Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

blog.checkpoint.com

Post reply on HN
Print view View original

61–70 of 120 posts

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#61

Post by stefan_ »

mohaine wrote: post #36
supernova87a wrote: post #4

I wonder if Apple/others knew about such vulnerabilities, and passed up on using the chip as a risk? Or, was it just dumb luck that they avoided this?

Looking at the slides from a different article, these are not really in the chip per say but in the SDK. So any lib compiled to use the chip would be affected but not really a hardware issue. Basically fuzzy testing found 400 library calls that fail with segfaults. These can sometimes (but not always) be modified to do a takeover, but I didn't see anyone claiming to have done that.

It's even more intentionally misleading than that. The SDK generates wrapper libraries that allow you to interface with your code running on the DSP. Some of the wrapper functions generated have vulnerabilities. The 400 vulnerabilities are the few vulnerabilities found in the SDK template multiplied by how many different generated wrapper libraries they found.

So you fix the handful of errors in the SDK templates and all the 400 vulnerabilities go away.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#62

Post by stefan_ »

mschuster91 wrote: post #17

Seriously I'm beyond pissed at the state of Android, patches and open-source compliance. If we are lucky 10% of current phone models will get any form of update. The rest will be vulnerable for years until the devices finally break. And that's only the Qualcomm stuff. There is another CPU vendor beginning with M who is big in el-cheapo hardware - look at their Android kernel leaks, wherever you dig you find horrid, H…

Google are the ones that went on an Apple-esque crusade to extinguish all GPL in AOSP.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#63

Post by staycoolboy »

doytch wrote: post #35
staycoolboy wrote: post #31

Earlier quoted context omitted.

> they just pay for more auditing and public research. Who is Intel paying to audit their chips?

Anyone who wants to report something via their bug bounty program. https://www.intel.com/content/www/us/en/security-center/bug-...

Bug bounties are very different than auditing. In an audit, there is a contract in place with specific analysis objectives based on agreed-upon criteria. I find it unlikely anyone in the industry would have more experience than Intel about CPU manufacturing, although there might be security consulting firms that are advanced enough to merit a real corporate NDA. But given the breadth and depth of their IP, even that seems unlikely.

But I would still really be interested to know who Intel hires to audit their products, if this is true. I'd like to do that kind of work.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#64

Post by ACow_Adonis »

google234123 wrote: post #60
unethical_ban wrote: post #43

Earlier quoted context omitted.

This is very much an opinion, not a fact. "Intel is only in trouble because they got caught, AMD is surely incompetent as well, but hasn't been found out".

A google scholar search for "amd security" turns up less than 100k results while a search for "intel security" has <2 million results.

ok, but what's the ratio of the number of Intel cpus running on something worth hacking compared to the number of amd CPUs?

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#65

Post by google234123 »

ACow_Adonis wrote: post #64
google234123 wrote: post #60

Earlier quoted context omitted.

A google scholar search for "amd security" turns up less than 100k results while a search for "intel security" has <2 million results.

ok, but what's the ratio of the number of Intel cpus running on something worth hacking compared to the number of amd CPUs?

My point is that there is more academic research on Intel processors than AMD. For a hacker, an Intel vulrability would of course be more lucrative than a AMD one.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#66

Post by Polylactic_acid »

jandrese wrote: post #11
supernova87a wrote: post #4

I wonder if Apple/others knew about such vulnerabilities, and passed up on using the chip as a risk? Or, was it just dumb luck that they avoided this?

From Apple's perspective Qualcomm has been insufficient for a long time for many reasons, the security issues here would only be one of the many factors involved in the decision to do their own development. For what it is worth, a modern chip as complex as the A* series is essentially guaranteed to have vulnerabilities. Maybe not 400, but definitely not 0.

Isn't this why apple doesn't trust the CPU with secure functions and has dedicated hardware for it? So a vuln in the cpu won't expose the encryption keys bypassing face id.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#67

Post by Polylactic_acid »

monocasa wrote: post #49
yjftsjthsd-h wrote: post #28

Earlier quoted context omitted.

> they just pay for more auditing and public research. Did Intel finance the research that turned up any of the major headline vulnerabilities over the last few years (meltdown, spectre)?

They did not.

It was a Google researcher mostly.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#68

Post by Polylactic_acid »

pjmlp wrote: post #51
mschuster91 wrote: post #17

Seriously I'm beyond pissed at the state of Android, patches and open-source compliance. If we are lucky 10% of current phone models will get any form of update. The rest will be vulnerable for years until the devices finally break. And that's only the Qualcomm stuff. There is another CPU vendor beginning with M who is big in el-cheapo hardware - look at their Android kernel leaks, wherever you dig you find horrid, H…

That is never going to happen, when Treble came out we thought it would change, but since they don't force OEMs to actually deliver updates, everything stayed the same. When questioned about this on the Android Platform 11 AMA last month, they stated that they think OEMs freedom is what makes Android a rich ecosystem. So there you have it. Can check by yourself on Reddit.

Treble was meant to be the key to making android roms easy to support but now the ROM scene is a fraction of what it was 5 years ago.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#69

Post by Polylactic_acid »

BiteCode_dev wrote: post #23
mschuster91 wrote: post #17

Seriously I'm beyond pissed at the state of Android, patches and open-source compliance. If we are lucky 10% of current phone models will get any form of update. The rest will be vulnerable for years until the devices finally break. And that's only the Qualcomm stuff. There is another CPU vendor beginning with M who is big in el-cheapo hardware - look at their Android kernel leaks, wherever you dig you find horrid, H…

Still getting updates for my one plus 6. YMMV.

Still getting updates for my 7 year old ipad air 2. About to get ios 14 as well. Android has warped peoples perspectives on how long a device would get updated. On PC you can just keep installing updates until the device can't keep up anymore.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#70

Post by Polylactic_acid »

Iolaum wrote: post #27
BiteCode_dev wrote: post #23

Earlier quoted context omitted.

Still getting updates for my one plus 6. YMMV.

You are getting updates for the OS and kernel but not for device drivers. That's a big surface area for someone to hack your phone.

Imagine how good things would be if the drivers were open source and in the kernel. We would still have bugs but at least it would be possible to fix them.
Post reply on HN