Keep Me Updated: An Empirical Study of Proprietary Vendor Blobs in Android Firmware

• URL: http://arxiv.org/abs/2410.11075v1
• Date: Mon, 14 Oct 2024 20:36:12 GMT
• Title: Keep Me Updated: An Empirical Study of Proprietary Vendor Blobs in Android Firmware
• Authors: Elliott Wen, Jiaxing Shen, Burkhard Wuensche,
• Abstract summary: We examine over 13,000 Android firmware releases between January 2018 and April 2024. About 82% of firmware releases contain outdated GPU blobs (up to 1,281 days) A significant number of blobs also rely on obsolete LLVM core libraries released more than 15 years ago.
• Score: 2.124303952404961
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Despite extensive security research on various Android components, such as kernel or runtime, little attention has been paid to the proprietary vendor blobs within Android firmware. In this paper, we conduct a large-scale empirical study to understand the update patterns and assess the security implications of vendor blobs. We specifically focus on GPU blobs because they are loaded into every process for displaying graphics user interfaces and can affect the entire system's security. We examine over 13,000 Android firmware releases between January 2018 and April 2024. Our results reveal that device manufacturers often neglect vendor blob updates. About 82\% of firmware releases contain outdated GPU blobs (up to 1,281 days). A significant number of blobs also rely on obsolete LLVM core libraries released more than 15 years ago. To analyze their security implications, we develop a performant fuzzer that requires no physical access to mobile devices. We discover 289 security and behavioral bugs within the blobs. We also present a case study demonstrating how these vulnerabilities can be exploited via WebGL. This work underscores the critical security concerns associated with vulnerable vendor blobs and emphasizes the urgent need for timely updates from device manufacturers.

