Wednesday, March 12, 2014

SamsungGalaxyBackdoor

This page contains a technical description of the back-door found in Samsung Galaxy devices.
For a general description of the issue, please refer to the statement published on the Free Software Foundation's website.

This back-door is present in most proprietary Android systems running on the affected Samsung Galaxy devices, including the ones that are shipped with the devices. However, when Replicant is installed on the device, this back-door is not effective: Replicant does not cooperate with back-doors.

Abstract

Samsung Galaxy devices running proprietary Android versions come with a back-door that provides remote access to the data stored on the device.
In particular, the proprietary software that is in charge of handling the communications with the modem, using the Samsung IPC protocol, implements a class of requests known as RFS commands, that allows the modem to perform remote I/O operations on the phone's storage. As the modem is running proprietary software, it is likely that it offers over-the-air remote control, that could then be used to issue the incriminated RFS messages and access the phone's file system.

Known affected devices

The following table shows which devices are known to contain this back-door as part of the software they ship with.
Please contact us if you know about some other device that could be concerned by this back-door or have more information on one of the listed devices!

DeviceIncriminated program running as rootSELinux enabledlibsamsung-ipc supportReplicant support
Nexus S (I902x)NoPossible with Android 4.2 and laterYesYes
Galaxy S (I9000)Yes?YesYes
Galaxy S 2 (I9100)No?YesYes
Galaxy Note (N7000)No?YesYes
Galaxy Nexus (I9250)NoPossible with Android 4.2 and laterYesYes
Galaxy Tab 2 7.0 (P31xx)No?YesYes
Galaxy Tab 2 10.1 (P51xx)No?YesYes
Galaxy S 3 (I9300)No?YesYes
Galaxy Note 2 (N7100)No?YesYes

Back-door sample

In order to investigate the back-door and check what it actually lets the modem do, some code was added to the modem kernel driver to make it craft and inject requests using the incriminated messages and check its results.

The following patch: 0001-modem_if-Inject-and-intercept-RFS-I-O-messages-to-pe.patch (to apply to the SMDK4412 Replicant 4.2 kernel) implements a sample use of the back-door that will:
  • open the /data/radio/test file
  • read its content
  • close the file

This demonstrates that the incriminated software will execute these operations upon modem request. Note that the software implementation appends /efs/root/ to the provided path, but it's fairly simple to escape that path and request any file on the file system (using ../../). Note that the files are opened with the incriminated software's user permissions, which may be root on some devices. On other cases, its runs as an unprivileged user that can still access the user's personal data (/sdcard). Finally, some devices may implement SELinux, which considerably restricts the scope of possible files that the modem can access, including the user's personal data (/sdcard/).

The following sample was obtained on a Galaxy Note 2 (N7100) running CyanogenMod 10.1.3.

Sample file

The sample file used for this demonstration (/data/radio/test) is filled with "Hello World!":

root@android:/ # hexdump -C /data/radio/test  00000000  48 65 6c 6c 6f 20 57 6f  72 6c 64 21 0a           |Hello World!.|  0000000d  

Kernel log

<3>[   62.712637] c0 mif: rx_iodev_skb: rx_iodev_skb: Dropping RFS frame  <3>[   62.712808] c0 mif: rfs_craft_start: rfs_craft_start: Crafting open  <3>[   62.712966] c0 mif: rfs_craft_start: rfs_craft_start: Adding SKB to queue  <3>[   62.713122] c0 mif: rx_iodev_skb: rx_iodev_skb: Dropping RFS frame  <3>[   62.744690] c0 mif: misc_write: misc_write: Intercepted RFS response  <3>[   62.744867] c0 mif: rfs_craft_write: rfs_craft_write: Open response: fd=21, errno=0  <3>[   62.745116] c0 mif: rfs_craft_write: rfs_craft_write: Adding SKB to queue  <3>[   62.792888] c0 mif: misc_write: misc_write: Intercepted RFS response  <3>[   62.793026] c0 mif: rfs_craft_write: rfs_craft_write: Read response: 12 bytes read  <3>[   62.793154] c0 mif: mif_print_data: 0000: 48 65 6c 6c  6f 20 57 6f  72 6c 64 21    <3>[   62.793284] c0 mif: rfs_craft_write: rfs_craft_write: Adding SKB to queue  <3>[   62.796168] c0 mif: misc_write: misc_write: Intercepted RFS response  <3>[   62.796269] c0 mif: rfs_craft_write: rfs_craft_write: Rx RFS message with command 0x6 and size 14  <3>[   62.796422] c0 mif: mif_print_data: 0000: 00 00 00 00  00 00 00 00    

The relevant part is the response to the read request:

<3>[   62.793026] c0 mif: rfs_craft_write: rfs_craft_write: Read response: 12 bytes read  <3>[   62.793154] c0 mif: mif_print_data: 0000: 48 65 6c 6c  6f 20 57 6f  72 6c 64 21    

which matches the content of the /data/radio/test file, hence making it obvious that the incriminated software implements the back-door.

