Slashdot Mirror
Android Hacked Via NFC On the Samsung Galaxy S 3
An anonymous reader writes with an item from The Next Web: "Security researchers participating in the Mobile Pwn2Own contest at the EuSecWest Conference in Amsterdam [Wednesday] demonstrated how to hack Android through a Near Field Communication (NFC) vulnerability. The 0day exploit was developed by four MWR Labs employees (two in South Africa and two in the UK) for a Samsung Galaxy S 3 phone running Android 4.0.4 (Ice Cream Sandwich). Two separate security holes were leveraged to completely take over the device, and download all the data from it."
This was hacked via NFC. But I live in Pittsburgh, and the Steelers are in the AFC.
So I can assume I am safe?
At the same event, they also hacked iOS6. Just to give an unbiased view...
Help I am stuck in a signature factory!
Hopefully they actually patch something like this, but knowing Verizon, AT&T, etc it won't for at least 6 months
This will be a big boon for Android. Given the current infatuation with government invasion of privacy here, government will probably mandate NFC capable phones everywhere now that you can get so much information off of it so easily :-)
I am not totally sure why these handset hacks are always such big news. What are the chances that this can happen to a normal person? One, you would need to have NFC enabled, which people may do, but at least I never do by default. Two, you need physical access to the handset.
Has it not been the case for a very long time that if you lose your handset that someone can use it, NFC or no NFC? Oh, and they need to trigger the exploit 185 times before it worked. I think we are still reasonably safe.
The article eludes to the fact that Jellybean may fix this. All the more reason for carriers and manufactures to expedite upgrades.
This was demonstrated at DEFCON 20. He live demo'd rooting an android device using NFC to open the browser and a brwoser exploit to gain root. https://www.defcon.org/html/defcon-20/dc-20-speakers.html#Miller
Given the short range and low bandwidth (424 kilobits/s) of NFC technology, this is more of an esoteric attack than a practical one. I think I'd notice someone shadowing me with a hand at my pocket to connect to my Nexus S via its NFC chip and pull data from it...
Still, it's a show of force (and vulnerabilities).
Hyperbole: I use it liberally!
against random hackers while having my cell phone in my pocket at the geek-overloaded dance clubs on a regular basis... I guess I'm safe for now.
Key phrase from the report: by holding two Galaxy S 3s next to each other .
I swear they give me mod points to shut me up.
you also need to have NFC enabled on your Galaxy for this to work. NFC is enabled by default, sure. But it can be disabled easily. I also find myself living happily without NFC, but not without tethering, which I use daily during my bus commute.
So my point is that both vulnerabilities suck, and which one sucks the most depends solely on your use-case. There is no point in saying that one device is more secure than the other, both Apple and Google seem to suck big time here. You should not store any sensitive data on your phone.
No, YOUR an idiot.
I mean, that's exactly what Apple's patent lets the TSA do to your phone.
424kb/s is 42k/second is all your telephone contacts, emails addresses etc per second. That's plenty for a major heist. It was only a few years back that 128kbps was called broadband FFS (2004 my DSL was 128kbps).
Short range is a fairer comment, but even so, someone will simply invent a booster antenna like they did with Bluetooth hacks to expand the range. Hacking the person sitting in front of you on the bus or next to you on the train is quite feasible.
Basically Samsung or Google screwed up, the best cause of action is hands up, then a quick fix, followed by detailed analysis of all the other front facing code to see what else might be hiding. Denial never works in these situations.
your animes will get hax0red
No, they'd have to be sitting next to me on the bus AND physically touch my phone with another device long enough to trigger NFC AND I have to have NFC enabled AND keep the devices in physical contact long enough for the download to complete OR hope that I have an active data connection AND the right web browser set as my default so their specially crafted web page loads to root my device...
Except that (since I have like six web browsers installed) it requires me to interact with the phone to pick the web browser to open the page... A lot more difficult to arrange than "sitting next to someone".
Also, the ASLR implementation is known to be incomplete on ICS. It's apparently fully fixed on Jelly Bean, so this hack shouldn't be possible on the S3 in a couple months, when the update is rolled out. Likewise, all of the Nexus NFC devices have been updated to Jelly Bean, so they're secure.
Yeah, it's sad that the hack was possible, but it was due to flaws in the OS, not due to problems with NFC, and only under a very contrived set of circumstances...
Maxim: People cannot follow directions.
Increases in truth directly with the length of time spent explaining them
I posted this above but here's what I see (maybe I'm missing something so help me out). So that assumption of danger here is what? Someone walks down the street bumping into random strangers repeatedly hoping that:
1) The bump into the side where the strangers phone was being held.
2) The two phones are perfectly at the same height (presumably in a pocket).
3) The strangers phone is vulnerable.
4) They have NFC enabled.
5) They could hold the phones in contact for the about of time necessary to transfer both an overloaded filed (presumably exceeded a buffer limit) and THEN also transfer the app compromised app that allows the actual hack to work (over a connection with a maximum bandwidth of a few hundred kbits/s).
6) Then after the hack succeeded they remained in contact long enough for the data from the strangers phone to be transferred back to the hackers phone.
All with anyone noticing? That's all assuming they fix whatever issue was causing it to need to be run 185 times before it finally worked? Assuming those 185 times were the incremental transfers of all the data needed? Again I'm still not scared. And this is fixed in Jelly bean (which my S3 is running...doom on you close talking random guy on the street thinking you finally found someone with an S3 to stand uncomfortably close to!).
If that's the case, someone is probably already making a root-access-giving program that works through phone-to-phone NFC as we speak.
Although... transmission through intimate contact? That sounds awfully like an STD...
