Slashdot Mirror
Silent, Easily Made Android Rootkit Released At DefCon
An anonymous reader writes with news that security experts from Spider Labs released a kernel level rootkit for Android devices at DefCon on Friday. "As a proof of concept, it is able to send an attacker a reverse TCP over 3G/WIFI shell upon receiving an incoming call from a 'trigger number.' This ultimately results in full root access on the Android device." The rootkit was developed over a period of two weeks, and has been handed out to DefCon attendees on DVD.
Do you have to have a rooted device already in order to install it or does it use an exploit to gain this? Will it show the usual warnings about permission requirements when installing?
If it does use an exploit, it would be interesting to use this for regular rooting of the devices.
I've noticed a 0-day vulnerability in old ladies in that I can hit them over the head with a cudgel and steal their handbags. I'm going to a black-hat muggers conference to hand out cudgels and more detailed instruction. But that doesn't make be an utter scumbag, oh no. I'm a "security researcher", that's what I am, only interested in increased security for old ladies.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
... an important question.
(The spider labs people claim) they did this to prompt Google to issue a fix. However, since the carriers seem to be very slow in updating the Android OS for their phones (a substantial number, perhaps a majority have never received an update), WHEN CAN WE EXPECT A FIX to get to the millions of phones out there? Compare this to the Apple ecosystem which received an update for their (admittedly widely publicized) Antennagate issue within weeks (whether or not it actually fixed anything is another question). In general Apple devices are (forcibly?) updated much more quickly. Perhaps this is because of his holinesses... I mean Steve Jobs powers of persuasion. ;)
Of course as an A/C I can't prove it but if you look at the submission, you'll see that's what I said. I no longer login because I feel that while attacking a company's products is fair game (specifically Apple), having stories singling out their users as "selfish" and unkind is not "news for nerds stuff that matters". Am I an Apple fanboi? Let's just say I've used NIX for decades (yes I'm old) and I'm not talking OS X.
1st:
Not news. Anything with a processor in it can run software. That software can do a number of things, and, considering that the processor is turing complete, it can actually do anything. Including allowing remote stealth access. That is NOT news and is NOT a vulnerability or anything to get excited about. Show me that you found a buffer overflow in Android's TCP stack that allows you to run arbitrary code on the device remotely. Of course you can put a rootkit in there after gaining access, you could run tetris for all I care. If you need unlimited rw access to the software to setup your malware, that is not fucking news.
2nd:
FTFA:
"Attendees pay $140 in cash to attend and are not required to provide their names to attend the conference. Law enforcement posts undercover agents in the audience to spot criminals and government officials recruit workers to fight computer crimes and for the Department of Defense."
(Reporting by Jim Finkle; additional reporting by Alexei Oreskovic in San Francisco; editing by Andre Grenon)
Wow. Just wow. Attentive Attendees attend to the conference. No shit. Andre Grenon could be a /. editor.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
It seems the main attack vector would be a "rogue app", just like with this recent story.
;)
I deem myself lucky that all software I have installed on my N900 is open source, which means I (or anyone else) can check the code, compile it and improve it anytime I feel the need to - it's as simple as on any debian based system, "apt-get source", "make" etc. - That alone makes it the superior platform imho, though obviously it doesn't come with all the bling-bling apps and games that Apfel and Google supplies you with. For me openness trumps gimmicks anytime.
It also don't hurt that many of the tools and scripts I use on my Ubuntu workstation can directly be used on the phone as well.
On a tongue in cheek note: the only two packages (out of 868) that vrms admonishes about are "human-icon-theme" and "tangerine-theme" - but they probably don't pose a security risk
And when you gaze long enough into the code, the code will also gaze into you.
Exactly. A rootkit doesn't let you hack into the device, it's not an exploit, and this doesn't mean Android is vulnerable. It's a program that runs after you already have access to the device. In fact, I have no doubt that there are hundreds of thousands of programmers here on Slashdot who could write an Android rootkit in an afternoon.
Qxe4
If you can "self-destruct" a phone that way, then it becomes a nifty way to do a DoS attack on those phones.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
You don't need to flash your phone to root it. (How do you flash your phone without rooting it?) Here's how I did mine.
It means that the rootkit can establish a connection from the victim to the attacker and receive orders from him/her. Since it's TCP i'm guessing it can also connect to IRC and other services that use TCP rather than UDP or more obscure protocols.
Therefore if the Android OS is to be shown to be secure, even against apps that user load on the phone, because there is no way a priori to know if an App is malicious, developers must write potentially malicious apps and test if they will cause harm or not. We already know from this conference that "Jackeeey Wallpaper" collects and publishes phone numbers and browser history from the phone, not a huge data breach, but shows the open garden is not fully protected.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
So yet more developers want to make a make for themselves by elevating a non-issue. I am currently attending their talk, and must admit that I am disappointed.
The first half of the presentation is them chatting about.how rooting a phone is desirable due to its intimate association with the user.No shit! Everybody knows this.
So let's get to the interesting part: There is no new attack vector. No propagation from Dalvik VM to kernel. No new technique. They wrote a Linux rootkit, like anyone can do. It is a kernel module. Anyone can make one of those. It hooks the kernel in various places to hide itself from various process / module listings. How innovative? Please.
The call this an exploit ... nothing is exploited. They willingly participate in the installation at the root level. Their conclusion seems to be that someone with root has access to everything on a system. Shocking, eh?
The only funny part is that this took them 2 weeks to create. How terribly disappointing.