16

How can buffer overflows be potentially dangerous in Android?

Specifically, if each app has its own user id and it being run in Dalvik VM copy that has the same id. I thought that even if the overflow happens, shellcode written to app's mem page will only have the same privileges as the app itself?

  • 2
    yes but what if you use native code or something like C++ – shura Aug 23 '16 at 14:11
  • 3
    I think it is possible to write an app (or some parts) in C – shura Aug 23 '16 at 14:20
  • 4
    as mentioned in the link, you mean the Android NDK -> developer.android.com/ndk/index.html – architekt Aug 23 '16 at 14:23
  • 1
    Simply said, Java is like a Virtual Machine. The Java runtime assigns the memory and the application runs within that "vm". So a buffer overflow can not occur because java has no direct memory access Thats´s essentially what the link @Saibot posted explains in detail – architekt Aug 23 '16 at 14:27
  • 1
    I don't say it is simple. I am trying to explain a complex long thing, in a short simple way, briefly. – ferit Aug 23 '16 at 15:50
20

Let's take Stagefright for example, the media library written in C++

How overflows bypass assigned privileges is simple; C code can directly write to memory. It's your job as developer to make sure what you put in fits, otherwise it will happily write over other instructions of the same privilege. Stagefright has a lot of privileges. And the information that flows out of the buffer could be a random cat video from the internet(which then -gains- the privileges of the media library)

So it would be naive to assume overflows are not harmful. Stagefright contained buffer overflows and this is extremely dangerous. Android developers have made exploitation harder by implementing (among other measures) address space layout randomization (ASLR), this makes the offsets to use unpredictable, causing a fault rather than code execution. But by combining this with browser vulnerabilities, information can be leaked about the current location of the memory pages so code execution is still possible.

I would recommend reading up on Metaphor, a Stagefright implementation including ASLR bypass, the paper and PoC code are available online

  • But can the Stagefright bypass the privileges of the application that calls it? I don't think so. – Jan Hudec Aug 23 '16 at 19:18
  • 1
    It can if there is another exploit to compound it with. The fear of remote code execution is that once you get to the point of executing arbitrary code your attack space increases dramatically. Consider that if Rock the Box were still unfixed, being able to endlessly fork the process can lead to an escalation of privilege and full root ownership. The point is that once you get to remote code execution, it's much more work to limit unfettered access. That's why buffer overflows are so dangerous and enable the bypassing of privileges. – Nate Diamond Aug 23 '16 at 20:30
9

Let me paraphrase the op's question: Android have a user-id-based app-isolation model and how could overflow bypass that?

The answer is you overflow the parts that are shared between the apps: services, system apps and the Linux kernel itself. A lot of these components are written in C/C++ so they're vulnerable.

This is effectively how you do privilege escalation in all multi-user systems and Android is nothing special.

  • 1
    the buffer overflow just means you can inject code into the process memory. Nothing more. Privilege escalation doesn't come automatically by that. It's a second step. And it might not be possible at all. – kaidentity Aug 23 '16 at 15:17
  • The RME enables privilege escalation exploits. It is a second step, it may not be possible, but the danger is in the increase of the attack surface. – Nate Diamond Aug 23 '16 at 20:31
2

I thought that even if the overflow happens, shellcode written to app's mem page will only have the same privileges as the app itself?

Unless the overflow is in kernel or in something exposed over inter-process communication (android provides many things as services), yes.

However note that the three key applications: messaging, e-mail and browser, have rather many privileges. Enough to steal some important private data. These applications are also the ones that interpret untrustworthy outside content. It is therefore up to these applications to make sure that the outside content (like web pages) can't use the permissions it shouldn't.

These applications also run a lot of potentially vulnerable C or C++ code, since interpreting some of the content (especially video and javascript) is CPU and memory intensive to the point Java and the JVM (the Android JVM is inferior to the desktop one) are not up to the task, and also before the code is reused from other platforms. It is vulnerabilities in this code that most of the serious exploits target.

1

I am not an Android security expert but I think I can answer the question let's say for an Apache/Linux scenario and I think equivalent threats also exist for Android (let's leave aside the question for the moment if buffer overflows are possible in Android or not).

  1. A buffer overflow allows an attacker to inject code into the memory of a running process. Usually, the attacker would try to inject code that starts a shell (/bin/bash, for instance) which sends its stdout to her remote attacking box and receives stdin from that box. The result is a terminal window on the attacker's computer but the shell process runs on the attacked box. Now, as you say in Android the process runs in the user space. The same thing is true for a normal web server scenario on Linux. I.e. you inject code into a process memory whose owner doesn't have much privileges (www-data or apache are not powerful at all on Linux). At this point in time you can only perform actions remotely from your attacker's box that the user is authorized to do in the OS. In Linux, this is pretty limited and as you say in Android as well.
  2. The next step an attacker is aiming for is a privilege escalation. I.e. find another flaw in the OS/whatever that allows you to break out of the "sandbox" type of thing you're cought in. There are hundreds/thousands of bugs in Windows/Linux/whatever which allow privilege escalation from a limited user to root/Administrator (counted over the last 15 years). For Android this means you would need to find such a bug in the Android OS that allows you to break out of the user space. Since perfection doesn't exist in this world there ARE most probably bugs which allow to do so. It just depends on your time and energy whether you find them or not.
  3. Can buffer overflows exist in Android? Of course, they can. Android is written in C like most operating systems. Every phone vendor brings his own flavor of the OS, so what makes you certain that not one Samsung/LG/whatever developer introduces a flaw in the code? On the interface between Java and C the C part still needs to do proper bounds checking, otherwise you still overwrite memory. However, as an app developer you don't need to worry about this problem anymore because writing directly to memory addresses is not possible in Java.
  • In Android (and this is mentioned in the question!), each application runs under separate user and the tools you could execute are rather limited. However, for most attacks, escalation is not actually needed. – Jan Hudec Aug 23 '16 at 19:20
0

Let's say you injected your code into a process. Now you can:

  • Mess with the data and permissions accessible to the process (steal your account details of the app, access your pictures if the app has the permissions, post a twitter message in you name if the attacked app was twitter, ...)
  • Use a privilege escalation attack to get higher privileges
  • Sometimes parts of the app (especially media libraries) run with higher privileges. If you attack those, you can get higher privileges. Stagefright used this if I remember correctly.
  • Attack another app/process on the phone (also those not remotely accessible) and repeat the whole thing until you reached your target

So even if you (initially) can only access your own adress space, you have a lot of possibilites.

For clarification: The process of the app is running with the user ID. The process might be the Dalvik VM. It also might also be native code using the Android NDK written in C/C++. This is often used by media libraries, games and low level OS functionality.

In general only critical bufferoverflow vulnerabilites are discussed in media, these are only a small part of all vulnerabilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.