Friday, 29 June 2018
No matter how secure Google calls its mobile operating system, it seems like a determined security researcher could come up with a vulnerability any day. A team of eight researchers has done the same with their exploit having a fancy name RAMPAGE (CVE-2018-9442), which enables unauthorized access to Android devices.
What is RAMPAGE attack?
In 2012, with the release of Android ICS, Google introduced a new component to the Android kernel called ION that allocates memory for different apps and services. RAMPAGE targets ION, thus, making itself a threat to millions of Android devices across the world.
However, Android isn’t to be blamed entirely. The attack originates out of a fundamental, more of a hardware error in the RAM chips called Rowhammer which works on ARM-based devices. In modern RAM chips, the memory cells are packed very close to each other. This could result in the cells leaking their charge and interact with other cells.
Each memory cells contains one memory bit which represents a unit of data in the RAM chip. An attack leveraging row hammer can be used to extract data from the RAM chip by changing the state of a memory bit from 0 to 1 and vice-versa, i.e., bit flipping.
How does RAMPAGE work?
A malicious app fitted with RAMPAGE can use the ION memory subsystem and cause a row of memory bits to change its state repeatedly until bit flipping happens in the adjacent row.
This way, an app could potentially attain admin level privileges to access the data of some other app which is not possible in regular scenarios. It can harvest confidential information like passwords from a password manager or browser, documents, photos, messages, etc.
“RAMPAGE breaks the most fundamental isolation between user applications and the operating system. This attack allows an app to take full administrative control over the device,” wrote the researchers on the website describing the attack.
Does it affect my device?
As mentioned above, every Android 4.0 and above devices released since 2012 that use LPDDR2, LPDDR3, or LPDDR4 RAM chip come under the radar. Although it’s not confirmed the attack could be crafted for iOS, Windows, MacOS, and also cloud servers.
However, the story isn’t as scary as it sounds. Modern operating systems don’t write all the information about an app in adjacent memory cells; it’s scattered across different cells. So, the process of flipping the bits may be easier but knowing what’s written on the memory bit isn’t.
An average Android smartphone with 32GB memory capacity has 32 billion bits. Given this fact, it would be nearly impossible for an attacker to pinpoint a particular piece of information. It’s nothing but a game of chance.
What should I do?
You can sit back and try not to worry. Google and Amazon are already notified about the RAMPAGE so it’s less likely that some malicious app would appear on Google Play. Moreover, it’s not known if the vulnerability is being exploited in the wild.
How do I check whether my device is vulnerable to RAMPAGE?
If you want, you can check whether your device is vulnerable to RAMPAGE by using the test app [direct link] created by the researchers. They have also created an app called GuardION which is meant to prevent attacks from modifying the memory cells.
It’s not the first time we have seen attack methods trying to explore hardware errors. In a similar attempt, a row hammer based attack called DRAMMER appeared in 2016 that affected Android devices.
Back then, there was a sense of satisfaction as it was less effective on LPDDR4 memory, but this doesn’t seem to be the case with RAMPAGE. Hopefully, devices makers and Google would come up with security patches soon.
Source: RAMPAGE via Android Central
