Google: Turn off VoLTE, Wi-Fi calling: severe Exynos modem vulnerabilities

https://9to5google.com/2023/03/16/google-exynos-modem-vulnerabilities/

by dmitrygr • 3 years ago

341 140 3 years ago

Project Zero’s advice for those impacted follows:
> Until security updates are available, users who wish to protect themselves from the baseband remote code execution vulnerabilities in Samsung’s Exynos chipsets can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings. Turning off these settings will remove the exploitation risk of these vulnerabilities.
Google Pixel devices received software updates in 2021 that automatically enabled VoLTE and removed the toggle.

That's some great advice.

toast03• 3 years ago

If you turn off VoLTE and Wi-Fi calling, I don't think you can get calls in the US, so I'm not suprised VoLTE can't be disabled.

yaomtc• 3 years ago

Isn't LTE part of 4G? What about 5G?

josephcsible4• 3 years ago

I don't know about you, but I'd way rather not be able to get calls until Monday than be vulnerable to this exploit.

flas9sd• 3 years ago

even in Androids phone diagnostics?

    *#*#4636#*#*

dmitrygr3• 3 years ago

"Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number. With limited additional research and development, we believe that skilled attackers would be able to quickly create an operational exploit to compromise affected devices silently and remotely."

Funsies...

Steltek2• 3 years ago

It's skilled attackers in proximity with radio gear and a laptop, right? This sucks for a lot of people but I don't think I'm on the list of targets such actors would care about.

chii• 3 years ago

Just because you have nothing valuable to steal from your house, doesn't mean you shouldn't make sure the front door is locked!

CaliforniaKarl• 3 years ago

I wonder how you would be able to apply mitigations on carriers (like T-Mobile) that have turned off their 3G service. If you don't have a carrier which supports 3G (or lower), don't you need VoLTE turned on in order to make & receive voice calls?

tguvot• 3 years ago

you can get voip service and forward calls there.

CameronNemo2• 3 years ago

yeah I use jmp.chat because I got tired of the whole VoLTE shenanigans.

toast03• 3 years ago

T-Mobile may still have 2G up, possibly for calling only, but I don't think any other national US carrier has 2G or 3G up and running.

joecool10292• 3 years ago

It works for data and calls, not fast but since not much falls to it anymore it seems to rarely be congested. My coverage with it was always better than with their 3G network and I used it years past its prime for conserving battery (until they deployed low-band LTE). You need at least a 3G device to use new sim cards to get on 2G but if you've been a customer a long time and you haven't changed cards, there are still activated ones in the wild that work with old devices (I was able to get calls and SMS to work on a t68i, but needed to use a w810i to get working data when I tried a few months back).

xvector• 3 years ago

At a certain point these aren't vulnerabilities and are just backdoors.

znkynz• 3 years ago

On my Pixel 7, the option to disable appears to be "4G Calling". This does mean in areas where 4G calling is the only option, you're screwed.

brookst3• 3 years ago

That’s like saying an incompetent person who makes a lot of mistakes is somehow transformed into a malicious actor “at a certain point”. It’s just not true. It may help justify your emotional response to consider them so, but it’s not true.

upofadown• 3 years ago

“Once is happenstance. Twice is coincidence. Three times is enemy action”

alyandon• 3 years ago

Ok go turn off VoLTE.... unless your carrier did the following

  * “Google Pixel devices received software updates in 2021 that automatically enabled VoLTE and removed the toggle.”

ars• 3 years ago

LTE is data only, if you want to make a call you need to have VoLTE (voice over LTE). So it's pretty reasonable to prevent disabling this.

I wonder if you can disable LTE entirely and use an older standard.

jsheard4• 3 years ago

Many carriers have already retired 3G, so there's nothing left to fall back on if you were to disable 4G/LTE.

wil421• 3 years ago

No you can’t. 3G SIMs were flagged a while back and the account holders were notified of the retirement. At one point they started blacklisting SIMs that connected to 3G because customers didn’t upgrade.

Careful if you put your SIM in a 3G only phone it may get blacklisted and you’ll need a new one.

Source: work at a carrier.

JeremyNT• 3 years ago

Unneeded on pixel devices per the project zero announcement [0]:

affected Pixel devices have already received a fix for CVE-2023-24033 in the March 2023 security update

[0] https://googleprojectzero.blogspot.com/2023/03/multiple-inte...

bqmjjx0kac• 3 years ago

I am still running the February update on my Pixel 6. When I check for updates, I don't see one.

josephcsible4• 3 years ago

But some Pixel phones haven't gotten the March 2023 security update yet, per the article.

actuator• 3 years ago

Ah, that would explain the multiple patches that came in last week on my 7 Pro. I thought it was strange.

matthewdgreen2• 3 years ago

The patch was written but withheld due to bugs. So you are not patched yet.

