UNISOC reached an 11% global market share of Smartphone Application Processor (AP) at the end of 2021
UNISOC produces budget chipsets that power 2/3/4/5G devices ranging from smartphones to smart TVs. UNISOC is extremely popular in Africa and Asia due to their low end prices. By the end of 2021, UNISOC was reported to be the fourth largest smartphone chip manufacturer globally (following MediaTek, Qualcomm and Apple), with an 11% global market share.
Despite the fact that UNISOC has been on the market for a long time, the UNISOC chip firmware, including the radio modem (AKA baseband), has not been studied extensively. There are no references for any UNISOC baseband vulnerabilities on the Internet to date, and this served as primary motivation for our researchers.
The smartphone modem is a prime target for hackers as it can be potentially reached remotely through SMS or radio packet.
Check Point Research has unveiled several vulnerabilities that can jeopardize the modem’s and other chip related weaknesses that can put Android mobile users at risk.
We decided to conduct an analysis of the UNISOC baseband to possibly find a way to remotely attack UNISOC-based devices, after which to collaborate with the manufacturer and find a solution to this troubling scenario.
Our researcher reverse-engineered the implementation of the LTE protocol stack and indeed discovered a vulnerability that could be used to deny modem services, and potentially even block communications by a threat actor, from remote.
Exploiting this vulnerability can be used to disrupt the device’s radio communication through a malformed packet. An attacker or even a military unit can leverage such a vulnerability to neutralize communications on the attacked devices.
Responsible disclosure
Check Point Research reached out to the UNISOC teams in May 2022 and disclosed these findings. UNISOC acknowledged the findings and, gave the vulnerability a 9.4 scoring (critical), and patched it.
Google have updated that they will be publishing the patch in the upcoming Android Security bulletin.
We recommend mobile users to always update their phone’s OS to the latest version.
Check Point’s customers remain fully protected against such threats while using Harmony Mobile Security.
Slava Makkaveev, Reverse Engineering & Security Research attorneys at Check Point Software says “We are the first to reverse-engineer and investigate the UNISOC modem for vulnerabilities. We found a vulnerability in the UNISOC modem built into 11% of smartphones. An attacker could have used a radio station to send a malformed packet that would reset the modem, depriving the user of the possibility of communication. Left unpatched, cellular communication can be blocked by an attacker. The vulnerability is in the modem firmware, not in the Android itself. There is nothing for Android users to do right now, though we strongly recommend applying the patch that will be released by Google in their upcoming Android Security Bulletin.”
