Devices with Qualcomm chipsets, especially smartphones and tablets, are vulnerable to a new security bug that allows attackers to retrieve private data and encryption keys that are stored in a secure area of the chipset known as the Qualcomm Secure Execution Environment (QSEE).
Qualcomm says they have deployed patches for this bug (CVE-2018-11976) earlier this month; however, knowing the sad state of Android OS updates, this will most likely leave many smartphones and tablets vulnerable for years to come.
What exactly is Qualcomm’s QSEE?
The vulnerability exploits how the Qualcomm chips (used in hundreds of millions of Android devices) handles data processed inside the QSEE.
The QSEE is a Trusted Execution Environment (TEE), something like Intel’s SGX.
In layman terms it’s a hardware-isolated area on Qualcomm chips where the Android OS and app developers can send data to be processed in a safe and secure environment, and the Android OS and no other app can reach and access the sensitive data, except the application that placed the data there, in the first place.
Data processed inside the QSEE usually includes private encryption keys and passwords, but the QSEE can handle anything an app wants to hide from prying eyes.
To exploit this vulnerability, an attacker would need root access on a device, but this isn’t actually such a big hurdle as it sounds because malware that can gain root access on Android devices is quite common these days, being spotted in many places, and even on the Play Store itself.
In March last year, Keegan Ryan, a security researcher with the NCC Group, discovered that Qualcomm’s implementation of the ECDSA cryptographic signing algorithm allowed for the retrieval of data processed inside the QSEE secure area of Qualcomm processors.
“This should not be possible, since the hardware-backed keystore is supposed to prevent any sort of key extraction, even against an attacker who has fully compromised the Android OS,” Ryan said.
This is not the first time security researchers have found a vulnerability that allows attackers to retrieve data from the QSEE.
A similar issue (CVE-2015-6639) was disclosed in May 2015 by security researcher Gal Beniamini.
