Slashdot Mirror
Silent, Easily Made Android Rootkit Released At DefCon
An anonymous reader writes with news that security experts from Spider Labs released a kernel level rootkit for Android devices at DefCon on Friday. "As a proof of concept, it is able to send an attacker a reverse TCP over 3G/WIFI shell upon receiving an incoming call from a 'trigger number.' This ultimately results in full root access on the Android device." The rootkit was developed over a period of two weeks, and has been handed out to DefCon attendees on DVD.
iPhone will always be the safest phone, all you linux and windows noobs getting your viruses and what not. All hail Apple!
This is not a helpful development. Just another assh--- trying to show off what he (or she) thinks he can do better.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Wouldn't it be trivial for a developer to add the code to an app store offering that seems to have some legitimate need for any permissions requested?
Ok as an android developer, you can't break out of the VM. period. that's the whole point of it. this exploit they are talking about is a kernel driver which you would include in a custom rom that you download from, say, sdx-developers (shoutout!). Now once you have a kernel rootkit, well you know the hell that can cause. But let's face it folks, mobile computing is here to stay. This is no different than having a rootkit on your windows box and tethering it through your phone. All the phone company sees are packets. It's also time to realize that our phones are full fledged computers. You gotta protect them.
Really? Can't break out of the VM, period?
If the application uses this little toolchain to provide a native code .so, you're able to break right on out of the VM, possibly never to return. It's not very hard at all- and there's a host of possible exploits to apply once you're in that space, all depending on how locked down the user account actually is on your Android device.
Let's all face a real fact here. Security has little to do with technology in and of itself. There's an aspect of it within the design of something, but in the end it's people that provide security as well. You would fail at securing something outright- you lay entirely too much faith in things like a VM to protect your system design.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
This is no different than having a rootkit on your windows box and tethering it through your phone. All the phone company sees are packets. It's also time to realize that our phones are full fledged computers. You gotta protect them.
Eh, oops... You just lost 99% of the general audience.
The phone that will win the market is the phone made where the hardware/software/service providers are willing to guarantee to you to make consistent and continued effort to protect our phone from malware and problems, versus just declare it a "computer" and let YOU do it.
I'd think I'd rather have my phone brick than get rooted, as long as there's some way I can reset it to factory config.
If you're going to believe in advertising, you might as well believe in magic anyway
"A wise man once said that any sufficiently advanced technology is indistinguishable from magic"
for many people we've reached that point
What the hell are you talking about?
The OP makes a perfectly valid point...
Little sensitive much?
In this case, the little old ladies already have to be holding the cudgel as well as the handbag.
computers and other devices are simply magic.
Why wouldn't they; some of them are even advertised that way.
Like my electronics teacher told my class "if you really think that n-p-n junctions are actually how semi-conductors work, you'll believe anything you are told".
The scientific and logical explanations for the phenomena that underlie the technology we use are simply that, explanations. You'll never see n-p-n junctions under any microscope, because there probably aren't any.
Even if there were, think about it, it won't make the phenomena of natural processes any less magical.
All is magic...
I get up, I get down...
And have you?
If you haven't, you're not that much better off. Assuming others have read the source and checked for security isn't a very good policy.