Xiling Gong - Exploiting Qualcomm WLAN and Modem Over the Air
Achieves over-the-air code execution on Android phones by exploiting vulnerabilities in Qualcomm WLAN and modem baseband firmware.
Summary
Qualcomm Baseband Over-the-Air Exploitation
Xiling Gong (Security Researcher, Tencent Blade Team) presents research achieving over-the-air code execution on Android smartphones by exploiting vulnerabilities in Qualcomm WLAN and modem baseband firmware.
Baseband Attack Surface
The Qualcomm modem and WLAN chips run separate firmware operating systems (AMSS/QuRT) isolated from the main Android OS. These components process all wireless protocol data (LTE, Wi-Fi, Bluetooth) and represent a powerful attack surface reachable without any user interaction.
WLAN Vulnerabilities
Gong discovers heap overflow vulnerabilities in the Qualcomm WLAN firmware's 802.11 management frame parser (QCACLD-3.0 driver). By transmitting specially crafted Probe Response frames from a malicious access point, the attacker triggers the overflow in the WLAN chip's firmware.
Modem Protocol Stack Attacks
On the LTE modem side, vulnerabilities in the NAS (Non-Access Stratum) protocol implementation allow a malicious base station to trigger memory corruption in the modem firmware, achieving code execution in the baseband OS with full network hardware access.
Related talks
Black Hat·45 min
Presenters detail vulnerability discovery and exploitation in Exploiting Qualcomm WLAN and Modem Over The Air.
Main Stage·19 min
Slava Makkaveev
Check Point researcher Slava Makkaveev audits Qualcomm Snapdragon compute DSPs (cDSP), disclosing critical vulnerabilities that allow malicious Android apps to take over the DSP.
Main Stage·41 min
Adam Donenfeld
Adam Donenfeld details multiple privilege escalation vulnerabilities and memory corruption flaws discovered across Qualcomm mobile chipset drivers.