Incriminated software log

E/RIL     ( 1927): processRFS: received standalone RFS frame. len 35  E/RIL     ( 1927): ipc_recv_rfs()  E/RIL     ( 1927): get_wakelock: 1. on 1, ril_WakeLock_Mask 0  E/RIL     ( 1927): get_wakelock: 2. on 1, ril_WakeLock_Mask 1  E/RIL     ( 1927): RxRFS_OpenFile:   E/RIL     ( 1927): RxRFS_OpenFile: open file "/efs/root/../../data/radio/test" flag O_RDWR (0x00000002)  E/RIL     ( 1927): check dir '/efs/root/../../data/radio'  E/RIL     ( 1927): A directory already exists.  E/RIL     ( 1927): RxRFS_OpenFile: length 14  E/RIL     ( 1927): TxRFS_CfrmOpenFile()  E/RIL     ( 1927): TxRFS_CfrmOpenFile(): length 14  E/RIL     ( 1927): IPC_send_singleRfsIPC: fd 16 sendto 14 bytes rfs_hdr =6  E/RIL     ( 1927): get_wakelock: 1. on 0, ril_WakeLock_Mask 1  E/RIL     ( 1927): get_wakelock: 2. on 0, ril_WakeLock_Mask 0  E/RIL     ( 1927): set_wakelock: secril_rfs-interface 0  E/RIL     ( 1927): set_wakelock: secril_fmt-interface 1  E/RIL     ( 1927): processIPC: Single IPC plen 23, pkt 23  
E/RIL     ( 1927): processRFS: received standalone RFS frame. len 14  E/RIL     ( 1927): ipc_recv_rfs()  E/RIL     ( 1927): get_wakelock: 1. on 1, ril_WakeLock_Mask 0  E/RIL     ( 1927): get_wakelock: 2. on 1, ril_WakeLock_Mask 1  E/RIL     ( 1927): RxRFS_ReadFile:   E/RIL     ( 1927): RxRFS_ReadFile: length 4110  E/RIL     ( 1927): TxRFS_CfrmReadFile()  E/RIL     ( 1927): TxRFS_CfrmReadFile(): length 4110  E/RIL     ( 1927): IPC_send_singleRfsIPC: fd 16 sendto 4110 bytes rfs_hdr =6  
E/RIL     ( 1927): processRFS: received standalone RFS frame. len 10  E/RIL     ( 1927): get_wakelock: 1. on 0, ril_WakeLock_Mask 1  E/RIL     ( 1927): get_wakelock: 2. on 0, ril_WakeLock_Mask 0  E/RIL     ( 1927): set_wakelock: secril_rfs-interface 0  E/RIL     ( 1927): [EVT]:Req(0), RX(0)  E/RIL     ( 1927): ipc_recv_rfs()  E/RIL     ( 1927): get_wakelock: 1. on 1, ril_WakeLock_Mask 0  E/RIL     ( 1927): get_wakelock: 2. on 1, ril_WakeLock_Mask 1  E/RIL     ( 1927): RxRFS_CloseFile:   E/RIL     ( 1927): RxRFS_CloseFile: length 14  E/RIL     ( 1927): TxRFS_CfrmCloseFile()  E/RIL     ( 1927): TxRFS_CfrmCloseFile(): length 14  E/RIL     ( 1927): IPC_send_singleRfsIPC: fd 16 sendto 14 bytes rfs_hdr =6  

Analysis

The following analysis was conducted using the libsec-ril.so binary file (the incriminated proprietary software) as extracted from the CyanogenMod 10.1.3 system zip for the Galaxy S 3 (I9300), from location system/lib/libsec-ril.so.

The developers involved in the present analysis did not ever agree to any sort of End User License Agreement that explicitly prohibited the reverse engineering and decompiling operations of the incriminated binary. The reverse engineering operations that led to these findings originally took place during the development of Samsung-RIL, the free software replacement for the incriminated program. Hence, we believe these operations were conducted for the sole purpose of interoperability and not with the intent of creating a competing product. As the involved developers were based in Europe, we believe the legality of these operations is granted by article 6 of the 1991 EU Computer Programs Directive.

As a first approach, using the strings tool against the incriminated program reveals numerous suspicious command names that appear to be Samsung IPC protocol definitions:

IPC_RFS_READ_FILE  IPC_RFS_WRITE_FILE  IPC_RFS_LSEEK_FILE  IPC_RFS_CLOSE_FILE  IPC_RFS_PUT_FILE  IPC_RFS_GET_FILE  IPC_RFS_RENAME_FILE  IPC_RFS_GET_FILE_INFO  IPC_RFS_UNLINK_FILE  IPC_RFS_MAKE_DIR  IPC_RFS_REMOVE_DIR  IPC_RFS_OPEN_DIR  IPC_RFS_READ_DIR  IPC_RFS_CLOSE_DIR  IPC_RFS_OPEN_FILE  IPC_RFS_FTRUNCATE_FILE  IPC_RFS_GET_HANDLE_INFO  IPC_RFS_CREATE_FILE  

The names of these commands make it obvious that they let the modem perform I/O operations.

