Over the Air, Under the Radar: Attacking and Securing the Pixel Modem
No ratings
Presented at BlackHat USA 2023 by
To ensure Google Pixel devices are always at their most secure, the Android Red Team continuously attacks the riskiest areas of the phone. This allows us to proactively get ahead of bugs and protect the phone, before it's even shipped to users.The modem — or baseband — is a high risk, fundamental smartphone component because it accepts data from untrusted remote sources (over the air radio, cell tower, etc.). A vulnerability in the modem can lead to many kinds of remote compromises on a phone.Modem security is currently a hot topic of research, attracting growing interest from security researchers, both in the industry and in academia. This wasn't the case up until recently for a couple of reasons: most modem code is closed source, and testing it requires expensive hardware equipment. With some of these barriers being removed in recent years, due to the invention of software-defined radio (SDR) devices and public toolkits, the entry level into baseband security analysis has become more affordable. This talk will cover multiple baseband remote code execution vulnerabilities in Pixel modems that could be launched with a software radio from as far as 3 miles away. The talk will also demonstrate an over-the-air (OTA) remote code execution (RCE) targeting smartphones running the affected modem stack, allowing remote compromise of all impacted devices that fall into the range of a malicious cell tower. The team will showcase a proof of concept that demonstrates the ability to compromise devices via an SMS message or phone call with no user interaction required.The Android Red Team worked closely with both internal and external partners to secure the modem implementation for millions of devices by implementing additional hardening and security mitigations in the modem code, and also evangelized the development of a fuzzing program within the manufacturer's organization.