What is QuadRooter? Are 900 million Android devices vulnerable?

Question

What actually is QuadRooter and how does it work on Android devices?

It is currently in the news that 900 millions Android devices are vulnerable:

Serious security flaws that could give attackers complete access to a phone's data have been found in software used on tens of millions of Android devices.

The bugs were uncovered by Checkpoint researchers looking at software running on chipsets made by US firm Qualcomm.

Qualcomm processors are found in about 900 million Android phones, the company said.

The article also said that it is something at the chipset level.

Is this true?

And how does this work internally?

Answer 1

What is QuadRooter?

Quadrooter is a name for a set of security vulnerabilities including

• CVE-2016-2059
• CVE-2016-2504
• CVE-2016-2503
• CVE-2016-5340

These are weaknesses in Linux/Android system software provided by chipset manufacturer Qualcomm.

They could be exploited by an app that you download, even one that does not ask for any special privileges. Such an app could exploit these vulnerabilities to gain higher level control of your phone, including access to any private data you have stored on it.

---

The US National Vulnerability Database gives the following description for the vulnerabilities listed above

2059

The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows attackers to gain privileges or cause a denial of service (race condition and list corruption) by making many BIND_CONTROL_PORT ioctl calls.

2504

The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28026365 and Qualcomm internal bug CR1002974.

2503

The Qualcomm GPU driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28084795 and Qualcomm internal bug CR1006067.

5340

The is_ashmem_file function in drivers/staging/android/ashmem.c in a certain Qualcomm Innovation Center (QuIC) Android patch for the Linux kernel 3.x mishandles pointer validation within the KGSL Linux Graphics Module, which allows attackers to bypass intended access restrictions by using the /ashmem string as the dentry name.

---

You can download an app named "Quadrooter Scanner" from the Google Play store - it will tell you if your phone is vulnerable. The app was written by Checkpoint Software Technologies Ltd. I have installed it, ran it and uninstalled it. Other than that, I cannot say if it is reliable in any way.

Qualcomm have issued software fixes to manufacturers

Google have addressed a couple of these in their security bulletins for July and August

Issue                                    CVE            Severity    Affects 
                                                                    Nexus?
Elevation of privilege vulnerability in  CVE-2016-2503,  Critical   Yes
Qualcomm GPU driver (Device specific)    CVE-2016-2067

...

Elevation of privilege vulnerability in  CVE-2016-2504,  Critical   Yes
Qualcomm GPU driver                      CVE-2016-3842

...

Elevation of privilege vulnerability in Qualcomm GPU driver

An elevation of privilege vulnerability in the Qualcomm GPU driver could 
enable a local malicious application to execute arbitrary code within the 
context of the kernel. This issue is rated as Critical due to the 
possibility of a local permanent device compromise, which may require 
reflashing the operating system to repair the device.

CVE References  Severity    Updated Nexus devices   Date reported
CVE-2016-2504    Critical   Nexus 5, Nexus 5X,      Apr 5, 2016
A-28026365                  Nexus 6, Nexus 6P, 
QC-CR#1002974               Nexus 7 (2013)

---

I suspect owners of vulnerable phones have a number of options including some or all of

• wait for manufacturer to provide an over the air update to fix this.
• don't download any new apps
• prevent apps from being updated until vulnerabilities are fixed
• uninstall all superfluous apps
• power down the phone until sure a fix is ready

I guess many people would regard at least the last item as overkill.

---

Are 900 million Android devices vulnerable?

Worldwide sales of smartphones are of the order of 1 billion each year.

Qualcomm are a major manufacturer of integrated circuits used in smartphones. They sell a variety of ICs including the popular "Snapdragon" range of ARM-based CPUs. Their annual revenues are of the order of USD 25 billion.

According to Forbes

According to ABI Research, leading chipset maker Qualcomm remained a leader in the LTE baseband chipsets in 2015. The company held a massive 65% of the LTE baseband chipset market in the year.

There may be 2 billion smartphones in use in 2016. Of course, a lot of these will be IOS devices. There may still be one or two Windows phone users out there :-).

The average lifetime of a smartphone might be two years or might be four years. There is certainly a market in second hand smartphones. It seems plausible that many smartphones older than one year are still in use.

Of course, there are Android devices that are not smartphones. Google estimates there are 1.4 billion active Android devices worldwide. 65% of 1.4 billion is 910 million. This might be how journalists arrived at this figure. If so, it isn't at all accurate.

However, assuming that the vulnerable drivers have existed for several years, it seems plausible that hundreds of millions of devices might be affected. 900 million seems to be the extreme upper end of possible estimates.

---

Related

• 2016-08-10 "Google says most users 'protected' against 'Quadrooter' - Play Store should spot exploits"
• 2016-08-08 QuadRooter vulnerability: 5 things to know about this Android security scare

Answer 2

More on Quadrooter

Traffic hijacking Linux flaw affects 80% of Android devices -- including Nougat - extracts

While there are a huge number of smartphones and tablets at risk, Lookout says that the flaw is difficult to exploit, somewhat mitigating the risks:

• The vulnerability allows an attacker to remotely spy on people who are using unencrypted traffic or degrade encrypted connections. While a man in the middle attack is not required here, the attacker still needs to know a source and destination IP address to successfully execute the attack.

  • We can estimate then that all Android versions running the Linux Kernel 3.6 (approximately Android 4.4 KitKat) to the latest are vulnerable to this attack or 79.9 percent of the Android ecosystem.

  • We found the patch for the Linux kernel was authored on July 11, 2016. However, checking the latest developer preview of Android Nougat, it does not look like the Kernel is patched against this flaw. This is most likely because the patch was not available prior to the most recent Android update.

(Emphasis supplied)

In order to patch this vulnerability Android devices need to have their Linux kernel updated. Fortunately, there are a few remedies a user can do until the patch is released:

• Encrypt your communications to prevent them from being spied on. This means ensuring the websites you browse to and the apps you use are employing HTTPS with TLS. You can also use a VPN if you want to add an extra step of precaution.

• If you have a rooted Android device you can make this attack harder by using the sysctl tool and changing the value for net.ipv4.tcp_challenge_ack_limit to something very large, e.g. net.ipv4.tcp_challenge_ack_limit = 999999999

Scammers put a bogus Android security patch app in Google Play- extracts

Scammers put a fake Android security patch app in Google Play to infect smartphones.

The bogus patch, packaged as an app, was briefly available in Google Play and purported to fix the so-called QuadRooter bugs that were revealed by security firm Check Point last week.

According to security firm ESET, Google has now pulled the two offending apps from Google Play. Both were both called “Fix Patch QuadRooter” from a publisher Kiwiapps Ltd.

ESET researchers said it is the first time fake Android security patches have been used to lure potential victims