Deep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
No ratings
Presented at BlackHat Europe 2022 by
In the past few years, researchers have found hundreds of security vulnerabilities in the AOSP Bluetooth module such as Blueborne and BlueFrag. Almost all of these vulnerabilities are caused by the process not properly validating the remote user-supplied data, when parsing the Bluetooth request packet.In this context, in order to improve the security of Bluetooth, Google has adopted a variety of hardening methods:1. Validate the length of incoming Bluetooth packets.2. Implement a new and more secure AVRCP profile.3. Rewrite Bluetooth stack code-named "Gabeldorsche" in Rust.However, through some new approaches (focusing on the lifecycle of Bluetooth packet data and specific weak Bluetooth architectural logic), we still found a large number of security vulnerabilities hidden deep in the code.In this presentation, we will first introduce the Bluetooth protocol architecture in AOSP, and summarize the existing research results and known attack surfaces. Then, we will share new attack surfaces and several potentially vulnerable code patterns, which have never been discussed before. Next, we will show how to efficiently find the vulnerabilities by fuzzing and code auditing (based on CodeQL). With these ideas, we found 23 vulnerabilities in different Bluetooth profiles (l2cap, bnep, avrcp, gatt, sdp...) and obtained 8 CVEs for some critical or high risk vulnerabilities. The vulnerabilities can lead to serious consequences such as information disclosure, privilege escalation and remote code execution. Finally, we will explain the root causes of vulnerabilities through several real cases, and share our work in exploiting these vulnerabilities.