Remote, One-Click, Breaking through Smartphones via a Non Well-Known Remote Attack Surface

Remote, One-Click, Breaking through Smartphones via a Non Well-Known Remote Attack Surface

Speakers: Unknown

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=xITV0DpBVGo

Overview

This article delves into a groundbreaking security research presentation that unveiled a critical, previously under-explored attack surface on Android smartphones, specifically targeting Samsung devices. The talk details a series of vulnerabilities within the device's video calling infrastructure, culminating in a one-click Remote Code Execution (RCE) exploit. What makes this research particularly significant is its focus on a system-level service, com.samsung.ims.service, which operates with high privileges, listens on an open network interface, and is installed by default on millions of Samsung phones.

The research was presented by a student researcher and senior security researchers, whose work sheds light on the often-overlooked components of mobile operating systems. Unlike prevalent attacks that target user-facing applications like WhatsApp or Telegram, this methodology exploits a fundamental communication service, requiring only the victim's phone number to initiate the attack. This capability to achieve full device compromise with minimal user interaction—simply by answering a video call—underscores a severe security flaw that has likely persisted for an extended period, posing a substantial risk to user privacy and data security.

Background

▶ Watch: Overview of talk and one-click RCE attack scenario (0:00)

For years, the cybersecurity community and threat actors alike have largely concentrated their efforts on popular messaging applications such as WhatsApp, Telegram, and various web browsers as primary attack vectors for mobile devices. These platforms, due to their widespread adoption and complex functionalities, frequently present opportunities for exploitation, leading to numerous reports of spyware and surveillance campaigns. However, this focused attention has inadvertently left other critical system components relatively unscrutinized, creating blind spots in the mobile security landscape.

The talk highlights one such overlooked area: video calling services on the Android platform. Specifically, the research targets the IP Multimedia Subsystem (IMS) service, an API interface introduced in Android 9. The IMS framework is crucial for enabling modern communication features, including Voice over LTE (VoLTE) and Video over LTE (ViLTE). While Android provides the API, the specific implementation is typically handled by carriers or device vendors. In the case of Samsung, this implementation, identified as com.samsung.ims.service and com.samsung.ims.video, became the focal point of the researchers' investigation.

The motivation for targeting this service stemmed from several key characteristics. Firstly, the service operates with high privileges, running as the system user, which grants it extensive access to critical device resources. Secondly, it listens on network ports accessible from 0.0.0.0, making it directly reachable from remote networks without relying on user interaction beyond answering a call. Thirdly, it is installed and runs by default on Samsung Android phones, provided a SIM card is inserted. Crucially, attacking this service requires no account registration or prior interaction with the victim beyond knowing their phone number, a stark contrast to attacks on messaging apps that often necessitate account creation or social engineering. This combination of high privilege, remote accessibility, default installation, and low attack complexity made the IMS video service a prime, yet previously neglected, candidate for security research.

Key Findings

▶ Watch: Critical one-click RCE vulnerabilities in Samsung's IS service (2:20)

The research yielded several critical discoveries, fundamentally altering the understanding of remote attack surfaces on Android smartphones. The primary finding was the identification of multiple critical vulnerabilities within Samsung's implementation of the IMS video calling service, specifically impacting com.samsung.ims.service and com.samsung.ims.video. These vulnerabilities, which the researchers believe have likely existed for a prolonged period, enable a sophisticated one-click Remote Code Execution (RCE) attack.

The most significant implication of these findings is the ability for an attacker to completely compromise a victim's smartphone with minimal effort. The attack scenario described is chillingly simple: a victim receives a video call, and upon connecting, the attacker gains full control over the device. This "one-click" nature means the user only needs to answer the call, making it an extremely potent and difficult-to-defend-against vector.

Key aspects of the findings include:

• Remote Accessibility: The targeted service listens on network ports bound to 0.0.0.0, meaning it is directly exposed to the internet and can be accessed remotely by an attacker.
• High Privileges: The com.samsung.ims.service process runs with system UID, granting it the highest possible user-space privileges on the device. This level of access allows the attacker, post-RCE, to control virtually all aspects of the phone, including sensitive data and hardware.
• Default Installation and Operation: The vulnerable service is pre-installed and runs by default on Samsung Android phones, provided a SIM card is present. This means millions of devices are potentially susceptible without any special configuration.
• Low Attack Barrier: Unlike many attacks that require account registration on specific platforms or complex social engineering, this exploit only requires the attacker to know the victim's phone number. No prior account setup or interaction is needed, drastically lowering the barrier for malicious actors.
• Comprehensive Permissions: The system privilege level grants the service, and subsequently the attacker, access to critical device functions and data, including the camera, network, storage, SMS, microphone, and contacts.