The strings utility also reveals matching function names that seem to implement the handling of these commands:

RxRFS_GetFile  RxRFS_CreateFile  RxRFS_ReadDirectory  RxRFS_OpenDirectory  RxRFS_RenameFile  RxRFS_Default  RxRFS_OpenFile  RxRFS_ReadFile  RxRFS_FtruncateFile  RxRFS_WriteFile  RxRFS_GetFileInfoByHandle  RxRFS_GetFileInfo  RxRFS_PutFile  RxRFS_LseekFile  RxRFS_CloseFile  RxRFS_DeleteFile  RxRFS_MakeDirectory  RxRFS_CloseDirectory  RxRFS_RemoveDirectory  TxRFS_CfrmCreateFile  TxRFS_CfrmPutFile  TxRFS_CfrmOpenDirectory  TxRFS_CfrmGetFileInfo  TxRFS_CfrmReadDirectory  TxRFS_CfrmRenameFile  TxRFS_CfrmCloseFile  TxRFS_CfrmFtruncateFile  TxRFS_CfrmGetFileInfoByHandle  TxRFS_CfrmDeleteFile  TxRFS_CfrmCloseDirectory  TxRFS_CfrmRemoveDirectory  TxRFS_CfrmMakeDirectory  TxRFS_CfrmGetFile  TxRFS_CfrmReadFile  TxRFS_CfrmWriteFile  TxRFS_CfrmLseekFile  TxRFS_CfrmOpenFile  

Taking a closer look at these functions, using the objdump decompiler, reveals that they are actually called from the ipc_recv_rfs function, itself called fromprocess_ipc_notify_message, which appears to handle the received messages from the modem. Hence we can deduct that the incriminated functions are actually called upon modem request.

Taking a closer look at one of these functions, e.g. RxRFS_ReadFile reveals multiple calls to the Procedure Linkage Table (PLT). Hence we believe these calls are linked functions from the libc library, especially I/O-related functions such as (in a general manner) openclosereadwrite, etc.

Samsung IPC RFS messages

The following table associates each Samsung IPC RFS message with its hexadecimal command value:

MessageHexadecimal command value
IPC_RFS_NV_READ_ITEM0x01
IPC_RFS_NV_WRITE_ITEM0x02
IPC_RFS_READ_FILE0x03
IPC_RFS_WRITE_FILE0x04
IPC_RFS_LSEEK_FILE0x05
IPC_RFS_CLOSE_FILE0x06
IPC_RFS_PUT_FILE0x07
IPC_RFS_GET_FILE0x08
IPC_RFS_RENAME_FILE0x09
IPC_RFS_GET_FILE_INFO0x0a
IPC_RFS_UNLINK_FILE0x0b
IPC_RFS_MAKE_DIR0x0c
IPC_RFS_REMOVE_DIR0x0d
IPC_RFS_OPEN_DIR0x0e
IPC_RFS_READ_DIR0x0f
IPC_RFS_CLOSE_DIR0x10
IPC_RFS_OPEN_FILE0x11
IPC_RFS_FTRUNCATE_FILE0x12
IPC_RFS_GET_HANDLE_INFO0x13
IPC_RFS_CREATE_FILE0x14
IPC_RFS_NV_WRITE_ALL_ITEM0x15

Legitimacy

The incriminated RFS messages of the Samsung IPC protocol were not found to have any particular legitimacy nor relevant use-case. However, it is possible that these were added for legitimate purposes, without the intent of doing harm by providing a back-door. Nevertheless, the result is the same and it allows the modem to access the phone's storage.

However, some RFS messages of the Samsung IPC protocol are legitimate (IPC_RFS_NV_READ_ITEM and IPC_RFS_NV_WRITE_ITEM) as they target a very precise file, known as the modem's NV data. There should be no particular security concern about these as both the proprietary implementation and its free software replacement strictly limit actions to that particular file.

Areas of work

Some work could be done in order to handle that back-door:
  • Samsung-RIL could show a message alerting the user when the back-door is being used, including the requested path and asking the user to save logs and contact us.
  • Alternatively, the kernel could block the incriminated RFS requests and keep a trace of them in the logs for the record. That option would work for CyanogenMod, where the incriminated proprietary blob is still used.

Notes

Our free software replacement for the incriminated binary is Samsung-RIL which relies on libsamsung-ipc: both are used in Replicant.

The affected devices have modems that use the Samsung IPC protocol, mostly Intel XMM6160 and Intel XMM6260 modems. Note that despite this back-door, the devices using these modems are most likely to have good modem isolation, compared to other devices using Qualcomm platforms. Bear in mind that this back-door is implemented in software and can easily be removed by installing a free replacement for the incriminated software, for instance by installing Replicant. Hence, we don't consider the incriminated devices to be inherently bad targets because of this back-door.

0001-modem_if-Inject-and-intercept-RFS-I-O-messages-to-pe.patch (5.6 kB) Paul Kocialkowski, 02/04/2014 06:57 PM

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.