OneLeggedCat3• 3 years ago

affected Pixel devices have already received a fix for CVE-2023-24033 in the March 2023 security update

That line is carefully deceptive (lawyerly, even). Pixel 6 series have not yet received the March 2023 update.

ttGpN5Nde3pK• 3 years ago

That is only for CVE-2023-24033 thought, right? Not the other three that haven't been assigned CVE ID's?

The four most severe of these eighteen vulnerabilities (CVE-2023-24033 and three other vulnerabilities that have yet to be assigned CVE-IDs) allowed for Internet-to-baseband remote code execution.

jsheard4• 3 years ago

Although this is a vulnerability in Samsung Exynos chipsets, ironically most Samsung flagship phones sold in the US shouldn't be affected because they use Qualcomm chipsets there rather than their own. The variants sold in Europe and Asia tend to have Exynos chipsets though, with the exception of the S23 series which is Qualcomm everywhere.

favaq• 3 years ago

That's interesting. People here in Europe hate Exynos chipsets, they say they are worse than Qualcomm. Are they giving up on them finally?

jsheard4• 3 years ago

The Exynos variants usually are worse than the Qualcomm ones, the cynical take was that most prominent phone reviewers are based in the US so giving that market the superior chipset served to bait-and-switch the other markets into buying inferior hardware. It remains to be seen if Exynos will return for the S24 or they'll stick with Qualcomm across the board.

p_l4• 3 years ago

Dunno, the real complaint against exynos in favour of Qualcomm other than tribalism is that a lot of stuff was developed for Qualcomm with Adreno and not whatever GPU Exynos spouted at the time (custom weird thing early on, then PowerVR, nowadays Adreno). In USA they used Qualcomm due to CDMA shenanigans mainly.

Oh, and stuff like qualcomm-specific hacks people were used to from Jail broken HTC devices (like phone call recording) not working. Final minority complaint was essentially based on qualcomm devices being more popular so you had more resources for custom roms, despite the fact that Exynos meant no need to do complicated jailbreak to load a custom rom.

Personally I found no issue with Exynos chips whatsoever. Always some of the fastest stuff I had in my hands.

killingtime74• 3 years ago

The latest S23 ditches the Exynos variant

Steltek2• 3 years ago

I hope it goes the other way. My recollection is that the Exynos phones were able to be bootloader unlocked and flashed with other ROMs while the Qualcomm ones were locked down forever. I've stayed away from Samsung phones for that reason.

binkHN• 3 years ago

According to https://googleprojectzero.blogspot.com/2023/03/multiple-inte..., this likely affects:

Mobile devices from Samsung, including those in the S22, M33, M13, M12, A71, A53, A33, A21, A13, A12 and A04 series

...and many others.

BoorishBears• 3 years ago

Yes, and most of those are not sold in the US.

And you seem to be missing that of Samsung puts out Qualcomm and Exynos versions of the same phone, sharing a model number with a phone on that list doesn't preclude it from being unaffected

bskap• 3 years ago

Right but it depends where the device was sold. A Galaxy S22 intended for Europe is built with a vulnerable Exynos SOC but a Galaxy S22 built for the US has a Snapdragon.

wankle• 3 years ago

We got our A53's on Amazon, it shows on their product page it uses the Exynos chipset. There's also no option in the settings to disable VoLTE.

CWuestefeld• 3 years ago

I just had a chat with Samsung support. They seem pretty clueless about the whole thing, and brushed off the disclosure on the semiconductor.samsung.com site as "not the official Samsung USA site".

There doesn't seem to be a user-friendly way to determine for sure which chipset you have. I think at the very least, Samsung ought to publish a little app for that immediately.

hirsin• 3 years ago

The pixel 6 modem has a bunch of known issues, to my understanding (certainly that's been the consensus when I've looked up solutions to my Pixel not getting a signal in the middle of Seattle until I toggle airplane mode on and off a few times). Hopefully this is the nail in the coffin for this modem series and they go back to using their previous modem

dmitrygr3• 3 years ago

their previous modem

That's qualcomm. The very idea of google's phone SoCs was to ditch qualcomm

chasil• 3 years ago

Can we get Project Zero to take a hard look at the next Pixels before they are released, please?

