Slashdot Mirror
Researcher To Release Web-Based Android Attack
CWmike writes "A computer security researcher says he plans to release code Thursday that could be used to attack some versions of Google's Android phones over the Internet. The attack targets the browser in older, Android 2.1-and-earlier versions of the phones. It is being disclosed Thursday at the HouSecCon conference by M.J. Keith, a security researcher with Alert Logic. Keith says he has written code that allows him to run a simple command line shell in Android (video) when the victim visits a website that contains his attack code. The bug used in Keith's attack lies in the WebKit browser engine used by Android. Google said it knows about the vulnerability. 'We're aware of an issue in WebKit that could potentially impact only old versions of the Android browser,' Google spokesman Jay Nancarrow confirmed in an e-mail. 'The issue does not affect Android 2.2 or later versions.' Version 2.2 runs on 36.2 percent of Android phones, Google says"
So many phone makers seem to think the worst thing in the world is to provide users an official update. Maybe this will get them in gear.
As an aside, does anyone know what phone makers are good about keeping updates coming?
What about the rest on versions lower than 2.2?
Isn't this roughly similar to the effects obtained by the earlier exploits on iOS? However, there many users first feeling was some relief from the monolithic Apple gate system, but here on Android the spin feels more like traditional tech news.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
irony
did you forget to take your meds?
testing security infrastructure for consenting users
How can he be permitted to release something, which when used as intended, does harm to others?
For the same reason that tobacco manufacturers are permitted the same thing.
Isn't this roughly similar to the effects obtained by the earlier exploits on iOS?
Technically it is. But unless you bought your Android phone from AT&T, you have the option to put in your own command prompt through "Unknown sources". So any jailbreaks for Android are considered less necessary, and the risk outweighs the benefit.
Because we've seen from history that most companies won't patch an exploit unless it's screaming at them, and that most exploits are picked up by people who wish actual harm on you before security researchers find them.
Hopefully this will force some device manufacturers to release 2.2 updates for their devices, and with any luck it'll teach them to stick with stock android rather than loading crapware.
--sitharus
Thomas A. Anderson is specialized in killing Agents, John Connor in killing Terminators, and now M.J. Keith kill Androids... that comes just in time when Hollywood was running out of ideas for a new movie.
"A computer security researcher says he plans to release code Thursday that could be used to attack some versions of Google's Android phones over the Internet. The attack targets the browser in older, Android 2.1-and-earlier versions of the phones.
How can he be permitted to release something, which when used as intended, does harm to others? This is insane...and he does it "in the light of day!"
Other tools that folks have used to harm others have dual use...but for this code, I do not see any use save for harm. What am I missing?
He is publishing code that can be used to exploit a vulnerability. This could be used for malicious purposes, or it could be used for security demonstrations, as an example to be taught to infosec students or any of a ton of other academic and/or security-related purposes. He is not actually using the code to do anything malicious. Please tell me exactly what statute he is in violation of? Are you saying that no one should ever publish code for exploits?
Social Engineering Expert: Because there is no patch for stupidity.
"A computer security researcher says he plans to release code Thursday that could be used to attack some versions of Google's Android phones over the Internet. The attack targets the browser in older, Android 2.1-and-earlier versions of the phones.
How can he be permitted to release something, which when used as intended, does harm to others? This is insane...and he does it "in the light of day!"
Other tools that folks have used to harm others have dual use...but for this code, I do not see any use save for harm. What am I missing?
Either your just whooshing, or you just got whooshed by the submitter and the rest of this community.
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
I read the headline and immediately thought a mad scientist was about to unleash an army of things resembling a cross between Spiderman and the Terminator, and we should all cower in terror in our makeshift basement bunkers awaiting our inevitable destruction.
But TFA revealed it's just a smartphone hack.
All we need is a brand of toilet paper called "Flying Car" and my disappointment with the 21st century will be complete.
Blank until
Headline = 1,000,000 points. Copy = I don't know - about a dozen points. Maybe.
I can understand your point of view. But look at mine pov. It's better to have a dude with an agenda including things as: job improvement, proof of concept releasing this then it it that Group X with selfenrichment AND costing damage to you releases it. It's gonna be released anyway. That's for sure.
This is a known exploit, Google has patched it. It isn't like this is some secret thing that no one would have known about if he didn't release it; anyone who actually cares (and has the technical ability) already has the exploit. So he is not harming you really.
Typically it is considered bad form for security researchers to release exploits before informing the manufacturer. Once the manufacturer has long enough to fix it, if then it is ok to release it. Experience has shown that sometimes this is the only way to pressure manufacturers into patching it.
Another use for the code is so you can learn. I appreciate it when researchers release the code; a lot of hackers try to keep their techniques secret, and we are all worse off for it.
