Bootmode exploit gave attackers ability to hack modem, eavesdrop on calls.

Google has shut down a "high-severity" exploit in its Nexus 6 and 6P phones which gave attackers with USB access the opportunity to take over the onboard modem during boot-up—allowing them to listen in on phonecalls, or intercept mobile data packets.

The vulnerability was part of a cluster of security holes found by security researchers at IBM's X-Force all related to a flaw—tagged CVE-2016-8467—in the phones' bootmode, which uses malware-infected PCs and malicious power chargers to access hidden USB interfaces. Patches were rolled out before the vulnerabilities were made public, in November for the Nexus 6, and January for the 6P.

The exploit also allowed access to find the phone's "exact GPS coordinates with detailed satellite information, place phone calls, steal call information, and access or change nonvolatile items or the EFS partition."

It was complex to activate, requiring the victim to have Android Debug Bridge (ADB) enabled on their devices—a debugging mode used by developers to load APKs onto Android phones—and to have manually authorised ADB connectivity with the infected PC or charger. However, according to the researchers, there were significant workarounds.

The vulnerability in 6P enables the ADB interface even if it was disabled in the developer settings user interface. With access to an ADB-authorised PC, a physical attacker could open an ADB session with the device and cause the ADB host running under the victim’s PC to RSA-sign the ADB authentication token even if the PC is locked.
Such an ADB connection would enable an attacker to install malware on the device. PC malware on an ADB-authorised machine might also exploit CVE-2016-8467 to enable ADB and install Android malware. The PC malware waits for the victim to place the device in the fastboot mode to exploit the vulnerability.

From there, provided attackers had USB access, they were able to reboot the phones into a special bootmode which permanently enabled the various additional interfaces, no longer needing ADB to run.

TJ4TP26.jpg

The older Nexus 6 was more vulnerable to this attack than the 6P, which had its modem diagnostics disabled in the firmware, but it could still be used to break into the modem's AT interface. That interface would let attacks send or eavesdrop on SMS messages and potentially bypass two-factor authentication.

Researchers found a separate vulnerability at the same time in the f_usbnet driver, identified as CVE-2016-6678, "in which 4–5 bytes of uninitialised kernel data are padded to every Ethernet frame carried over USB," effectively allowing attackers to access and compromise network traffic. Google flagged this as "moderate severity," and patched it in October.

The fact that the Nexus 5X isn't in the list means this isn't a bug that automatically affects every phone. That doesn't guarantee there are no other affected devices, but it also means that there is no reason to automatically assume there are.