Lewei Qu is the head of a security team in an automotive company in China. He leads the team to protect the cooperative vehicle infrastructure system and improve the level of network and data security of the company.
Debug modules are important parts of the Android ecosystem. they can capture logs and exceptions for all levels and support vendor-specific verification of functions. When exceptions occur in the system, the debug modules can help to discover problems and improve product quality. However, due to the fragmentation of the Android ecosystem, vendors customize their own debug features to adapt to hardware-related functional verification or factory testing. Therefore, vendors design specific debug modules to obtain logs, manage exceptions, and factory testing.
Since the debug modules need to obtain information at all levels of the system and expose them to users for operation verification. The security risks are introduced such as local privilege escalation and information leakage. In some scenarios, attackers can use the debug modules to obtain sensitive information and bypass permission control to execute privileged instructions. Based on the attack surfaces, we found dozens of security issues in 3 vendors and obtained 49 CVEs credits.
In this session, we first introduce the native debug architecture of Android. Then we take two vendors’ debug architectures as examples to introduce vendor-specific debug modules. Secondly, we build a threat model for the debug modules and analyze the attack surfaces. Finally, the interesting cases discovered are introduced, and security suggestions are proposed.