Vulnerability could neutralize communication of Android mobile phones

Highlights

• CPR finds vulnerability in UNISOC’s baseband chipset that could deny and block communication of mobile phones by remote attacker
• UNISOC reached an 11% global market share of Smartphone Application Processor (AP) at the end of 2021
• CPR responsibly disclosed the information to UNISOC who acknowledged the vulnerability, assigned a CVE and rolled out a patch to fix

Background

UNISOC produces budget chipsets that power 2/3/4/5G devices ranging from smartphones to smart TVs. UNISOC is extremely popular in Africa and Asia due to their low end prices. By the end of 2021, UNISOC was reported to be the fourth largest smartphone chip manufacturer globally (following MediaTek, Qualcomm and Apple), with an 11% global market share.

Despite the fact that UNISOC has been on the market for a long time, the UNISOC chip firmware, including the radio modem (AKA baseband), has not been studied extensively. There are no references for any UNISOC baseband vulnerabilities on the Internet to date, and this served as primary motivation for our researchers.

The smartphone modem is a prime target for hackers as it can be potentially reached remotely through SMS or radio packet.

Check Point Research has unveiled several vulnerabilities that can jeopardize the modem’s and other chip related weaknesses that can put Android mobile users at risk.

We decided to conduct an analysis of the UNISOC baseband to possibly find a way to remotely attack UNISOC-based devices, after which to collaborate with the manufacturer and find a solution to this troubling scenario.

Our researcher reverse-engineered the implementation of the LTE protocol stack and indeed discovered a vulnerability that could be used to deny modem services, and potentially even block communications by a threat actor, from remote.

Exploiting this vulnerability can be used to disrupt the device’s radio communication through a malformed packet. An attacker or even a military unit can leverage such a vulnerability to neutralize communications on the attacked devices.

Responsible disclosure

Check Point Research reached out to the UNISOC teams in May 2022 and disclosed these findings. UNISOC acknowledged the findings and, gave the vulnerability a 9.4 scoring (critical), and patched it.

Google have updated that they will be publishing the patch in the upcoming Android Security bulletin.

We recommend mobile users to always update their phone’s OS to the latest version.

Check Point’s customers remain fully protected against such threats while using Harmony Mobile Security.

The full technical details of the research will be presented during the Recon 2022 conference, to be held from 3-5 June 2022

REcon is a computer security conference with a focus on reverse engineering and advanced exploitation techniques. It is held annually in Montreal, Canada.