This does not seem an unreasonable ask.

pflanze• 3 years ago

allow an attacker to remotely compromise a phone at the baseband level

Aren't modern phones supposedly securely separate the baseband from the OS (Android)? Does this mean that voice and data can be intercepted, but at least other data might be safe?

parker_mountain• 3 years ago

Android pretty effectively enforces TLS as well.

Also, aside from the surface level issues of a vuln like this, an attacker now has a serious foothold on the device, which is still very bad.

brookst3• 3 years ago

Pure speculation, but I would guess that the interfaces to baseband are not particularly hardened, so an attack on the phone from the baseband might be trivial. Or worse, the baseband might have a trusted channel to launch arbitrary code.

pdoege• 3 years ago

No. The baseband can DMA what it wants, when it wants. The baseband PMIC can power what it wants when wants. The AP is the junior partner.

flangola7• 3 years ago

IOUMMU prevents this

userbinator• 3 years ago

Not on MTK chipsets, or at least the older ones I'm familiar with:

https://github.com/varunchitre15/MT6589_kernel_source/blob/m...

Look at the enable_mem_access_protection function.

notactuallyben6• 3 years ago

This is not true on pretty much any phone post 2014ish. Pretty much all platforms have IOMMU's or similar separation mechanisms. source: did baseband vr commercially

Analemma_• 3 years ago

Basebands have not had DMA for a long time. There can still be vulnerabilities, which it sounds like is what happened here, but there’s no DMA anymore on new phones.

p_l4• 3 years ago

That was (possibly still is) the case on Qualcomm integrated Application and Baseband SoCs, not on Exynos where baseband is the junior partner.

fomine3• 3 years ago

Original blogpost looks fine https://googleprojectzero.blogspot.com/2023/03/multiple-inte...

josephcsible4• 3 years ago

The Google Project Zero blog post implies that all Google Pixel models have received a fix, but really only some of them have, and it doesn't mention that the vulnerability can't be mitigated on them either. The 9to5Google post gets both of these things right, though: "the Pixel 6, 6 Pro, and 6a have yet to see that March update" and "Google Pixel devices received software updates in 2021 that automatically enabled VoLTE and removed the toggle."

stragulus• 3 years ago

So, essentially, you have to disable mobile data as well as wifi calling, thus disabling the ability to be called entirely until they release the march patch. Nice..

caf• 3 years ago

Switch the preferred network to 3G should disable VoLTE.

e12e• 3 years ago

Ok,so looks like pixel 7 and 7 pro are patched:

On Pixel phones, the main CVE-2023-24033 vulnerability was fixed with the March 2023 security patch that rolled out on Monday but should have come a week earlier.
However, the Pixel 6, 6 Pro, and 6a have yet to see that March update and are currently vulnerable.

mistyvales3• 3 years ago

Welp, turned off wi-fi calling but can't turn off VoLTE. I can set 3G, but since I'm on Fi, 3G won't work (T-mobile).. I get horrible 5G where I am, so it always goes to LTE.

BenjiWiebe• 3 years ago

If you are in the US, 3G is done from the big carriers. Verizon was the last hold out, only turning it off at the beginning of this year.

mistyvales3• 3 years ago

A shame! I have a Nokia Windows Phone that I used on 3.5G for a long time as a second phone, and now it's basically worthless other than maybe for a music player..

hackmiester3• 3 years ago

VoLTE will work over 5G (and sometimes over 3G in esoteric configurations). It is very data centric, even using SIP for call control. A rule of thumb is, any time you have a data connection, VoLTE can be used.

This is why Wi-Fi Calling and VoLTE took off at roughly the same time. Once you can route calls as data, you can offer it over both cellular and Wi-Fi. (Wi-Fi Calling has an additional outer IPsec layer, but it is the same "guts" inside the tunnel.)

gst• 3 years ago

VoLTE will work over 5G

Doesn't 5G use VoNR? Or does VoNR imply the same SIP call format, but just over 5G instead of 4G?

jacooper2• 3 years ago

But I already have the march update?, it arrived on grapheneOS for the Pixel 6 pro

aesh2Xa1• 3 years ago

https://grapheneos.org/releases#changelog

T2B3.230109.009.2023031500 (Pixel 6, Pixel 6 Pro, Pixel 6a) — 2023-03-05 Android patch level but only 2023-03-01 Pixel patch until a March stock OS release is published with updated firmware, etc. (marked as 2023-03-01 overall patch level in the OS)

Your baseband isn't protected. GrapheneOS patched Android, but the complete device set of images (firmware) is still vulnerable. That said, GrapheneOS does seem to implement its own additional baseband hardening.

jacooper2• 3 years ago

Good catch!

nneonneo• 3 years ago

This BlackHat talk from 2021 seems relevant: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Over-T...