These findings collectively expose a severe systemic weakness, demonstrating how a foundational communication service, when improperly secured, can become a gateway for complete device takeover.

Technical Deep Dive

▶ Watch: Why IS service is a prime target: privileges and remote access (2:50)

The core of the presented research lies in the detailed examination of Samsung's specific implementation of the IMS (IP Multimedia Subsystem) service on their Android phones. This implementation involves two primary processes: com.samsung.ims.service and com.samsung.ims.video. Understanding their roles, privileges, and interaction is crucial to grasping the severity of the discovered vulnerabilities.

The com.samsung.ims.service process is responsible for resolving signaling in the IMS architecture. Signaling refers to the exchange of messages that set up, manage, and tear down communication sessions, such as video calls. This process is the initial point of contact for incoming video call requests. Crucially, the researchers observed that com.samsung.ims.service is actively listening on network ports bound to 0.0.0.0. This means it is directly exposed to external network traffic, allowing remote attackers to interact with it without any local network presence. The capability to be "exercised from remote directly" is a critical enabler for the one-click RCE.

Once a video call connection is established, the com.samsung.ims.video process takes over. This process is responsible for resolving audio and video packages, meaning it handles the actual streaming of multimedia data during the call. The interaction between com.samsung.ims.service (for signaling) and com.samsung.ims.video (for media) is facilitated through the network. The overall architecture involves the network passing and reorganizing messages to com.samsung.ims.service, which then coordinates with com.samsung.ims.video for the media stream. The messages transmitted between these components, especially those handled by com.samsung.ims.video, are primarily video messages and video control messages. These messages are also transmitted over the network, with the network acting as the direct conduit.

A cornerstone of the attack's severity is the high privilege context in which these services operate. The com.samsung.ims.service process runs with the system UID, which is the highest privilege level available in user space on Android. This elevated privilege grants the service, and subsequently an attacker who exploits it, extensive access to sensitive device resources and functionalities. The researchers explicitly listed permissions associated with this service, including:

• Camera: Full control over the device's camera, allowing for covert video recording or photography.
• Network: Unrestricted network access, enabling data exfiltration, command and control communication, or further attacks.
• Storage: Read and write access to internal and external storage, compromising user files and system data.
• SMS: Ability to send, receive, and read SMS messages, facilitating phishing, two-factor authentication bypass, or spam.
• Microphone: Covert audio recording capabilities.
• Contacts: Access to the user's entire contact list, enabling further social engineering or data collection.
• Other permissions: The "other permissions" category implies a broad spectrum of additional capabilities not explicitly listed but inherent to the system UID.

The combination of direct remote accessibility (0.0.0.0 binding), high privileges (system UID), and complex message parsing (for signaling and multimedia streams) creates a fertile ground for vulnerabilities. While the specific types of "several series vulnerabilities" were not detailed in the provided transcript (e.g., buffer overflows, integer overflows, logic bugs in state machines, or parsing errors), their cumulative effect is a one-click RCE. Such vulnerabilities often arise in codebases that handle complex, untrusted network input, especially when processing multimedia formats or intricate communication protocols without sufficient input validation, bounds checking, or state management. The fact that these services are installed and run by default on Samsung phones, requiring only a SIM card for activation, makes the attack surface pervasive across a vast user base.

Demo / Proof of Concept

▶ Watch: IS service process: highest privileges and open network ports (4:00)

The talk concluded with the promise of an "awesome video demo," which was prepared to visually illustrate the impact of the discovered vulnerabilities. While the transcript does not provide specific technical details of the demonstration itself, it outlines the critical scenario that the Proof of Concept (PoC) aimed to depict: a victim receives a video call, and "as soon as he or she connects," a hacker takes over the phone.

This demonstration would have served as a compelling visual confirmation of the one-click RCE capability. It underscores that the attack requires no elaborate social engineering beyond prompting the victim to answer an incoming video call. The immediacy of the compromise upon connection highlights the severity of the underlying flaws in Samsung's IMS video service implementation. The PoC likely showcased an attacker remotely initiating a video call, the victim answering, and then the attacker gaining control, potentially demonstrating access to sensitive device functions like the camera, microphone, or file system, thereby validating the full compromise achieved through the system privileges.