Qxe4
As the owner of a Samsung Galaxy S phone, the manufacturer Samsung has released its 2.2 version for a while. Unfortunately, since I'm under the TMobile carrier, I'm still stuck with 2.1. They said it'll be updated by the end of the year, and every time TMo makes a prediction, it usually takes another 3 months - so March 2011 for me. Why the delay? Probably to keep its bloatware and layout working.
I'll be luck if I don't lose my data by then.
You won't lose your data. The exploit doesn't allow full access to the phone. Still, you ought to have a backup of all that data anyway, in case your phone gets run over by a truck.
Qxe4
I wonder if there is any law which covers this sort of situation. The original G1 was only released like 3 years ago - not really very old, but T-Mobile has completely abandoned owners/users of the G1 and is not providing any additional updates.
Honestly, I blame Google. From day 1, it should have been mandatory that OS updates would come from Google, forever. Carriers don't give a crap about keeping users in updated code once the phone is sold. To them, it's just a device which comes in a box, gets sold, and if it becomes 'obsolete' within 2 years, well that's just another box they can sell you in 2 years.
It's absolutely inexcusable that a programmable, Internet enabled device of the complexity of a G1 should not have guaranteed security updates for the included software, for a minimum of 10 years.
...in case your phone gets run over by a truck.
:-}
That isn't as silly as it sounds. I drove my tractor (twice - forwards and backwards) over my Motorola Razr2 V9 a few months ago. Funny thing is, although the phone looked a bit of a mess, it was still working after that. I guess that qualifies as an endorsement.
I was tempted on several occasions to drive over my old RAZR, or throw it out of the window. I always thought that Moto's hardware designers might have put some extra effort into the robustness of the handset given they knew what software was going to end up on there...!
Agreed about their software. But I don't use the device for much more than making calls and sending text messages, for which it's adequate. That handset is really beginning to flake out now, so I'll have to take a look at the competition. Yes, I am still using it - in a way, it's kind of cool to have a phone that has been so extensively abused. ;-}
50% tangent, MS Security Essentials is flagging Firesheep on me, even though it's more of a security risk to *other* people. They're banking on the lowest X % being so scared to get away from the "Nice Safe Green" effect.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
No code release is necessary, just research what API call is broken and how. The purpose of such information is to fix the bug and allow for users to mitigate the attack vector, if possible. Without this information, only black hats can steal your information without you even being aware it was possible.
Yes, but the problem (as with Firesheep) is that what was once something requiring technical knowledge becomes easily available to script kiddies.
It's like why you don't generally sell alcohol or guns to children.
To have a right to do a thing is not at all the same as to be right in doing it
I've been with AT&T for a long time, bought the Galaxy S (Captivate) relatively not too long ago. Was perfect when I bought it, did everything I wanted it to do, especially tethering, one of the big reasons I bought it.
A couple weeks down the line, 2.1-update1 rolls out, disables my tethering abilities. I called AT&T, Samsung, talked with an in-store rep, and called AT&T again. Samsung says it's not their problem, AT&T pushed the update. The In-store rep and the person I talked to on the AT&T phonecall both agreed that I needed to use third-party software to continue tethering. They were pretty much ENCOURAGING ME TO ROOT MY PHONE. The solution I found was to use a third-party tethering app which I had to remove the AT&T sim card in order for it to show in the marketplace, install, then reinsert the sim card.
Still waiting for that 2.2 update that I was promised when I bought the phone.
Starting to look more and more like I should just return the phone, drop AT&T, and move to another Galaxy S carrier.
Yes, there will be a lot of trouble once people lose all their contacts & emails, buy a random Market app for 1000 and similar.
But this will _force_ makers, vendors, network operators and everyone else to introduce sane update policies. These machines are a small PC. They need the same software update capabilities.
It's phone makers AND carriers. The only real reason carriers are loving Android is it's the Anti-iPhone. Think about it - the iPhone denies carriers to ability to customize the experience, load up custom helpful apps, and all that stuff. Apple's basically dictated the terms - Apple does the software, you guys sell service (and pay Apple a portion of the profits). The only reason carriers are doing this is because people want the iPhone and they'll line up in droves to get one. What they lose in the iPhone deals, they make up because there are just so freaking many iPhone users (see how the iPhone has been kind ot AT&T's revenue).
I just saw in the news that Verizon's Android customers are getting an update that will be pushed on them over the Verizon network starting next week. It will add V-Cast and the V Cast store so you can add Verizon approved apps to your Android. This is the same crap I had years ago from Verizon on my LG phone.
So Verizon may not have fixed the browser problem but the Android user has a pretty red Verizon V-Cast interface to work with.