It’s (probably) not the same bug, but gives you an idea of the state of baseband security and the attack surface. The baseband is an ARM chip running an RTOS.

The security situation is not pretty. We have here an XML parser running in the baseband RTOS which has a stack overflow bug. There are no stack canaries and it looks like there’s no ASLR or even NX so they get trivial shellcode execution. Although they didn’t demonstrate persistence or AP compromise, I can’t imagine either of those would be hard from the privileged baseband, especially if the baseband drivers are as bad as the baseband firmware seems to be.

notactuallyben6• 3 years ago

Great work from P0 (and Keen lab).

but this statement about baseband mitigations is only partially true. Huawei Balong platform has ASLR and stack canaries now (and some Infineon too I believe), and all baseband platforms are improving (even Mediatek). I didn't check Qualcomm lately, but they have a lot of similar protections now.

It's not trivial to do a pivot to AP on modern iPhones or Android phones (excluding some categories) - especially with PAC (and MTE coming).

But yeah, (Samsung) Shannon are an attractive target for attackers due to easily obtainable firmware, strings, DWARF (elf) firmware that you can find and relatively good debugging platform. The bugs are generally pretty low hanging too.

This isn't the same on Qualcomm platforms (Hexagon is notoriously hard to RE and debug), or the iPhone platforms.

saagarjha2• 3 years ago

Plus DART/IOMMU, I would imagine?

fulafel• 3 years ago

Yep. And the interface is not easily accessible for normal users so it's hard to fuzz, we're at the mercy of telcos telco-connected vendors for security testing.

cubesnooper• 3 years ago

I find myself wishing more and more for a wifi‐only tablet in a phone form factor.

Sure, I recognize that I’m in the minority here, as someone who keeps his phone in airplane mode/wifi‐only mode all the time. But it doesn’t mean giving up much: most of my messaging (including replying to texts and checking voicemails) can be done from the browser, GPS navigation works fine without an internet connection (maps can be trivially preloaded), and when I desperately need internet access while driving I can pull into any Starbucks, McDonalds, or Walmart.

Mostly I do this for philosophical reasons (basically, purposely downgrading the importance of phone notifications relative to what activities I’m physically doing at a given time), but the security advantage of smaller attack surface is a benefit I hadn’t considered.

MBCook• 3 years ago

It existed. It was called the iPod Touch. It was a full iPhone without a cellular modem.

It was discontinued, assumedly for low sales as more and more people gave their kids either iPads or hand me down iPhones instead of buying iOS touches like they used to.

CameronNemo2• 3 years ago

There was also the Samsung Galaxy Player. Discontinued long ago.

https://en.m.wikipedia.org/wiki/Samsung_Galaxy_Player

BLKNSLVR• 3 years ago

Is a phone without a SIM card any equivalent, or just the fact it has the ability to have a SIM card means the attack surface is too big?

vladvasiliu• 3 years ago

I don't think it's equivalent judging by the fact that you can still make emergency calls, which means it's able to talk to the network anyway. I remember than an older Samsung I had (GS3 IIRC) would show the signal level even withou a SIM installed.

Don't know what happens when you put it in airplane mode, though.

chris37879• 3 years ago

If your goal is to reduce your attack surface, then yes, even a modem without a SIM is too much.

The modem in your phone isn't like a modem from the days of dialup, it's more like a cable modem. More often than not, the modem is its own entire microprocessor, ram, i/o, etc and then communicates with the device's CPU over a mixture of serial, i2c, spi, or other busses. For instance, in my Pinephone, the modem is a Qualcomm MDM9607, which is a single core arm cpu that has 256mb of ram and 256mb of nand on its package, it literally runs its own entire operating system (linux in its case) separate from what the CPU of the phone does.

This CPU can also have its own connection to the battery, which is how, for example, iPhones can remain 'findable' even when the phone's CPU is otherwise powered off and at rest. The modem sips at the little remaining power in the battery to power itself and the GPS chip to report the devices location.

As for 'removing the sim' that doesn't prevent the device from connecting to a network, just authenticating with it, typically. Your sim card is just a standard identifier and a little bit of storage that the modem can read and write to for things like storing contacts and SMS messages. All of which can be done in software as well (known as an eSIM these days).

