Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap

Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap

Speakers: Robert Herrera, Senior Security Consultant, NCC Group's Hardware and Embedded team; Alex Pasket, NCC Group's EDG

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=piw0CZ46-Q0

Overview

This talk, presented by Robert Herrera and Alex Pasket of NCC Group, delves into critical security vulnerabilities discovered in Sonos smart speakers. The primary focus is on a sophisticated over-the-air remote kernel exploitation of the Sonos 1 Gen 2 device, leveraging a vulnerability in its Wi-Fi driver. This research culminated in achieving remote code execution (RCE) at the kernel level, demonstrating the ability to establish a covert wiretap by recording audio from the compromised device's microphone. The presentation also briefly touches upon ongoing research into a secure boot bypass for the more recent Sonos Era 100 device.

The significance of this research lies in its demonstration of how seemingly innocuous smart home devices, designed for entertainment, can harbor severe security flaws leading to profound privacy implications. By exploiting a fundamental flaw in the Wi-Fi stack, the researchers illustrate a path to complete device compromise without physical access, turning a consumer speaker into a surveillance tool. The findings underscore the critical need for robust security engineering, comprehensive auditing of third-party components, and proactive patching in the rapidly expanding Internet of Things (IoT) landscape.

Background

▶ Watch: Talk scope: Wi-Fi exploit (Sonos 1), secure boot (Air 100) (0:40)

NCC Group's Embedded Device Group (EDG) initiated this research with prior work focused on Sonos devices, initially for a Pwn2Own competition. This earlier effort, combined with existing public research from figures like Blasty and Sinactive, enabled the team to successfully dump software and firmware images from the Sonos 1 Gen 2. This initial access was crucial, as it allowed for a holistic review of the device's kernel modules. A key discovery during this review was that the Wi-Fi driver, a kernel module, was compiled without several standard security mitigations, specifically stack cookies and CONFIG_RANDOMIZE_BASE (Kernel Address Space Layout Randomization or KASLR). These omissions significantly lowered the bar for exploitation, transforming a potentially complex exploit into a more tractable problem.

The Sonos 1 Gen 2's Wi-Fi implementation is not an integrated chipset but rather a Wi-Fi card connected over PCI-E. This architecture means that the Wi-Fi communication, including the processing of wireless frames and state machine handling, is managed by a kernel module running within the main operating system rather than being offloaded to a dedicated, tightly integrated chip. The speakers referred to this as a "soft stack" implementation, highlighting that much of the critical processing occurs in the host kernel. Further analysis revealed that the device's UART TX debug interface was exposed, providing invaluable boot logs and kernel panic output. This debugging capability was instrumental in observing the effects of crafted payloads and confirming exploit primitives in real-time. The research methodology involved enumerating the receive functionality of the Wi-Fi kernel module to understand how raw wireless payloads were parsed, categorizing functions into pre- and post-authenticated contexts. The team focused on the authenticated context, assuming the attacker would know the Pre-Shared Key (PSK) of the network the Sonos device was connected to. MediaTek, the vendor of the Wi-Fi chipset, organizes its message handling protocols into "sanity functions," which became a primary target for auditing.

Key Findings

▶ Watch: Bug discovered, Sonos and MediaTek released fixes (2:00)

The central discovery of this research is a stack buffer overflow vulnerability within the MediaTek Wi-Fi kernel module running on the Sonos 1 Gen 2. Specifically, the vulnerability resides in the WPA_Parse_EAPOL_Key_Data function, which processes information elements from EAPOL Key messages during the WPA2 handshake. Due to a critical lack of input validation, an attacker can craft a malicious EAPOL message to overwrite a 32-byte stack-allocated buffer, GTK_buff, with an arbitrary length, leading to kernel remote code execution (RCE).

The absence of crucial kernel security mitigations, namely KASLR (CONFIG_RANDOMIZE_BASE) and stack cookies, significantly facilitated the exploitation of this vulnerability. These missing protections meant that attackers could predict memory addresses and bypass typical stack overflow defenses, making the path to RCE much more straightforward on the device's 64-bit ARM architecture.

The successful exploitation demonstrated by the researchers led to the ability to control critical registers, including the Program Counter (PC), and ultimately achieve a covert audio wiretap by remotely activating and capturing audio from the Sonos speaker's microphone. This highlights a severe privacy breach potential.

Sonos released a fix for this vulnerability in Fall/Winter 2023, and MediaTek, the Wi-Fi chipset vendor, followed with their respective Wi-Fi stack implementation fix in January 2024.

