Skip to content

T1404 Exploitation for Privilege Escalation

Adversaries may exploit software vulnerabilities in order to to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in an application, service, within the operating system software, or kernel itself to execute adversary-controlled code. Security constructions, such as permission levels, will often hinder access to information and use of certain techniques. Adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

When initially gaining access to a device, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and applications running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user- level permission to root permissions depending on the component that is vulnerable.

Item Value
ID T1404
Sub-techniques
Tactics TA0029
Platforms Android, iOS
Version 2.1
Created 25 October 2017
Last Modified 20 March 2023

Procedure Examples

ID Name Description
S1061 AbstractEmu AbstractEmu can use rooting exploits to silently give itself permissions or install additional malware.5
S0440 Agent Smith Agent Smith exploits known OS vulnerabilities, including Janus, to replace legitimate applications with malicious versions.8
S0293 BrainTest Some original variants of BrainTest had the capability to automatically root some devices, but that behavior was not observed in later samples.12
S0550 DoubleAgent DoubleAgent has used exploit tools to gain root, such as TowelRoot.4
S0420 Dvmap Dvmap attempts to gain root access by using local exploits.13
S0405 Exodus Exodus Two attempts to elevate privileges by using a modified version of the DirtyCow exploit.14
S0182 FinFisher FinFisher comes packaged with ExynosAbuse, an Android exploit that can gain root privileges.2
S0290 Gooligan Gooligan executes Android root exploits.6
S0322 HummingBad HummingBad can exploit unfixed vulnerabilities in older Android versions to root victim phones.7
S0463 INSOMNIA INSOMNIA exploits a WebKit vulnerability to achieve root access on the device.11
S0316 Pegasus for Android Pegasus for Android attempts to exploit well-known Android OS vulnerabilities to escalate privileges.1
S0289 Pegasus for iOS Pegasus for iOS exploits iOS vulnerabilities to escalate privileges.15
S0294 ShiftyBug ShiftyBug is packed with at least eight publicly available exploits that can perform rooting.16
S0327 Skygofree Skygofree has the capability to exploit several known vulnerabilities and escalate privileges.10
S0324 SpyDealer SpyDealer uses the commercial rooting app Baidu Easy Root to gain root privilege and maintain persistence on the victim.3
S0494 Zen Zen can obtain root access via a rooting trojan in its infection chain.9

Mitigations

ID Mitigation Description
M1002 Attestation Device attestation can often detect jailbroken or rooted devices.
M1010 Deploy Compromised Device Detection Method Mobile security products can potentially detect jailbroken or rooted devices.
M1001 Security Updates Security updates often contain patches for vulnerabilities.

Detection

ID Data Source Data Component
DS0041 Application Vetting API Calls
DS0013 Sensor Health Host Status

References

  1. Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017. ↩

  2. Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018. ↩

  3. Wenjun Hu, Cong Zheng and Zhi Xu. (2017, July 6). SpyDealer: Android Trojan Spying on More Than 40 Apps. Retrieved September 18, 2018. ↩

  4. A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020. ↩

  5. P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023. ↩

  6. Check Point Research Team. (2016, November 30). More Than 1 Million Google Accounts Breached by Gooligan. Retrieved December 12, 2016. ↩

  7. Dan Goodin. (2016, July 7). 10 million Android phones infected by all-powerful auto-rooting apps. Retrieved January 24, 2017. ↩

  8. A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020. ↩

  9. Siewierski, L. (2019, January 11). PHA Family Highlights: Zen and its cousins . Retrieved July 27, 2020. ↩

  10. Nikita Buchka and Alexey Firsh. (2018, January 16). Skygofree: Following in the footsteps of HackingTeam. Retrieved September 24, 2018. ↩

  11. A. Case, D. Lassalle, M. Meltzer, S. Koessel, et al.. (2020, April 21). Evil Eye Threat Actor Resurfaces with iOS Exploit and Updated Implant. Retrieved June 2, 2020. ↩

  12. Chris Dehghanpoor. (2016, January 6). Brain Test re-emerges: 13 apps found in Google Play Read more: Brain Test re-emerges: 13 apps found in Google Play. Retrieved December 21, 2016. ↩

  13. R. Unuchek. (2017, June 8). Dvmap: the first Android malware with code injection. Retrieved December 10, 2019. ↩

  14. Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved September 3, 2019. ↩

  15. Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016. ↩

  16. Michael Bentley. (2015, November 4). Lookout discovers new trojanized adware; 20K popular apps caught in the crossfire. Retrieved December 21, 2016. ↩