study 2 - Leaking the value
Page 23 and 24: Case study 3 - Discover the bug •
Page 25 and 26: First issue: Expose a surface for a
Page 27 and 28: Android-ID-24739315 • The patch i
Page 29 and 30: How to trigger • Unfortunately tw
Page 31 and 32: ATTACKER Binder IPC Binder thread o
Page 33 and 34: But how small the window is! • Fr
Page 35 and 36: Heap spraying by sendmmsg • Creat
Page 37 and 38: Happy rooting • Now you have kern
Page 39 and 40: Google’s latest mitigation • CV

Rooting Every Android From extension to exploitation

Create successful ePaper yourself

Delete template?

Save as template?