While the primary focus was on the Sonos 1 Gen 2, the talk also briefly introduced NCC Group's efforts to research a secure boot bypass on the newer Sonos Era 100. The goal here was to enable eMMC in-circuit programming to modify the device's embedded MultiMediaCard (eMMC) without the cumbersome process of desoldering, allowing for more rapid testing and experimentation with firmware modifications. However, the details of the Era 100 bypass itself were not presented in this talk, as the research was ongoing.

Technical Deep Dive

▶ Watch: UART enabled: crucial boot logs and kernel panic (2:35)

The technical core of the Sonos 1 Gen 2 Wi-Fi exploitation hinges on a specific stack buffer overflow within the MediaTek Wi-Fi kernel module. The researchers systematically analyzed the module's receive functionality to identify how raw wireless payloads were parsed. Their methodology involved categorizing functions into those accessible from a pre-authenticated context (without knowing the Wi-Fi PSK) and a post-authenticated context (requiring the PSK). The vulnerability was discovered in the latter, assuming the attacker has knowledge of the network's PSK, which is a reasonable assumption in many scenarios (e.g., a compromised network, social engineering, or a default/weak password).

The critical function identified was WPA_Parse_EAPOL_Key_Data. This function is responsible for parsing EAPOL Key Data, which is transmitted during the WPA2 four-way handshake. The key_data parameter, even after decryption by the client, is essentially a series of Information Elements (IEs). An IE is a basic data structure in Wi-Fi frames, comprising a one-byte type, a one-byte length field, and the actual value data corresponding to the specified length.

The vulnerability stems from a glaring lack of input validation within WPA_Parse_EAPOL_Key_Data. As highlighted by the speakers, the length field of an incoming IE (referred to as KDL) is directly used without sufficient checks. Specifically, KDL is assigned, then six bytes are unconditionally subtracted from it (KDL - 6), and this result is then assigned to GTK_length. Subsequently, a memmove operation uses this potentially attacker-controlled GTK_length to copy data into GTK_buff, a buffer initialized on the stack with a fixed size of 32 bytes.

The flaw is that if an attacker provides an IE length field that, after the subtraction of six, results in a value greater than 32, a classic stack buffer overflow occurs. For example, if KDL is set to 255 (the maximum possible for a single byte length), GTK_length would become 249 (255 - 6). This value would then be used in the memmove operation, attempting to copy 249 bytes onto the 32-byte GTK_buff, leading to an overflow of 217 bytes onto the stack.

The exploitation was further simplified by the absence of key kernel mitigations on the Sonos 1 Gen 2:

1. CONFIG_RANDOMIZE_BASE (KASLR) was disabled: This meant that the base address of the kernel and its modules was predictable, allowing the attacker to hardcode addresses for gadgets and shellcode.
2. Stack cookies were not enabled: Stack cookies (or canaries) are values placed on the stack to detect buffer overflows. Their absence meant that an overflow could directly corrupt the stack frame, including return addresses, without triggering a protection mechanism.

These omissions, combined with the 64-bit ARM architecture, provided a potent environment for crafting a reliable kernel exploit. The researchers achieved control over the Program Counter (PC) and a significant number of registers, specifically X19 through X23, effectively giving them seven controlled registers. Notably, the Most Significant Byte (MSB) of X23 was consistently set to FF, which proved useful as an address gadget during exploitation. The team also encountered and mitigated downstream corruption by strategically adding additional Information Elements (IEs) to their crafted frames, allowing the parsing loop to iterate and avoid unintended side effects. The vulnerability is triggered during message three of the WPA2 four-way handshake, specifically when the Global Temporal Key (GTK) is typically installed.

Demo / Proof of Concept

▶ Watch: Identified WPA parts E-pol key data as vulnerable (5:05)

The practical demonstration of the Sonos 1 Gen 2 Wi-Fi kernel exploit showcased a compelling covert audio wiretap. The physical setup involved an Alpha card configured to act as a rogue access point (AP), to which the target Sonos 1 Gen 2 device connected. The researchers utilized a tool, referred to as WTP, which they described as ideal for quickly testing theories and modifying EAPOL message 3 logic. This tool allowed them to inject their specially crafted Information Element (IE) containing the malicious length field into the WPA2 handshake.

The exploit sequence involved the Sonos device associating with the attacker-controlled access point. During the EAPOL message 3 exchange, the crafted malicious payload was sent. The immediate effect, as observed via the exposed UART TX port, was a kernel panic output, confirming that the vulnerability had been triggered. Crucially, this output also revealed that the attackers had successfully gained control over the expected registers, including the Program Counter (PC) and registers X19 through X23.

