New acquisition method based on firmware update protocols for Android smartphones

Yang, Seung Jei; Choi, Jung Ho; Kim, Ki Bom; Chang, Taejoo

doi:10.1016/j.diin.2015.05.008

Cited by 35 publications

(13 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Today, smartphones and portable devices are more ubiquitous and powerful than ever before. Android is the most popular mobile operating system, with over 80% market share all over the world (Yang et al, 2015;Zhu et al, 2018). Various computing environments, including MATLAB (https://www.…”

Section: Introductionmentioning

confidence: 99%

CrysX: crystallographic tools for the Android platform

Sharma¹,

Mishra²

2019

J Appl Cryst

View full text Add to dashboard Cite

A set of crystallographic tools for computational modelling and manipulation of molecular structures as well as resolving problems related to crystal structure determination, amongst many other tools for performing multidisciplinary research work, have been developed for the Android platform. Superior graphics quality and ergonomics are the trademarks of this nascent software package, CrysX. The tools are packaged as Android applications (apps) that offer an easy‐to‐use graphical user interface to perform a lot of complex tasks that were once limited to desktop applications. Various tasks including modelling of structures for density functional theory calculations, diffraction pattern simulation and analysis, structure analysis, and calculation of equilibrium energy, bulk modulus, volume etc., can be performed with ease by using smartphones or tablets. The apps aim to increase the productivity of computational condensed matter physicists, chemists and material scientists. The apps can be downloaded and used for free from the Google Play Store or via the link https://bragitoff.com/crysx.

show abstract

Section: Introductionmentioning

confidence: 99%

CrysX: crystallographic tools for the Android platform

Sharma¹,

Mishra²

2019

J Appl Cryst

View full text Add to dashboard Cite

show abstract

“…In recent work, Yang et al (2015) discovered in the firmware update protocol for different brands of Android devices a flash memory read command. By reverse engineering the protocol in the bootloader, the researchers were able to physically acquire the entire flash memory of the device without gaining root privilege and unlocking the screen.…”

Section: Android Acquisition Methodsmentioning

confidence: 99%

Breaking into the vault: Privacy, security and forensic analysis of Android vault applications

Zhang

Baggili

Breitinger

2017

Computers & Security

View full text Add to dashboard Cite

In this work we share the first account for the forensic analysis, security and privacy of Android vault applications. Vaults are designed to be privacy enhancing as they allow users to hide personal data but may also be misused to hide incriminating files. Our work has already helped law enforcement in the state of Connecticut to reconstruct 66 incriminating images and 18 videos in a single criminal case. We present case studies and results from analyzing 18 Android vault applications (accounting for nearly 220 million downloads from the Google Play store) by reverse engineering them and examining the forensic artifacts they produce. Our results showed that 12 ⁄18 obfuscated their code and 5 ⁄18 applications used native libraries hindering the reverse engineering process of these applications. However, we still recovered data from the applications without root access to the Android device as we were able to ascertain hidden data on the device without rooting for 10 ⁄18 of the applications. 6 ⁄18 of the vault applications were found to not encrypt photos they stored, and 8 ⁄18 were found to not encrypt videos. 7 ⁄18 of the applications were found to store passwords in cleartext. We were able to also implement a swap attack on 5 ⁄18 applications where we achieved unauthorized access to the data by swapping the files that contained the password with a self-created one. In some cases, our findings illustrate unfavorable security implementations of privacy enhancing applications, but also showcase practical mechanisms for investigators to gain access to data of evidentiary value. In essence, we broke into the vaults.

show abstract

“…the firmware was at most compressed, not encrypted or otherwise packed). In general, obtaining firmware can be a significant challenge [29], [35], [34]. As our goal is advancing the capabilities in re-hosting firmware, we chose devices for which obtaining the firmware was straight forward.…”

Section: Vxwork Re-hosting Support Layermentioning

confidence: 99%

Is Your Firmware Real or Re-Hosted? A case study in re-hosting VxWorks control system firmware

Clements¹,

Carpenter²,

Moeglein³

et al. 2021

Proceedings 2021 Workshop on Binary Analysis Research

View full text Add to dashboard Cite

servers. This also allows many instances of the system to be started -with the number of instances only limited by the availability of general purpose computing resources.The primary challenge to re-hosting firmware is providing valid inputs for the hardware that is not implemented in the emulator. Emulators such as QEMU [6] provide the ability to emulate a variety of CPU architectures, but provide very limited support for the huge variety of peripherals (e.g., timers, UARTs, Ethernet controllers) used in commodity embedded systems. Many different approaches have been proposed to address these challenges. One approach is to implement the hardware at low-level memory mapped register interface as done in QEMU -a laborious task that does not scale well. Another approach is hardware-in-the-loop emulation [18], where accesses to peripherals are forwarded to physical hardware -which reduces its scalability. Machine learning [14] is an approach where interactions with peripherals are recorded on hardware and used to build models of peripherals. These models are then used during emulation. Another approach is to use a fuzzer [12] to provide inputs for the peripherals. Both machine learning and fuzzing peripherals limits control over the devices making them unsuitable for high fidelity emulation.A promising approach is High Level Emulation (HLE) [8], [7], [10], [11] where common abstractions within the firmware are utilized to remove the need to provide low-level support for peripherals. Both Firmadyne [7] and Costin et al. [10], [11] utilize the Linux kernel abstractions to enable re-hosting Linux based firmware. HALucinator [8] uses hardware abstraction layers provided by micro-controller manufacturers, enabling re-hosting of simple bare-metal applications.Our goal is to advance the art of re-hosting to enable answering questions about how low-level logic and vulnerabilities in Real-Time Operating Systems (RTOS) impact the larger systems in which they are a part. While we are not yet able to achieve this final end goal we report our current progress here. To achieve this goal we extend HALucinator to work with a commercial RTOS. For a more general review of re-hosting we refer the reader to [34]. RTOSes aim to make the process of writing firmware for embedded systems easier. These RTOSes provide the basic constructs for a real-time system and give the developer abstract mechanisms to define system behavior. These mechanisms are often organized as layers, which hide the working details of the system from higher layers. In addition, these operating systems define an interface-called a Board Support Package (BSP)-to enable portability across a large variety of hardware. These layers, and in particular the BSP, provide a natural place for HALucinator to decouple firmware from its hardware and enable re-hosting in an emulator.Here we focus on VxWorks, a commercial RTOS Abstract-Emulating firmware is increasingly popular for systems research, particularly vulnerability research. In this paper we describe how we extend HALuc...

show abstract

New acquisition method based on firmware update protocols for Android smartphones

Cited by 35 publications

References 9 publications

CrysX: crystallographic tools for the Android platform

CrysX: crystallographic tools for the Android platform

Breaking into the vault: Privacy, security and forensic analysis of Android vault applications

Is Your Firmware Real or Re-Hosted? A case study in re-hosting VxWorks control system firmware

Contact Info

Product

Resources

About