Orange Tsai Details Three Years of Sonos Vulnerability Research
· 47:14 · Watch on YouTube ↗
Summary
Orange Tsai recounts three years of Sonos Pwn2Own research, including media-parser vulnerabilities, failed exploit attempts and a previously harmless code path that became exploitable after an update.
Key points
- An initial firmware-parser buffer overflow was exploitable on older firmware but did not work against the current version.
- In the second year, Tsai used a DMA attack to obtain a local root shell and analyze device binaries, leading to an integer underflow in MP3 metadata parsing.
- In the third year, an MP4 parser stack-clash exploit was completed shortly before a Sonos update patched the bug.
- A later exploit combined an XML callback out-of-bounds write with an information leak, but another update removed access to the vulnerable function.
- A previously non-vulnerable metadata parsing path became a stack overflow after an architectural change and was demonstrated at Pwn2Own.
- Tsai suspected Sonos was analyzing uploaded crash dumps, but presented this as an inference rather than a confirmed explanation.
Article Details
- Topics
- [02:22] Initial black-box research and firmware-parser overflow
- [11:09] Hardware setup and DMA-based access to device binaries
- [16:14] Media metadata analysis and MP3 integer underflow
- [25:30] MP4 stack clash and exploit timing
- [32:33] XML callback flaw and information leak
- [40:27] A previously harmless parser path becomes exploitable
- [42:50] Research methodology and lessons learned