Project

General

Profile

SamsungGalaxyBackdoor » History » Version 22

Paul Kocialkowski, 06/30/2015 05:53 PM

1 22 Paul Kocialkowski
h1. Samsung Galaxy back-door
2 1 Paul Kocialkowski
3 3 Paul Kocialkowski
This page contains a technical description of the back-door found in Samsung Galaxy devices.
4 20 Paul Kocialkowski
For a general description of the issue, please refer to the "statement published on the Free Software Foundation's website":http://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor.
5 1 Paul Kocialkowski
6
*This back-door is present in most proprietary Android systems running on the affected Samsung Galaxy devices, including the ones that are shipped with the devices. However, when Replicant is installed on the device, this back-door is not effective: Replicant does not cooperate with back-doors.*
7
8
h2. Abstract
9
10 9 Paul Kocialkowski
Samsung Galaxy devices running proprietary Android versions come with a back-door that provides remote access to the data stored on the device.
11
In particular, the proprietary software that is in charge of handling the communications with the modem, using the Samsung IPC protocol, implements a class of requests known as RFS commands, that allows the modem to perform remote I/O operations on the phone's storage. As the modem is running proprietary software, it is likely that it offers over-the-air remote control, that could then be used to issue the incriminated RFS messages and access the phone's file system.
12 1 Paul Kocialkowski
13 7 Paul Kocialkowski
h2. Known affected devices
14
15
The following table shows which devices are known to contain this back-door as part of the software they ship with.
16
Please contact us if you know about some other device that could be concerned by this back-door or have more information on one of the listed devices!
17
18
|_. Device |_. Incriminated program running as root |_. SELinux enabled |_. libsamsung-ipc support |_. Replicant support |
19
| Nexus S (I902x) | No | Possible with Android 4.2 and later | Yes | Yes |
20
| Galaxy S (I9000) | Yes | ? | Yes | Yes |
21
| Galaxy S 2 (I9100) | No | ? | Yes | Yes |
22
| Galaxy Note (N7000) | No | ? | Yes | Yes |
23 18 Paul Kocialkowski
| Galaxy Nexus (I9250) | No | Possible with Android 4.2 and later | Yes | Yes |
24 7 Paul Kocialkowski
| Galaxy Tab 2 7.0 (P31xx) | No | ? | Yes | Yes |
25
| Galaxy Tab 2 10.1 (P51xx) | No | ? | Yes | Yes |
26
| Galaxy S 3 (I9300) | No | ? | Yes | Yes |
27
| Galaxy Note 2 (N7100) | No | ? | Yes | Yes |
28
29 21 Paul Kocialkowski
While we don't have any absolute certainty regarding other Samsung Galaxy devices, it is likely that any other such device in its 3G flavor is affected by the back-door as well, as it probably uses the Samsung IPC protocol with the same proprietary user-space implementation.
30
31 12 Paul Kocialkowski
h2. Back-door sample
32 11 Paul Kocialkowski
33 1 Paul Kocialkowski
In order to investigate the back-door and check what it actually lets the modem do, some code was added to the modem kernel driver to make it craft and inject requests using the incriminated messages and check its results.
34 12 Paul Kocialkowski
35 15 Paul Kocialkowski
The following patch: attachment:0001-modem_if-Inject-and-intercept-RFS-I-O-messages-to-pe.patch (to apply to the SMDK4412 Replicant 4.2 kernel) implements a sample use of the back-door that will:
36 12 Paul Kocialkowski
* open the @/data/radio/test@ file
37
* read its content
38
* close the file
39
40
This demonstrates that the incriminated software will execute these operations upon modem request. Note that the software implementation appends @/efs/root/@ to the provided path, but it's fairly simple to escape that path and request any file on the file system (using @../../@). Note that the files are opened with the incriminated software's user permissions, which may be root on some devices. On other cases, its runs as an unprivileged user that can still access the user's personal data (@/sdcard@). Finally, some devices may implement SELinux, which considerably restricts the scope of possible files that the modem can access, including the user's personal data (@/sdcard/@).
41
42 16 Paul Kocialkowski
The following sample was obtained on a Galaxy Note 2 (N7100) running CyanogenMod 10.1.3.
