Dark Side of the Shader: Mobile GPU-Aided Malware Delivery

Mobile phones are the most intimate computing devices of our time. We use them for private and business purposes. At the same time lax update habits of manufacturers make them accumulate disclosed vulnerabilities. That is why smartphones have become very attractive targets for attackers. Until today Graphics Processing Units (GPU) were not considered an interesting mean of payload delivery in mobile devices. However, in this paper, we present how the Direct Memory Access (DMA) capabilities of a mobile GPU can be abused for a privilege escalation attack. We describe a successful and real-world GPU-based attack, discuss problems that the GPU's different programming model poses, and techniques that lead to a successful attack. We also show a proof-of-concept exploit against a very popular smartphone line. We conclude that DMA-based malware is a serious threat to mobile devices.