2023/12/13 Council Agenda Packet

(((y)>) GSM Device Kernel Rootkit Allot to: �. Rootkit is triggered r ... 2. Rooikt cells attacker S. Rocti& tons on mlaophone Sound System Calendar Application Figure 2: The GSM rootkit intercepts an alarm signal, e.g., a meeting notification, and stealthily dials the attacker, thereby allowing him to snoop on confidential conversations. port loadable kernel modules; consequently, our proof -of -concept tootkits can potentially be modified to work on the Android plat- form (and the phones that run it, such as the Droid and the Nexus One). Since the attacks modify OS -specific data structures, they must be re -implemented for other platforms, such as Windows Mo- bile and Symbian OS; we expect that domg this will be relatively easy. In the following three subsections, we will describe m detail the three rootkits we developed. For each rootkit, we will present the goal of the attack, the attack description and its social impact. 3.1 Spying on Conversations via GSM Goat The goal of this attack is to allow a remote attacker to stealthily listen into or record confidential conversations using a victim's rootkit-infected smart phone. Attack Description. The Freerunner phone is equipped with a GSM radio which is connected via the serial bus and it is therefore avail- able to applications as a serial device. During normal operation of the phone, user -space applications issue system calls to the ker- nel requesting services from the GSM device The GSM device services the request allowing the application to access the tele- phony functionality provided by the device. GSM devices are con- trolled through serves of commands, called AT (attention) com- mands, that let the kernel and user -space applications invoke spe- cific GSM functions. For example, GSM devices support AT com- mands to dial a number, fetch SMS messages, and so on. To ma- liciously operate -the GSM device, e g., to place .a phone call to a remote attacker, the rootkit must therefore issue AT commands from within the kernel. Most smart phones today contain calendar programs, which no- tify users when scheduled events. occur. Our prototype rootkit op- erates by intercepting these notifications set by the user. As shown in Figure 2, a notification is displayed by a user -space program to notify the user of an impending meeting. The rootkit intercepts this notification and activates its malicious functionality. The at- tack code stealthily dials a phone number belonging to a remote attacker, who can then snoop or record confidential conversations of the victim. The phone number dialed by the rootkit can either be hard -coded into the rootkit, or delivered via an SMS message from the attacker, which the rootkit intercepts to obtain the attacker's phone number. Alternatively, the rootkit could be activated when the victim dials a number. The rootkit could then stealthily place a three-way call to the attacker's number, thereby allowing the at- tacker to record the phone conversation. 6. Triggering the rootkit. We used a simple alarm clock program to simulate calendar notifications on the Openmoko (we did so be- cause the Openmoko phone does not have any released calendar programs) In an uninfected kernel, when an alarm is signaled a specific message is delivered via the write system call. In our ` in- fected" kernel, the rootkit hooks the system call table and replaces the address of the write system call with the address of a mali- cious write function implemented m the rootkit. The goal of the malicious write function in our prototype rootkit is to check for the alarm notification in the write calls. Once an alarm message is identified, the malicious functionality is triggered. e Placing a phone call. When triggered, our rootkit places a phone call by emulating the functionality of user -space telephony appli- cations. Typically, user -space applications (such as the Qtopia soft- ware stack [6], which ships with the Openmoko Linux distribution on the Freerunner phone) make calls by issuing a sequence of sys- tem calls to the kernel. Specifically, applications such as Qtopia use write system calls to issue AT commands to the GSM device (these commands are supplied as arguments to the write system call). The n to be dialed is located in the AT command. Our prototype rootkit calls the attacker by issuing the same se- quence of AT commands from within the kernel. We obtained the sequence of AT calls that must be issued to place a phone call by studying the Qtopia software stack. The AT commands issued by the rootkit activate the telephony subsystem and successfully es- tablish a connection to the attacker's phone. The prototype rootkit must also activate the sound system by turning on the microphone. Social Impact. Snooping on confidential conversations has severe social impact because most users tend to keep their mobile phones in their proximity and powered -on most of the time. Rootkits op- erate stealthily, and as a result, end users may not even be aware that their phones are infected. Consequently, an attacker can listen- m on several conversations, which violates user privacy, ranging from those that result in embarrassing social situations to leaks of sensitive information. For example, an attack that records the con- versations at a corporate board meeting can potentially compromise corporate trade secrets and busmess reports to competitors. Simi- larly, several automated phone -based services often require a user to enter (via voice or key presses) PIN numbers or passwords be- fore routing the call to a human operator; an attacker snooping on such calls may financially benefit from such information. 3.2 Compromising Location Privacy using GPS Goal. The goal of this attack is to compromise a victim s loca- tion privacy by ordering the victim's rootkit-infected smart phone to send to the remote attacker a text message with victim's current location (obtained via GPS). Attack Description. As with the GSM device, the GPS device is also a serial device. The kernel maintains a list of all serial devices installed on the system. A rootkit can easily locate the GPS device. Every serial device contains a buffer in which the corresponding device stores all outgoing data until it is read by a user -space appli- cation. Our prototype rootkit uses this buffer to read information before it is accessed by user -space applications This allows us to monitor and suppress incoming SMS messages and also query the GPS for location information. A rootkit that compromises location privacy as described above must implement three mechanisms. First, it must be able to inter- cept incoming text messages, and determine whether a text message is a query from a remote attacker on the victim's current location Second, the rootkit must be able to extract location information from the GPS receiver. Last, it must generate a text message with the victim's current location, and send this information to the at- tacker. An overview of this attack is shown in Figure 3. Our prototype rootkit intercepts text messages by monitoring and changing data in the GSM device buffer. To monitor the GSM buffer, we hook the kernel's read and write system calls. This 3