43 12 Paul Kocialkowski
44
h3. Sample file
45
46
The sample file used for this demonstration (@/data/radio/test@) is filled with "Hello World!":
47
<pre>
48
root@android:/ # hexdump -C /data/radio/test
49
00000000  48 65 6c 6c 6f 20 57 6f  72 6c 64 21 0a           |Hello World!.|
50
0000000d
51
</pre>
52
53
h3. Kernel log
54
55
<pre>
56
<3>[   62.712637] c0 mif: rx_iodev_skb: rx_iodev_skb: Dropping RFS frame
57
<3>[   62.712808] c0 mif: rfs_craft_start: rfs_craft_start: Crafting open
58
<3>[   62.712966] c0 mif: rfs_craft_start: rfs_craft_start: Adding SKB to queue
59
<3>[   62.713122] c0 mif: rx_iodev_skb: rx_iodev_skb: Dropping RFS frame
60
<3>[   62.744690] c0 mif: misc_write: misc_write: Intercepted RFS response
61
<3>[   62.744867] c0 mif: rfs_craft_write: rfs_craft_write: Open response: fd=21, errno=0
62
<3>[   62.745116] c0 mif: rfs_craft_write: rfs_craft_write: Adding SKB to queue
63
<3>[   62.792888] c0 mif: misc_write: misc_write: Intercepted RFS response
64
<3>[   62.793026] c0 mif: rfs_craft_write: rfs_craft_write: Read response: 12 bytes read
65
<3>[   62.793154] c0 mif: mif_print_data: 0000: 48 65 6c 6c  6f 20 57 6f  72 6c 64 21  
66
<3>[   62.793284] c0 mif: rfs_craft_write: rfs_craft_write: Adding SKB to queue
67
<3>[   62.796168] c0 mif: misc_write: misc_write: Intercepted RFS response
68
<3>[   62.796269] c0 mif: rfs_craft_write: rfs_craft_write: Rx RFS message with command 0x6 and size 14
69
<3>[   62.796422] c0 mif: mif_print_data: 0000: 00 00 00 00  00 00 00 00  
70
</pre>
71
72
The relevant part is the response to the read request:
73
<pre>
74
<3>[   62.793026] c0 mif: rfs_craft_write: rfs_craft_write: Read response: 12 bytes read
75
<3>[   62.793154] c0 mif: mif_print_data: 0000: 48 65 6c 6c  6f 20 57 6f  72 6c 64 21  
76
</pre>
77
which matches the content of the @/data/radio/test@ file, hence making it obvious that the incriminated software implements the back-door.
78
79
h3. Incriminated software log
80
81
<pre>
82
E/RIL     ( 1927): processRFS: received standalone RFS frame. len 35
83
E/RIL     ( 1927): ipc_recv_rfs()
84
E/RIL     ( 1927): get_wakelock: 1. on 1, ril_WakeLock_Mask 0
85
E/RIL     ( 1927): get_wakelock: 2. on 1, ril_WakeLock_Mask 1
86
E/RIL     ( 1927): RxRFS_OpenFile: 
87
E/RIL     ( 1927): RxRFS_OpenFile: open file "/efs/root/../../data/radio/test" flag O_RDWR (0x00000002)
88
E/RIL     ( 1927): check dir '/efs/root/../../data/radio'
89
E/RIL     ( 1927): A directory already exists.
90
E/RIL     ( 1927): RxRFS_OpenFile: length 14
91
E/RIL     ( 1927): TxRFS_CfrmOpenFile()
92
E/RIL     ( 1927): TxRFS_CfrmOpenFile(): length 14
93
E/RIL     ( 1927): IPC_send_singleRfsIPC: fd 16 sendto 14 bytes rfs_hdr =6
94
E/RIL     ( 1927): get_wakelock: 1. on 0, ril_WakeLock_Mask 1
95
E/RIL     ( 1927): get_wakelock: 2. on 0, ril_WakeLock_Mask 0
96
E/RIL     ( 1927): set_wakelock: secril_rfs-interface 0
97
E/RIL     ( 1927): set_wakelock: secril_fmt-interface 1
98
E/RIL     ( 1927): processIPC: Single IPC plen 23, pkt 23
99
</pre>
100
101
<pre>
102
E/RIL     ( 1927): processRFS: received standalone RFS frame. len 14
103
E/RIL     ( 1927): ipc_recv_rfs()
104
E/RIL     ( 1927): get_wakelock: 1. on 1, ril_WakeLock_Mask 0
105
E/RIL     ( 1927): get_wakelock: 2. on 1, ril_WakeLock_Mask 1
106
E/RIL     ( 1927): RxRFS_ReadFile: 
107
E/RIL     ( 1927): RxRFS_ReadFile: length 4110
108
E/RIL     ( 1927): TxRFS_CfrmReadFile()
109
E/RIL     ( 1927): TxRFS_CfrmReadFile(): length 4110
110
E/RIL     ( 1927): IPC_send_singleRfsIPC: fd 16 sendto 4110 bytes rfs_hdr =6
111
</pre>
112
113
<pre>
114
E/RIL     ( 1927): processRFS: received standalone RFS frame. len 10
115
E/RIL     ( 1927): get_wakelock: 1. on 0, ril_WakeLock_Mask 1
116
E/RIL     ( 1927): get_wakelock: 2. on 0, ril_WakeLock_Mask 0
117
E/RIL     ( 1927): set_wakelock: secril_rfs-interface 0
118
E/RIL     ( 1927): [EVT]:Req(0), RX(0)
119
E/RIL     ( 1927): ipc_recv_rfs()
120
E/RIL     ( 1927): get_wakelock: 1. on 1, ril_WakeLock_Mask 0
121
E/RIL     ( 1927): get_wakelock: 2. on 1, ril_WakeLock_Mask 1
122
E/RIL     ( 1927): RxRFS_CloseFile: 
123
E/RIL     ( 1927): RxRFS_CloseFile: length 14
124
E/RIL     ( 1927): TxRFS_CfrmCloseFile()
125
E/RIL     ( 1927): TxRFS_CfrmCloseFile(): length 14
126
E/RIL     ( 1927): IPC_send_singleRfsIPC: fd 16 sendto 14 bytes rfs_hdr =6
127
</pre>
128 11 Paul Kocialkowski
129 1 Paul Kocialkowski
h2. Analysis
130
131 2 Paul Kocialkowski
The following analysis was conducted using the @libsec-ril.so@ binary file (the incriminated proprietary software) as extracted from the CyanogenMod 10.1.3 system zip for the Galaxy S 3 (I9300), from location @system/lib/libsec-ril.so@.
