Dynamic Library Hijacking Vulnerability in BB10

While investigating alternative vectors for privilege escalation on BlackBerry 10, an interesting binary loading behavior was identified.

The vast majority of stock signed applications share a similar property in their MANIFEST.MF: Entry-Point: LD_LIBRARY_PATH=app/native/lib:/usr/lib/qt4/lib CASCADES_THEME=dark app/native/BBVE.so

This indicates that the dynamic loader prioritizes app/native/lib when searching for shared object dependencies required by the executable.

Exploitation Mechanics

For installed applications, the OS fails to check whether a file present on disk is actually listed in MANIFEST.MF. Consequently, signature verification is entirely skipped for such unlisted files.

This behavior allows us to:

  1. Inspect which shared libraries (.so) the target binary imports.
  2. Place a proxy library or patch an unlisted dependency inside app/native/lib.
  3. Achieve code execution with the target process's elevated system privileges without breaking app signatures.

Boot Persistence & Escalation

Another key finding involves background services triggered at startup. If an application defines an entry point such as: Entry-Point: [path=(cg660)sys.socialconnect.facebook/default:(cg660)sys.facebook/default:(fg660)sys.socialconnect.facebook/default:(fg660)sys.facebook/default timeout=20] LD_LIBRARY_PATH=app/native/lib:/usr/lib/qt4/lib CS4_ASSET_CACHE_ENABLED= CASCADES_THEME=bright app/native/service_app -t 300 libfacebook_plugin.so.1

...arbitrary code execution can be triggered automatically during system boot in the background process's context, providing a seamless mechanism for persistence and privilege escalation.

This exact vulnerability serves as the core exploitation vector for AutoRoot v4.

Limitations

Notably, the highest-privileged target—the Android Runtime subsystem—does not exhibit this vulnerability pattern.