Exploiting Qualcomm WLAN and Modem Over The Air

Presented at DEF CON 27 (2019), Aug. 11, 2019, 11 a.m. (45 minutes).

In this talk, we will share our research in which we successfully exploit Qualcomm WLAN in FIRMWARE layer, break down the isolation between WLAN and Modem and then fully control the Modem over the air. Setup the real-time debugger is the key. Without the debugger, it's difficult to inspect the program flow and runtime status. On Qualcomm platform, subsystems are protected by the Secure Boot and unable to be touched externally. We'll introduce the vulnerability we found in Modem to defeat the Secure Boot and elevate privilege into Modem locally so that we can setup the live debugger for baseband. The Modem and WLAN firmware is quite complex and reverse engineering is a tough work. Thanks to the debugger, we finally figure out the system architecture, the components, the program flow, the data flow, and the attack surfaces of WLAN firmware. We'll share these techniques in detail, along with the zero-days we found on the attack surfaces. There are multiple mitigations on Qualcomm baseband, including DEP, stack protection, heap cookie, system call constraint, etc. All the details of the exploitation and mitigation bypassing techniques will be given during the presentation. Starting from Snapdragon 835, WLAN firmware is integrated into the Modem subsystem as an isolated userspace process. We'll discuss these constraints, and then leverage the weakness we found to fully exploit into Modem.

Presenters:

• Xiling Gong - Consultant, NCC Group
  Xiling Gong is a Senior Security Researcher of Tencent Blade Team. He has discovered many vulnerabilities of vendors like Google and Qualcomm. He is the speaker of CanSecWest 2018. Twitter: @Gxiling
• Peter Pi - Senior Security Researcher of Tencent Blade Team
  Peter Pi is a Senior Security Researcher of Tencent Blade Team. He has discovered many vulnerabilities of vendors like Google, Microsoft, Apple, Qualcomm, Adobe and Tesla. He was the #1 researcher of Google Android VRP in year 2016. He has spoken at many famous security conferences such as BlackHat, CanSecWest, HITB GSEC and Hitcon. Twitter: @tencent_blade

Links:

• https://defcon.org/html/defcon-27/dc-27-speakers.html#Gong
• https://infocon.org/cons/DEF CON/DEF CON 27/DEF CON 27 video and slides/DEF CON 27 - Xiling Gong - Exploiting Qualcomm WLAN and Modem Over The Air.mp4
• https://infocon.org/cons/DEF CON/DEF CON 27/DEF CON 27 video and slides/DEF CON 27 - Xiling Gong - Exploiting Qualcomm WLAN and Modem Over The Air.srt (subtitles)
• https://www.youtube.com/watch?v=KxdfX9NxfA4

Similar Presentations:

• DEF CON 17 (2009) / Old Skool Brought Back: A 1964 Modem Demo
• Black Hat USA 2019 / Exploiting Qualcomm WLAN and Modem Over The Air
• DEF CON 31 (2023) / Over the Air, Under the Radar: Attacking and Securing the Pixel Modem