Google Introduces Fresh Pixel Security Enhancements to Prevent 2G Breaches and Baseband Assaults
Google has unveiled the various protective measures that have been integrated into its latest Pixel gadgets to thwart the increasing risk posed by baseband security breaches.
The cellular baseband (for example, modem) denotes a processor on the gadget that is accountable for managing all connections, like LTE, 4G, and 5G, with a mobile phone cell tower or base station via a radio interface.
“This function inherently entails processing external inputs, which may arise from untrusted origins,” Sherk Chung and Stephan Chen from the Pixel team, and Roger Piqueras Jover and Ivan Lozano from the company’s Android team articulated in a blog post shared with The Hacker News.
“For example, malicious actors can utilize false base stations to insert altered or falsified network packets. In specific protocols like IMS (IP Multimedia Subsystem), this can be carried out remotely from any global location employing an IMS client.”
Furthermore, the software propelling the cellular baseband could also be exposed to flaws and mistakes that, if successfully manipulated, could jeopardize the security of the gadget, especially in scenarios where they result in remote code execution.
In a Black Hat USA presentation last August, a team of Google security technologists stated the modem as both an “essential” and “crucial” smartphone element with access to confidential data and one that is remotely reachable with assorted radio technologies.
The hazards to the baseband are not hypothetical. In October 2023, research disseminated by Amnesty International revealed that the Intellexa coalition behind Predator had engineered a tool called Triton to exploit vulnerabilities in Exynos baseband software employed in Samsung devices to distribute the clandestine spyware as part of precisely targeted assaults.
The assault involves executing a concealed downgrade maneuver that prompts the targeted gadget to hook up to the outdated 2G network through a cell-site simulator, following which a 2G base station transceiver (BTS) is applied to dispense the vicious payload.
Google has subsequently implemented a new security characteristic in Android 14 that permits IT administrators to deactivate support for 2G cellular networks in their supervised devices. It has also emphasized the function fulfilled by Clang sanitizers (IntSan and BoundSan) in fortifying the security of the cellular baseband in Android.
Then previously this year, the giant tech company exposed it is cooperating with ecosystem partners to introduce novel methods of informing Android users if their cellular network connection is unencrypted and if a counterfeit cellular base station or surveillance mechanism is monitoring their location through a device identifier.
The corporation has also delineated the measures it is taking to counter malevolent actors’ utilization of cell-site simulators like Stingrays to insert SMS messages directly into Android phones, otherwise termed SMS Blaster fraud.
“This technique to insert messages entirely evades the carrier network, hence evading all the advanced network-based anti-spam and anti-fraud filters,” Google pointed out in August. “SMS Blasters establish a bogus LTE or 5G network which executes a single function: downgrading the user’s connection to an obsolete 2G protocol.”
Several of the other defenses the corporation has included in its novel Pixel 9 series comprise stack canaries, control-flow integrity (CFI), and automatic initialization of stack variables to zero to avert disclosure of confidential data or serve as an avenue to attain code execution.
“Stack canaries are akin to tripwires arranged to ensure code executes in the anticipated sequence,” it mentioned. “If a hacker endeavors to exploit a vulnerability in the stack to alter the flow of execution without heeding the canary, the canary “trips,” notifying the system of a potential attack.”
“Analogous to stack canaries, CFI guarantees code execution adheres to a limited number of paths. If an attacker attempts to diverge from the authorized compilation of execution paths, CFI prompts the modem to reboot instead of taking the unauthorized execution route.
About Author