132
133 9 Paul Kocialkowski
*The developers involved in the present analysis did not ever agree to any sort of End User License Agreement that explicitly prohibited the reverse engineering and decompiling operations of the incriminated binary. The reverse engineering operations that led to these findings originally took place during the development of [[Samsung-RIL]], the free software replacement for the incriminated program. Hence, we believe these operations were conducted for the sole purpose of interoperability and not with the intent of creating a competing product. As the involved developers were based in Europe, we believe the legality of these operations is granted by article 6 of the 1991 EU Computer Programs Directive.*
134 1 Paul Kocialkowski
135 6 Paul Kocialkowski
As a first approach, using the @strings@ tool against the incriminated program reveals numerous suspicious command names that appear to be Samsung IPC protocol definitions:
136
<pre>
137
IPC_RFS_READ_FILE
138
IPC_RFS_WRITE_FILE
139
IPC_RFS_LSEEK_FILE
140
IPC_RFS_CLOSE_FILE
141
IPC_RFS_PUT_FILE
142
IPC_RFS_GET_FILE
143
IPC_RFS_RENAME_FILE
144
IPC_RFS_GET_FILE_INFO
145
IPC_RFS_UNLINK_FILE
146
IPC_RFS_MAKE_DIR
147
IPC_RFS_REMOVE_DIR
148
IPC_RFS_OPEN_DIR
149
IPC_RFS_READ_DIR
150
IPC_RFS_CLOSE_DIR
151
IPC_RFS_OPEN_FILE
152
IPC_RFS_FTRUNCATE_FILE
153
IPC_RFS_GET_HANDLE_INFO
154
IPC_RFS_CREATE_FILE
155
</pre>
156 4 Paul Kocialkowski
157 6 Paul Kocialkowski
The names of these commands make it obvious that they let the modem perform I/O operations.
158 1 Paul Kocialkowski
159 6 Paul Kocialkowski
The @strings@ utility also reveals matching function names that seem to implement the handling of these commands:
160
<pre>
161
RxRFS_GetFile
162
RxRFS_CreateFile
163
RxRFS_ReadDirectory
164
RxRFS_OpenDirectory
165
RxRFS_RenameFile
166
RxRFS_Default
167
RxRFS_OpenFile
168
RxRFS_ReadFile
169
RxRFS_FtruncateFile
170
RxRFS_WriteFile
171
RxRFS_GetFileInfoByHandle
172
RxRFS_GetFileInfo
173
RxRFS_PutFile
174
RxRFS_LseekFile
175
RxRFS_CloseFile
176
RxRFS_DeleteFile
177
RxRFS_MakeDirectory
178
RxRFS_CloseDirectory
179
RxRFS_RemoveDirectory
180
TxRFS_CfrmCreateFile
181
TxRFS_CfrmPutFile
182
TxRFS_CfrmOpenDirectory
183
TxRFS_CfrmGetFileInfo
184
TxRFS_CfrmReadDirectory
185
TxRFS_CfrmRenameFile
186
TxRFS_CfrmCloseFile
187
TxRFS_CfrmFtruncateFile
188
TxRFS_CfrmGetFileInfoByHandle
189
TxRFS_CfrmDeleteFile
190
TxRFS_CfrmCloseDirectory
191
TxRFS_CfrmRemoveDirectory
192
TxRFS_CfrmMakeDirectory
193
TxRFS_CfrmGetFile
194
TxRFS_CfrmReadFile
195 1 Paul Kocialkowski
TxRFS_CfrmWriteFile
196 6 Paul Kocialkowski
TxRFS_CfrmLseekFile
197 7 Paul Kocialkowski
TxRFS_CfrmOpenFile
198
</pre>
199
200 9 Paul Kocialkowski
Taking a closer look at these functions, using the @objdump@ decompiler, reveals that they are actually called from the @ipc_recv_rfs@ function, itself called from @process_ipc_notify_message@, which appears to handle the received messages from the modem. Hence we can deduct that the incriminated functions are actually called upon modem request.
