Mystique Hits: Vulnerability Chain that breaks the Android Application Sandbox

The Android Application Sandbox is the cornerstone of the Android Security Model, which protects and isolates each application’s process and data from the others. Attackers usually need kernel vulnerabilities to escape the sandbox, which by themselves proved to be quite rare and difficult due to emerging mitigations and attack surfaces tightened. However, we found a vulnerability in the Android 11 stable that breaks the dam purely from userspace, which is CVE-2021-0691. Combined with other 0days (CVE-2021-25450, CVE-2021-25485, CVE-2021-25510, CVE-2021-25511 and CVE-2021-23243 etc) we discovered in major Android vendors forming a chain, a malicious attacker app can totally bypass the Android Application Sandbox, owning any other applications such as Facebook and WhatsApp, reading application data, injecting code or even trojanize the application (including unprivileged and privileged ones) without user awareness. We named the chain "Mystique" after the famous Marvel Comics character due to the similar ability it possesses. These findings have been acknowledged and fixed by Google and major Android vendors such as Samsung. In this talk we will give a detailed walkthrough on the whole vulnerability chain and bugs included. On the attack side, we will discuss the bugs in detail and share our exploitation method and framework that enables privilege escalation, transparently process injection/hooking/debugging and data extraction for various target applications based on "Mystique". We will also share insights on our static program data-flow analysis framework that automatically identifies large portion of bugs in this chain on multiple vendors. On the defense side, we will talk about the detection SDK/tool for app developers and end users since this new type of attack differs from previous ones, which largely evade traditional analysis.

Dawn Security Lab

Dawn Security Lab mainly focuses on system and iOT security research. The Lab has found more than hundreds of CVEs on Google, Apple, Samsung, etc and members consisting of formal Pwn2Own champions. The Lab's twitter is @dawnseclab.