Related papers

• Outrunning LLM Cutoffs: A Live Kernel Crash Resolution Benchmark for All [57.23434868678603]
  Live-kBench is an evaluation framework for self-evolving benchmarks that scrapes and evaluates agents on freshly discovered kernel bugs.<n> kEnv is an agent-agnostic crash-resolution environment for kernel compilation, execution, and feedback.<n>Using kEnv, we benchmark three state-of-the-art agents, showing that they resolve 74% of crashes on the first attempt.
  arXiv  Detail & Related papers  (2026-02-02T19:06:15Z)
• Jailbreaking in the Haystack [64.82605038772253]
  We introduce NINJA (short for Needle-in-haystack jailbreak attack), a method that jailbreaks aligned LMs by appending benign, model-generated content to harmful user goals.<n>We show that NINJA significantly increases attack success rates across state-of-the-art open and proprietary models, including LLaMA, Qwen, Mistral, and Gemini.<n>These findings reveal that even benign long contexts -- when crafted with careful goal positioning -- introduce fundamental vulnerabilities in modern LMs.
  arXiv  Detail & Related papers  (2025-11-05T01:12:50Z)
• FAARM: Firmware Attestation and Authentication Framework for Mali GPUs [0.463928297802265]
  Recent work has revealed MOLE, the first practical attack to compromise GPU Trusted Execution Environments (TEEs)<n>This paper presents FAARM, a lightweight and cryptographic framework that prevents MOLE-style firmware subversion.<n>FAARM reliably detects and blocks malicious firmware injections, rejecting tampered images before use and denying attempts after attestation.
  arXiv  Detail & Related papers  (2025-10-26T07:46:27Z)
• Match & Mend: Minimally Invasive Local Reassembly for Patching N-day Vulnerabilities in ARM Binaries [5.645823801022895]
  Low-cost Internet of Things (IoT) devices are increasingly popular but often insecure due to poor update regimes.<n>We propose to patch IoT firmware at the binary level, without requiring vendor support.<n>In particular, we introduce minimally invasive local reassembly, a new technique for automatically patching known (n-day) vulnerabilities in IoT firmware.
  arXiv  Detail & Related papers  (2025-10-16T07:31:42Z)
• Empowering IoT Firmware Secure Update with Customization Rights [15.500229921783257]
  We conduct a pilot study on the update of 200 Linux-based IoT devices across 23 vendors.<n>A broader analysis of update-related CVEs from 2020 to 2024 reveals that over half originate from customization-induced issues.<n>We propose IMUP, the first framework to address two key challenges: constructing a trustworthy cross-module integrity chain and scaling update performance under mass customization.
  arXiv  Detail & Related papers  (2025-07-25T15:17:29Z)
• LLMs Caught in the Crossfire: Malware Requests and Jailbreak Challenges [70.85114705489222]
  We propose MalwareBench, a benchmark dataset containing 3,520 jailbreaking prompts for malicious code-generation.<n>M MalwareBench is based on 320 manually crafted malicious code generation requirements, covering 11 jailbreak methods and 29 code functionality categories.<n>Experiments show that mainstream LLMs exhibit limited ability to reject malicious code-generation requirements, and the combination of multiple jailbreak methods further reduces the model's security capabilities.
  arXiv  Detail & Related papers  (2025-06-09T12:02:39Z)
• Vulnerability, Where Art Thou? An Investigation of Vulnerability Management in Android Smartphone Chipsets [2.1959918957023743]
  This paper provides an empirical study of the current state of smartphone chipset vulnerability management within the Android ecosystem. We create a unified knowledge base of 3,676 chipset vulnerabilities affecting 437 chipset models from all four major chipset manufacturers, combined with 6,866 smartphone models. We find that a single vulnerability often affects hundreds to thousands of different smartphone models, for which update availability is, as we show, often unclear or heavily delayed.
  arXiv  Detail & Related papers  (2024-12-09T15:04:50Z)
• Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures [47.435076500269545]
  Apache Log4J was found to be vulnerable to remote code execution attacks. More than 35,000 packages were forced to update their Log4J libraries with the latest version. It is practically reasonable for software developers to update their third-party libraries whenever the software vendors have released a vulnerable-free version.
  arXiv  Detail & Related papers  (2024-11-12T01:55:51Z)
• The Impact of SBOM Generators on Vulnerability Assessment in Python: A Comparison and a Novel Approach [56.4040698609393]
  Software Bill of Materials (SBOM) has been promoted as a tool to increase transparency and verifiability in software composition. Current SBOM generation tools often suffer from inaccuracies in identifying components and dependencies. We propose PIP-sbom, a novel pip-inspired solution that addresses their shortcomings.
  arXiv  Detail & Related papers  (2024-09-10T10:12:37Z)
• AutoFirm: Automatically Identifying Reused Libraries inside IoT Firmware at Large-Scale [13.107464371236148]
  Developers often reuse software libraries in the Internet of Things (IoT) firmware, leading to a major security concern. We propose the AutoFirm, an automated tool for detecting reused libraries in IoT firmware at a large scale. We conduct a large-scale empirical study of reused libraries of IoT firmware, investigating more than 6,900+ firmware and 2,700+ distinct vulnerabilities affecting 11,300+ vulnerable versions from 349 open-source software libraries.
  arXiv  Detail & Related papers  (2024-06-18T09:22:32Z)
• A Risk Estimation Study of Native Code Vulnerabilities in Android Applications [1.6078134198754157]
  We propose a fast risk-based approach that provides a risk score related to the native part of an Android application. We show that many applications contain well-known vulnerabilities that miscreants can potentially exploit.
  arXiv  Detail & Related papers  (2024-06-04T06:44:07Z)
• Manifest V3 Unveiled: Navigating the New Era of Browser Extensions [53.288368877654705]
  In 2020, Google announced a shift in extension development with Manifest Version 3 (V3), aiming to replace the previous Version 2 (V2) by January 2023. This paper presents a comprehensive analysis of the Manifest V3 ecosystem.
  arXiv  Detail & Related papers  (2024-04-12T08:09:26Z)
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models [123.66104233291065]
  Jailbreak attacks cause large language models (LLMs) to generate harmful, unethical, or otherwise objectionable content. evaluating these attacks presents a number of challenges, which the current collection of benchmarks and evaluation techniques do not adequately address. JailbreakBench is an open-sourced benchmark with the following components.
  arXiv  Detail & Related papers  (2024-03-28T02:44:02Z)
• An Investigation of Hardware Security Bug Characteristics in Open-Source Projects [4.526103806673449]
  We perform a deep dive into the popular OpenTitan project, including its bug reports and bug fixes. We manually classify the bugs as relevant to functionality or security and analyze characteristics, such as the impact and location of security bugs. Our results show that 53% of the bugs in OpenTitan have potential security implications and that 55% of all bug fixes modify only one file.
  arXiv  Detail & Related papers  (2024-02-01T15:47:01Z)
• SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices [67.65883495888258]
  We present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud.
  arXiv  Detail & Related papers  (2023-09-26T08:11:38Z)
• Analysis of Longitudinal Changes in Privacy Behavior of Android Applications [79.71330613821037]
  In this paper, we examine the trends in how Android apps have changed over time with respect to privacy. We examine the adoption of HTTPS, whether apps scan the device for other installed apps, the use of permissions for privacy-sensitive data, and the use of unique identifiers. We find that privacy-related behavior has improved with time as apps continue to receive updates, and that the third-party libraries used by apps are responsible for more issues with privacy.
  arXiv  Detail & Related papers  (2021-12-28T16:21:31Z)
• A Survey of Machine Learning Algorithms for Detecting Malware in IoT Firmware [0.0]
  This paper employs a number of machine learning algorithms to classify IoT firmware and the best performing models are reported. Deep learning approaches including Convolutional and Fully Connected Neural Networks are also explored.
  arXiv  Detail & Related papers  (2021-11-03T17:55:51Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.