Defensive Implications

▶ Watch: High-level overview of IS service communication architecture (4:30)

The discovery of one-click RCE vulnerabilities in a fundamental, high-privilege communication service like Samsung's IMS video implementation carries profound defensive implications for device manufacturers, mobile carriers, and end-users.

For Device Manufacturers (e.g., Samsung):

1. Immediate Patching: The most critical step is the rapid development and deployment of security patches to address the "several series vulnerabilities" identified. This requires thorough code auditing of the com.samsung.ims.service and com.samsung.ims.video components, focusing on input validation, memory safety, state machine logic, and privilege separation.
2. Secure Development Lifecycle (SDL) Review: This incident necessitates a re-evaluation of the SDL for system-level services, especially those handling untrusted network input. Emphasis should be placed on threat modeling, security testing (fuzzing, penetration testing), and code review by security experts.
3. Principle of Least Privilege: Manufacturers should reassess the necessity of such extensive permissions (camera, microphone, storage, SMS, contacts) for a core video decoding/encoding service, particularly its system UID. Where possible, services should operate with the absolute minimum privileges required for their function.
4. Network Exposure Review: The practice of binding critical system services to 0.0.0.0 and exposing them directly to remote networks without robust authentication and authorization mechanisms must be re-evaluated. Stronger network segmentation or access controls should be considered.

For Mobile Carriers:

1. Collaborate with Vendors: Carriers play a crucial role in deploying firmware updates. They must work closely with device manufacturers to ensure that security patches are rolled out swiftly and effectively to all affected devices on their networks.
2. Network-Level Monitoring: While not a direct defense against device-level RCE, carriers can implement advanced network-level anomaly detection to identify suspicious video call patterns or unusual data flows that might indicate an ongoing attack campaign targeting IMS services.

For End-Users:

1. Apply Updates Promptly: Users of Samsung Android phones must prioritize installing system updates as soon as they become available. These updates will contain the crucial security patches for these vulnerabilities.
2. Be Wary of Unknown Calls: While a "one-click" exploit is challenging to defend against, exercising caution with incoming video calls from unknown numbers is a general good security practice. However, it's important to acknowledge that this specific vulnerability bypasses many typical user-level defenses.
3. Understand Device Permissions: While users cannot directly change system service permissions, awareness of the extensive permissions granted to core components like IMS can foster a better understanding of potential risks.
4. Consider Device Security Features: Utilize built-in security features such as Knox on Samsung devices, though these might not fully mitigate a system-level RCE.

Overall, this research highlights the persistent challenge of securing complex, deeply integrated system services in modern smartphones. It underscores the need for continuous vigilance, rigorous security auditing, and a proactive approach from all stakeholders in the mobile ecosystem to protect users from sophisticated remote attacks.

Key Takeaways

• Neglected Attack Surface: The IMS video calling service, specifically Samsung's implementation (com.samsung.ims.service and com.samsung.ims.video), represents a critical, previously under-researched remote attack surface on Android devices.
• One-Click RCE: Researchers discovered multiple critical vulnerabilities enabling a one-click Remote Code Execution (RCE) on affected Samsung smartphones, requiring only the victim to answer a video call.
• High Privilege, Default Exposure: The vulnerable services run with system UID (highest user-space privilege), listen on 0.0.0.0 (remotely accessible), and are installed by default on Samsung phones with a SIM card inserted.
• Low Barrier to Attack: An attacker only needs the victim's phone number, with no account registration or prior interaction required, significantly lowering the complexity of launching an attack.
• Comprehensive Compromise: Successful exploitation grants the attacker extensive control over the device, including access to the camera, microphone, storage, SMS, and contacts.
• Urgent Patching Required: Device manufacturers, particularly Samsung, must prioritize the development and deployment of security patches to mitigate these long-standing vulnerabilities and protect millions of users.

About the Speaker(s)

The presentation was delivered by a team of security researchers. One of the speakers introduced themselves as a 23-year-old student whose research primarily focuses on Windows security and development. They were joined by senior security researchers, who contributed significantly to the presented work. These senior researchers have a notable history of presenting at prestigious security conferences, including Black Hat Asia and Black Hat USA, indicating their expertise and experience in the field of cybersecurity research. While specific names were not provided in the input, the collaboration between a student and senior researchers highlights a blend of emerging talent and seasoned experience in tackling complex mobile security challenges.