Research

Blog posts

• January 4, 2012 - Poking Holes in AppArmor Profiles
• April 27, 2010 - Fun With FORTIFY_SOURCE
• April 8, 2010 - Controlling Uninitialized Memory with LD_PRELOAD

Bugs

Kernel hardening

In addition to publishing many vulnerabilities and exploitation techniques, I have contributed to efforts to harden the Linux kernel as the original author of the dmesg_restrict and kptr_restrict kernel features (both based on ideas and code from grsecurity).

Stackjacking

Jon Oberheide and I gave a presentation on exploitation techniques against Linux kernels hardened with the grsecurity patchset. By leveraging the leakage of uninitialized stack data in conjunction with an existing arbitrary kernel write vulnerability, we demonstrated two techniques that could be used to escalate privileges. This presentation was the first public discussion of leveraging leakage of uninitialized kernel stack data as a practical exploitation technique, as well as the first public usage of the addr_limit technique to achieving a robust kernel read/write primitive.

• June 2011 - Summercon [slides]

• April 2011 - Immunity Infiltrate [slides]

• April 2011 - BeaCon [slides]

• April 2011 - Hackito Ergo Sum [slides] [code]

Remote kernel exploitation

After studying every public example of remote kernel exploitation, I developed a fully working exploit for a remote kernel stack overflow in the Linux kernel’s implementation of the ROSE amateur radio protocol. The exploit installs a kernel backdoor in the victim host, allowing the attacker to send and trigger arbitrary userland payloads at will. The exploit targets 32-bit PAE kernels, requiring the use of return-oriented programming (ROP) in kernel mode.

• October 2011 - H2HC [slides]

• August 2011 - Defcon [slides] [code]

SLOB exploitation

The Linux kernel’s SLOB allocator is primarily used on embedded systems. I developed a series of new attacks against SLOB that may be used to exploit progressively more constrained vulnerabilities, ranging from an arbitrary heap overflow to an off-by-one NULL byte. I also released libplayground, a simple framework I used to develop and test these techniques.

• January 2012 - Immunity Infiltrate [slides] [code]

Blog posts

• February 6, 2013 - A Linux Memory Trick
• August 12, 2011 - WP: Safe or Not?
• June 5, 2011 - SMEP: What is It, and How to Beat It on Linux

Bugs

In addition to discovering these vulnerabilities, I occasionally write exploits for bugs discovered by other researchers, such as full-nelson.c for CVE-2010-3849, CVE-2010-3850, and CVE-2010-4258, or for fun bugs with low security impact, such as caps-to-root.c.

Android root exploits

I published the first root exploits for a number of Android phones:

• Motorola Droid 3 (2011-08-25)
• Samsung Admire / Galaxy Prevail (2011-09-12)
• Thinkpad Tablet (2012-01-22)
• Sony Tablet S (2012-02-08)
• Motorola Droid 4 (2012-02-11)
• LG Esteem (2012-02-15)
• Motorola Xyboard / Xoom 2 (2012-02-17)
• Motorola Xoom FE (2012-02-18)
• LG Spectrum (2012-02-19)
• LG Thrill / Optimus 3D (2012-02-26)

These exploits were all based on a class of vulnerabilities involving leveraging symlinks or other filesystem tricks to cause privileged processes to mistakenly change ownership, contents, or permissions on files or directories that could lead to privilege escalation.

I spoke about the security implications of rooting/modding:

• April 2012 - SOURCE Boston [slides]

I published an exploit for the Logitech Revue Google TV as part of a group:

• August 2012 - Defcon [slides] [code]

In April 2013, I published motochopper, an exploit for the previously undiscovered CVE-2013-2596 that achieved root access on essentially every Qualcomm and Tegra Android device on the market.

Carrier IQ

In December 2011, the Internet and news media exploded over the discovery of Carrier IQ, a software framework integrated into millions of Android phones to gather analytics and performance data on behalf of carriers. I conducted an independent analysis of this software (blog), and was subsequently interviewed by and cited in major news publications around the world. I also developed a tool to unpack compressed Carrier IQ profiles (blog).

Bootloader and TrustZone research

In April 2013, I published motopocalypse (blog), an exploit for permanently unlocking the bootloader on Qualcomm-based Motorola devices by leveraging a design flaw in the implementation of bootloader locking.

In May 2013, I published loki (code, blog), a set of tools for installing unsigned kernels and recovery partitions to a wide range of Samsung and LG devices. Loki leveraged a previously undisclosed vulnerability in aboot, the bootloader responsible for loading the Linux kernel.

In August 2014, I published details of a vulnerability and exploit for QSEE, the implementation of TrustZone on Qualcomm devices, and demonstrated using this vulnerability to unlock the bootloader of the Motorola Droid X:

• August 2014 - Black Hat USA [slides]

Blog posts

• September 21, 2011 - Defeating Windows 8 ROP Mitigation

Bugs