Mobile Threat Catalogue

Privilege Escalation via Software Vulnerabilities

Contribute

Threat Category: Mobile Operating System

ID: STA-0

Threat Description: Privilege escalation vulnerabilities in the mobile OS, OS services, service libraries, or the OS kernel itself can allow an attacker to gain unauthorized access to sensitive data or execute arbitrary code from the privileged context to achieve any number of goals.

Threat Origin

Internet Security Threat Report 2016 1

Mobile Security: Threats and Countermeasures 2

Exploit Examples

Zimperium Applauds Google’s Rapid Response to Unpatched Kernel Exploit 3

Remote Code Execution as System User on Samsung Phones 4

CVE Examples

Possible Countermeasures

Enterprise

To reduce the risk to enterprise resources being accessed from vulnerable devices, deploy EMM/MDM solutions that can successfully enforce policies to monitor the OS version of devices and block enterprise connectivity from out-of-date devices or those with known-exploitable privilege escalation vulnerabilities.

To help reduce the latency between exploit notification and patch availability, purchase devices from vendors/carriers who have committed to providing timely updates or who have known track records for prompt updates.

To help reduce the opportunity for attack following availability of patches, configure automatic installation of, or, at a minimum, automatic notification of the availability of mobile OS security updates.

Use tools or device APIs (Android SafetyNet, Samsung Knox hardware-backed remote attestation, or other applicable remote attestation technologies) to detect and block enterprise connectivity from devices that fail attestation or integrity checks.

Disable components with known vulnerabilities (e.g. disable MMS, Bluetooth, etc.) until the vulnerability is patched to prevent exploitation.

Mobile Device User

To help reduce the opportunity for attack following availability of patches, configure automatic installation of, or, at a minimum, automatic notification of the availability of mobile OS security updates.

Disable components with known vulnerabilities (e.g. disable MMS, Bluetooth, etc.) until the vulnerability is patched to prevent exploitation.

References

  1. Internet Security Threat Report vol. 21, Symantec, 2016; https://docs.broadcom.com/doc/istr-16-april-volume-21-en [accessed 8/1/2022] ↩

  2. Mobile Security: Threats and Countermeasures, white paper, MobileIron; www.mobileiron.com/sites/default/files/security/Mobile-Security-Threats-and-Countermeasures-WP-MKT-6361-V1.pdf [accessed 8/25/2016] ↩

  3. zLabs, “Zimperium Applauds Google’s Rapid Response to Unpatched Kernel Exploit,” Zimperium, 25 Mar. 2016; https://blog.zimperium.com/zimperium-applauds-googles-rapid-response-to-unpatched-kernel-exploit/ ↩

  4. R. Welton, “Remote Code Execution as System User on Samsung Phones”, blog, 16 June 2015; www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/ [accessed 8/25/2016] ↩