Edit: Here's a link to the wiki page on the Pinephone's modem, just to give you an idea of what a cell phone's modem can be capable of, and keep in mind, it uses a rather old, outdated, and unpopular modem, other modems may have more features: https://wiki.pine64.org/wiki/PineModems

rsync• 3 years ago

One caveat here ...

The baseband processor also performs real time audio and noise cancelling functions.

So while I have had some decent luck with VOIP and dialer apps that live solely in the application layer, voice quality and noise cancelling, etc., may not ever be as good as what the RTOS in the baseband can provide.

MonaroVXR• 3 years ago

Do you have a source?

dtx1• 3 years ago

This is great news!

Hear me out: we've long known that the current state of modems running their own tiny buggy unpatched is with way too much access to the device has been bad but no one could do much about it. A severe exploit like this doing actual damage to users of flagship phones from google and Samsung might be enough to finally change that. Unless it hurts the bottom line of those companies severely they won't change it. I think they should have released the info to force them to.

dhdhhdd2• 3 years ago

There is no way to disable volte on a pixel phone. There is a way to disable wifi calling.

pabs3• 3 years ago

The source code for baseband software needs to be open source, I expect there are many more such vulnerabilities. I also wonder how many basebands contain Linux and are GPL violating.

notactuallyben6• 3 years ago

None use Linux, most just use BSD licence software (or things like openssl). I haven’t seen any GPL code at all tbh.

But yep, would be nice if it was open source, although not sure how much that would help (only if sufficiently motivated auditors can be bothered to look at it). A bunch of baseband firmware is even encrypted on disk now (loaded into BB memory from the kernel)

dogben• 3 years ago

Quectel EG25-G is running linux

https://nns.ee/blog/2021/04/01/modem-blog.html

wnevets• 3 years ago

Did anyone else get a pop up on their Pixel asking to enable WiFi calling earlier in the week? Was that coincidence or related to this issue?

ThePowerOfFuet• 3 years ago

On Pixel phones, the main CVE-2023-24033 vulnerability was fixed with the March 2023 security patch that rolled out on Monday but should have come a week earlier.

That means GrapheneOS is already protected against this vuln:

https://grapheneos.org/releases#2023031500

A tip of the hat (and my great thanks) to the GrapheneOS team!

javajosh• 3 years ago

This is a pretty big win for Graphene - nice work. That link mentioned 3/20 as the date Google will release a patch.

fsflover• 3 years ago

Not fully: https://news.ycombinator.com/item?id=35192379.

OneLeggedCat3• 3 years ago

Pixel 6, 6a, 6 Pro are NOT protected from this on GrapheneOS. Not yet.

joosters• 3 years ago

..."Users who wish to protect themselves from the baseband remote code execution vulnerabilities in Samsung’s Exynos chipsets can turn off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings."

Very kind of them to offer the freedom of choice to all those users who don't want to protect themselves!

sneak• 3 years ago

Meanwhile, the other 14 vulnerabilities are considered not as severe as they “require either a malicious mobile network operator or an attacker with local access to the device.”

The kind of people with the resources to actively exploit this are the same kind of people who can compel the carriers to transmit whatever they want.

jchw• 3 years ago

Okay, so can Google please consider doing more work to isolate the modem from the application processor in Pixel phones now? This is a disaster, but probably worse than it needs to be.

darthmallrat• 3 years ago

Is this a valid mitigation for pixel 6/a/pro?

- Turn off wifi calling

- Turn on airplane mode

And then ensure wifi is on and wait for the March security update.

clankyclanker• 3 years ago

In 2014, Replicant found and fixed similar modem vulnerabilities, which Samsung never patched, AFAIK.

https://www.fsf.org/blogs/community/replicant-developers-fin...

Have we surpassed incompetence and arrived at maliciousness yet?

wkat4242• 3 years ago

Hmm. WiFi calling is not a big deal. VoLTE however is. Some networks don't even support 2/3G anymore so VoLTE is the only way to make calls there.

I always thought it was ridiculous that LTE didn't come with a built-in voice mode that was just universally supported. VoLTE is more of an add on app on top of of data and a big cause of compatibility problems. It wasn't even finished when the rest of the LTE standard came out so many early phones came without support. And many still have to fall back to 3G during calls due to incompatibilities or networks blocking them due to "not invented here".

It's a mess compared to 2G/3G where you can just stick a sim card into any phone and know it will work just fine.

In a far future a data only network makes sense but we're not there yet and we definitely weren't when LTE was specced. Voice should have been an integral part of the standard.

Google: Turn off VoLTE, Wi-Fi calling: severe Exynos modem vulnerabilities

Related Stories