Vulnerabilities > CVE-2016-10370 - Improper Access Control vulnerability in Oneplus Oxygenos
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
HIGH Availability impact
NONE Summary
An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
OS | 1 | |
Hardware | 1 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Embedding Scripts within Scripts An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
- Signature Spoofing by Key Theft An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Seebug
bulletinFamily exploit description #### Summary The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850 & CVE-2017-8851. #### Technical Details OxygenOS & HydrogenOS send the following JSON request to `http://otac.h2os.com/post/Query_Update` or to `http://i.ota.coloros.com/post/Query_Update` in order to check if a new OTA is available: ``` { "beta": "0", "imei": "<IMEI>", "isOnePlus": "1", "language": "en", "mobile": "ONEPLUS A3010", "mode": "0", "ota_version": "<CURRENT_VERSION>", "type": "1", "version": "1" } ``` For example, on a OnePlus 3T device running OxygenOS 4.1.1 this results in the following response, announcing that a 4.1.3 OTA is available: ``` { "active_url": "http://otafsc1.h2os.com/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "description": "https://otafsc.h2os.com/html/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011_version_EN_1492072442240.html", "down_url": "http://otafsc.h2os.com/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "extract": "#OS Version: OnePlus3TOxygen_28_170411\n##WHAT'S NEW\n\\\n\u2022 Upgraded Android 7.1.1 \n\\\n\u2022 Added expanded screenshots \n\\\n\u2022 Improved picture taking of moving objects\n with blur reduction \n\\\n\u2022 Improved video stability when recording\n\\\n\u2022 Improved WiFI connectivity \u00a0\n\\\n\u2022 Improved bluetooth connectivity \n\\\n\u2022 Fixed Instagram swiping bug\n\\\n\u2022 Fixed hardware buttons\u00a0malfunction\u00a0bug\n\\\n\u2022 Increased system stability\n\\\n\u2022 General bug fixes\n [www.oneplus.net](http://www.oneplus.net/)", "new_version": "OnePlus3TOxygen_28.A.51_GLO_051_1704112011", "patchFilePath": "/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "patch_md5": "031507863135b7008c2651ea461d0e9e", "patch_name": "OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "patch_size": "1461187808", "recommend": "100", "share": "\u8bf7\u7528\u82f1\u8bed\u8bbe\u7f6e\u5206\u4eab\u5185\u5bb9", "type": "1", "version_name": "OnePlus3TOxygen_28_1704112011", "wipe": "0" } ``` Man-in-the-Middle attackers can therefore spoof this response in order to exploit CVE-2017-5948, CVE-2017-8850 & CVE-2017-8851. ### POC `https://github.com/alephsecurity/research/tree/master/OnePlusOTA` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2016-10370 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017022. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported. id SSV:93109 last seen 2017-11-19 modified 2017-05-12 published 2017-05-12 reporter Root title OnePlus OTA Lack of TLS Vulnerability(CVE-2016-10370) bulletinFamily exploit description #### Products * OnePlus 3T * OnePlus 3 * OnePlus 2 * OnePlus X * OnePlus One #### Vulnerable Version * All OnePlus OxygenOS & HydrogenOS OTAs #### Technical Details Due to lenient updater-script in the OnePlus OTA images (see below), and the fact both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use adb sideload to push the OTA (on OnePlus 3/3T ‘Secure Start-up’ must be off). updater-script of the OnePlus 3T OxygenOS 4.1.3 OTA: ``` getprop("ro.display.series") == "OnePlus 3T" || abort("E3004: This package is for \"OnePlus 3T\" devices; this is a \"" + getprop("ro.display.series") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") || abort("E1001: Failed to update system image."); show_progress(0.050000, 10); [...] ``` updater-script of the OnePlus 3T HydrogenOS 3.0.0 OTA: ``` getprop("ro.display.series") == "OnePlus 3T" || abort("E3004: This package is for \"OnePlus 3T\" devices; this is a \"" + getprop("ro.display.series") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") || abort("E1001: Failed to update system image."); show_progress(0.050000, 10); [...] ``` #### PoC ``` https://github.com/alephsecurity/research/tree/master/OnePlusOTA ``` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2017-8850 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017020. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported. id SSV:93107 last seen 2017-11-19 modified 2017-05-12 published 2017-05-12 reporter Root title OnePlus OTA OxygenOS/HydrogenOS Crossover Vulnerability(CVE-2017-8850) bulletinFamily exploit description #### Products * OnePlus X * OnePlus One #### Vulnerable Version * All OnePlus OxygenOS & HydrogenOS OTAs #### Technical Details Due to lenient updater-script on the OnePlus One & X’s OTA images (see below), the fact both products use the same OTA verification keys, and the fact both products share the same ro.build.product system property, attackers can install OTAs of one product over the other, even on locked bootloaders. That could theoretically allow for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. Moreover, the vulnerability may result in having the device unusable until a Factory Reset is performed. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use adb sideload to push the OTA. updater-script of the latest OnePlus X OxygenOS OTA: ``` getprop("ro.build.product") == "OnePlus" || abort("This package is for \"OnePlus\" devices; this is a \"" + getprop("ro.build.product") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/platform/msm_sdcc.1/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat"); ``` updater-script of the OnePlus One OxygenOS OTA: ``` getprop("ro.build.product") == "OnePlus" || getprop("ro.build.product") == "ONE" || abort("This package is for \"OnePlus\" devices; this is a \"" + getprop("ro.build.product") + "\"."); ifelse(is_mounted("/system"), unmount("/system")); mount("ext4", "EMMC", "/dev/block/platform/msm_sdcc.1/by-name/system", "/system", ""); unmount("/system"); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); ``` #### PoC ``` https://github.com/alephsecurity/research/tree/master/OnePlusOTA ``` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2017-8851 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017021. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported. id SSV:93108 last seen 2017-11-19 modified 2017-05-12 published 2017-05-12 reporter Root title OnePlus OTA One/X Crossover Vulnerability(CVE-2017-8851)
The Hacker News
id | THN:51F38064616715ED3D71C32EC64BFB0F |
last seen | 2018-01-27 |
modified | 2017-05-12 |
published | 2017-05-11 |
reporter | Swati Khandelwal |
source | https://thehackernews.com/2017/05/oneplus-mobile-vulnerabilities.html |
title | All OnePlus Devices Vulnerable to Remote Attacks Due to 4 Unpatched Flaws |
References
- http://www.securityfocus.com/bid/98495
- http://www.securityfocus.com/bid/98495
- https://alephsecurity.com/vulns/aleph-2017022
- https://alephsecurity.com/vulns/aleph-2017022
- https://forums.oneplus.net/threads/ota-and-imei-over-http.453992/
- https://forums.oneplus.net/threads/ota-and-imei-over-http.453992/