201 7 Paul Kocialkowski
202 9 Paul Kocialkowski
Taking a closer look at one of these functions, e.g. RxRFS_ReadFile reveals multiple calls to the Procedure Linkage Table (PLT). Hence we believe these calls are linked functions from the libc library, especially I/O-related functions such as (in a general manner) @open@, @close@, @read@, @write@, etc.
203 7 Paul Kocialkowski
204 10 Paul Kocialkowski
h2. Samsung IPC RFS messages
205 7 Paul Kocialkowski
206 10 Paul Kocialkowski
The following table associates each Samsung IPC RFS message with its hexadecimal command value:
207 1 Paul Kocialkowski
208 10 Paul Kocialkowski
|_. Message |_. Hexadecimal command value |
209
| IPC_RFS_NV_READ_ITEM | 0x01 |
210
| IPC_RFS_NV_WRITE_ITEM | 0x02 |
211
| IPC_RFS_READ_FILE | 0x03 |
212
| IPC_RFS_WRITE_FILE | 0x04 |
213
| IPC_RFS_LSEEK_FILE | 0x05 |
214
| IPC_RFS_CLOSE_FILE | 0x06 |
215
| IPC_RFS_PUT_FILE | 0x07 |
216
| IPC_RFS_GET_FILE | 0x08 |
217
| IPC_RFS_RENAME_FILE | 0x09 |
218
| IPC_RFS_GET_FILE_INFO | 0x0a |
219
| IPC_RFS_UNLINK_FILE | 0x0b |
220
| IPC_RFS_MAKE_DIR | 0x0c |
221
| IPC_RFS_REMOVE_DIR | 0x0d |
222
| IPC_RFS_OPEN_DIR | 0x0e |
223
| IPC_RFS_READ_DIR | 0x0f |
224
| IPC_RFS_CLOSE_DIR | 0x10 |
225
| IPC_RFS_OPEN_FILE | 0x11 |
226
| IPC_RFS_FTRUNCATE_FILE | 0x12 |
227
| IPC_RFS_GET_HANDLE_INFO | 0x13 |
228
| IPC_RFS_CREATE_FILE | 0x14 |
229
| IPC_RFS_NV_WRITE_ALL_ITEM | 0x15 |
230
231
h2. Legitimacy
232
233
The incriminated RFS messages of the Samsung IPC protocol were not found to have any particular legitimacy nor relevant use-case. However, it is possible that these were added for legitimate purposes, without the intent of doing harm by providing a back-door. Nevertheless, the result is the same and it allows the modem to access the phone's storage.
234
235
However, some RFS messages of the Samsung IPC protocol are legitimate (IPC_RFS_NV_READ_ITEM and IPC_RFS_NV_WRITE_ITEM) as they target a very precise file, known as the modem's NV data. There should be no particular security concern about these as both the proprietary implementation and its free software replacement strictly limit actions to that particular file.
236
237 14 Paul Kocialkowski
h2. Areas of work
238
239
Some work could be done in order to handle that back-door:
240
* [[Samsung-RIL]] could show a message alerting the user when the back-door is being used, including the requested path and asking the user to save logs and contact us.
241
* Alternatively, the kernel could block the incriminated RFS requests and keep a trace of them in the logs for the record. That option would work for CyanogenMod, where the incriminated proprietary blob is still used.
242
243 1 Paul Kocialkowski
h2. Notes
244
245 13 Paul Kocialkowski
Our free software replacement for the incriminated binary is [[Samsung-RIL]] which relies on [[Libsamsung-ipc|libsamsung-ipc]]: both are used in Replicant.
246 1 Paul Kocialkowski
247 10 Paul Kocialkowski
The affected devices have modems that use the Samsung IPC protocol, mostly Intel XMM6160 and Intel XMM6260 modems. Note that despite this back-door, the devices using these modems are most likely to have good modem isolation, compared to other devices using Qualcomm platforms. Bear in mind that this back-door is implemented in software and can easily be removed by installing a free replacement for the incriminated software, for instance by installing Replicant. Hence, we don't consider the incriminated devices to be inherently bad targets because of this back-door.