With kernel-level control established, the researchers demonstrated the ability to access the device's microphone and initiate an audio capture. The demo showed that the audio within the room, including the speaker's voice, was successfully recorded and captured from the compromised Sonos 1 Gen 2. This proof of concept clearly illustrated the severe privacy implications of the vulnerability, transforming a consumer smart speaker into an undetectable surveillance device capable of remote audio exfiltration.

The talk also briefly mentioned the ongoing research for the Sonos Era 100, where the goal was to enable eMMC in-circuit programming to facilitate firmware modification and secure boot bypass research. However, a live demo or detailed proof of concept for the Era 100 was not part of this presentation, as that research was still in progress.

Defensive Implications

▶ Watch: Stack buffer overflow due to missing input validation (6:00)

The findings presented in this talk have significant implications for both device manufacturers and end-users of IoT devices, particularly smart speakers.

1. Prioritize Robust Input Validation: The core of this vulnerability was a lack of input validation on externally supplied data (Wi-Fi Information Elements). Manufacturers must implement stringent checks on all incoming network data, especially within kernel modules and low-level drivers, to prevent buffer overflows, integer overflows, and other memory corruption bugs. This is paramount for any component processing untrusted input.
2. Enable Kernel Security Mitigations: The absence of KASLR (CONFIG_RANDOMIZE_BASE) and stack cookies was a critical factor in the exploit's success. Device manufacturers should ensure that all available kernel security mitigations are enabled by default during compilation. These features are designed to make exploitation significantly more challenging, even when vulnerabilities exist. For 64-bit ARM architectures, these are standard and should not be overlooked.
3. Prompt Patching and Updates: Sonos promptly released a fix in Fall/Winter 2023, and MediaTek followed in January 2024. This highlights the importance of a swift and coordinated response to disclosed vulnerabilities. Users should ensure their Sonos devices (and all smart home devices) are always running the latest firmware to receive critical security updates.
4. Supply Chain Security: The vulnerability resided in a MediaTek Wi-Fi kernel module, a third-party component. Manufacturers like Sonos must exercise rigorous security auditing and due diligence on all third-party software and hardware components integrated into their products. This includes regular security reviews of vendor-supplied drivers and firmware.
5. Minimize Debugging Interfaces in Production: The exposed UART TX port, while useful for researchers, can also aid attackers by providing valuable debugging information like boot logs and kernel panic output. Production devices should have debugging interfaces disabled or secured appropriately.
6. Awareness of IoT Device Risk: Consumers should be aware that smart devices, even seemingly benign ones like speakers, can become targets for sophisticated attacks leading to severe privacy breaches, such as covert audio surveillance. Understanding the security posture of IoT devices before purchase and keeping them updated is crucial.
7. Network Segmentation: While not preventing the on-device exploit, segmenting IoT devices onto a separate network can limit an attacker's lateral movement once a device is compromised.

Key Takeaways

• Remote Kernel Exploitation: The Sonos 1 Gen 2 was vulnerable to an over-the-air remote kernel exploit via its Wi-Fi interface.
• Critical Vulnerability: A stack buffer overflow in the WPA_Parse_EAPOL_Key_Data function of the MediaTek Wi-Fi kernel module allowed for arbitrary memory writes.
• Mitigation Bypass: The absence of CONFIG_RANDOMIZE_BASE (KASLR) and stack cookies significantly facilitated the exploit on the 64-bit ARM architecture.
• Severe Impact: Successful exploitation led to kernel-level Remote Code Execution (RCE) and was demonstrated with a covert audio wiretap, highlighting significant privacy risks.
• Timely Patches: Sonos released a fix in Fall/Winter 2023, and MediaTek released their updated Wi-Fi stack implementation in January 2024. Users are urged to update their devices.
• IoT Security Imperative: This research underscores the critical need for robust input validation, comprehensive kernel hardening, and diligent supply chain security practices in all embedded and IoT devices.
• Ongoing Research: NCC Group is also actively researching secure boot bypasses for newer devices like the Sonos Era 100 to enable in-circuit eMMC programming.

About the Speaker(s)

Robert Herrera is a Senior Security Consultant with NCC Group's Hardware and Embedded team. He presented the detailed Wi-Fi exploitation portion of the research, leveraging his expertise in Wi-Fi security.

Alex Pasket is also with NCC Group, part of their Embedded Device Group (EDG). He presented alongside Robert Herrera, providing context on the broader research efforts, including the initial work on Sonos devices and the objectives for the Sonos Era 100.