Vulnerabilities Discovered in Mobile Bootloaders of Major Vendors

[LASER_oneXM]

Android bootloader components from five major chipset vendors are affected by vulnerabilities that break the CoT (Chain of Trust) during the boot-up sequence, opening devices to attacks.

The vulnerabilities came to light during research carried out by a team of nine computer scientists from the University of California, Santa Barbara.

Researchers developed BootStomp to analyze bootloaders
The research team looked into the shadowy world of Android bootloaders, components that are hard to analyze because they are closed-source and tend to lack typical metadata (such as program headers or debugging symbols) that are usually found in normal programs and help reverse engineering and security audits.

"Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks," the research team said. "Our tool also identified two bootloader vulnerabilities that can be leveraged by an attacker with root privileges on the OS to unlock the device and break the CoT."

For their work, researchers considered five different bootloaders from four different vendors.

- Huawei / HiSilicon chipset [Huawei P8 ALE-L23]
- NVIDIA Tegra chipset [Nexus 9]
- MediaTek chipset [Sony Xperia XA]
- Qualcomm's new LK bootloader
- Qualcomm's old LK bootloader