Someone discusses an NFC hack to root and steal data off Android and half the posts are "Apple isn't secure either!"
Focus people! Slashdot is supposed to be the home of Linux and Open Source and über hacks! Why isn't anyone deceminating how this hack works and posting some kind of work-around that isn't just "Don't use NFC" (a feature which Apple gets derided for not having)?
Remember, a fix isn't "Don't use NFC and switch to another browser." Let's assume a user *likes* NFC, and *likes* his web browser as it is. Lets *fix* the problem here. Any thoughts or conjecture?
- "Scientia non habet inimicum nisp ignorantem"
Turns out users can simply deactivate NFC when they're not using it. I do these things with WiFi, GPS and Bluetooth. Both for sercurity and battery-saving purposes.
Yes, iOS6 was hacked. So if you were lured into visiting some bad web site site someone could potentially see your address book and photos - Oh no!
Meanwhile everyone you bump with the S3 could be a carrier of a filthy, filthy disease that would render your entire system open to keyloggers or whatever.
The iOS6 attack is read only, the NFC attack write...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
That NFC exploit was F'n WEAK!
C'mon dudes. Seriously? You can do better!
"As you can see, (glaven!) with the use a willing victim who stands perfectly still; a soldering iron and logic probe; 'Don't touch!' ;we can subvert the phone after one hour. Why anyone would want to want to use such a dangerous communication medium is beyond me. (a-hem!)"
Misspell something once and it is a typo. Do it twice and you a complete fucking idiot. Idiot.
This is a big boon for trolls. Oh look...
"The flaw had to be triggered 185 times in the exploit code in order to overcome some of the vulnerability’s limitations."
While I'm certain the exploit could be improved, I'm fairly certain that if it takes 185 tries to work, it is not practical to exploit this in the wild at this time.
All this cracking and still no way to root the AppleTV 3?
Da Blog
At the same event, they also hacked iOS6. Just to give an unbiased view...
Actually you seem a little misleading given that the iPhones don't have NFC. I think the true subject of the article is NFC not Android. The fact that iOS and Android can get hacked by a malicious webpage seems a bit off topic.
Android and Samsung are mentioned prominently only to get people's attention.
Samsung has incredible hardware. The Galaxy series of phones have all been quite remarkable. Their OLED technology puts out color gamut that makes Plasma TVs look like they were painted with pastel watercolors.
Their software has always blown. Every tried to use GPS on a samsung phone? How about USB mass storage mode? How about SVoice? How about waiting 2 years for ICS to come out on a device? How about USB Host mode on CDMA models? List goes on... They cut so many corners on software to get it out the door.
They try so hard to be like Apple... they've smoked Apple on the hardware side, but the lack of quality on their software side just completely spoils their phones. So when a 0 day flaw pops up that allows one to completely take over a phone, it doesn't surprise me. Results like this usually correlate with high software engineer turnover with low management turnover, which should points to a solution: fire the management.
In other news though, I laughed at Person of Interest where the main character hacked other peoples phones by holding them together. Now I'm drinking my cup of shut up tea.
Samsung(R): Amazing Hardware, Shitty Software (TM)
How is it possible at this age in computer development that we STILL design shit with giant holes in it? I honestly do not understand why it is so hard to make a robust and secure system. Is it because we demand so many features that they cant look at everything? How do you design a program that cannot be exploited? Why is it so very hard?
Good-bye
iPhone
Settings -> Browser of.... damn
The exploit (ab)uses privileges Mobile Safari.
That means ANY other browser you use on the device is safe from this attack, yes even though it's also using webkit. Like Chrome...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Why bother hacking Android when you can republish some open-source app, or write a crappy flashlight app, and get all the same data, "legitimately," to Google's view?
Cool. A security exploit was found and now it can be fixed. A rational person would go, I'll just disable NFC and be okay.
This being slashdot, we'll have more than our fair share of people insisting that this proves that Android is somehow inferior than their favorite brand of OS. This will in turn lead to Android fans pointing out how the other OS was also hacked. The next thing you know, we have an all out fanboy war on the comments. It's as if Slashdot editors are planning on this.
Isn't there any cool news for geeks that isn't related to a cell phone?
These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
What you did there. I see it.
The first time I saw NFC demonstrated, with phones receiving and acting on data without user consent, a LOL'd at what a security disaster it would surely be.
"When information is power, privacy is freedom" - Jah-Wren Ryel
It has security holes and attracts malware. iOS only really has security holes.
I am not totally sure why these handset hacks are always such big news. What are the chances that this can happen to a normal person? One, you would need to have NFC enabled, which people may do, but at least I never do by default. Two, you need physical access to the handset.
Has it not been the case for a very long time that if you lose your handset that someone can use it, NFC or no NFC? Oh, and they need to trigger the exploit 185 times before it worked. I think we are still reasonably safe.
The point is if you're actually using NFC the very device you're rubbing your phone against can run code on it, install software, whatever, without you actually noticing anything.
Yes, if you're not using NFC you're safe.
For establishing NFC this is very bad news. It's hardly used anywhere and can already take over your phone if you use it.
Wrong, We are talking milimetres here, it is very hard to keep your device within 2 or 3 centimetres of someone elses for any length of time without being noticed.
Posting this from the article (which it looks like you haven't read).
The flaw had to be triggered 185 times in the exploit code in order to overcome some of the vulnerabilityâ(TM)s limitations.
OK, so they may need to attack me 185 times.
The real world implications of this aren't significant. But it's good the vulnerability has been found so it can be patched in future versions.
Calling someone a "hater" only means you can not rationally rebut their argument.
Ever been on a crowded bus/subway? Distance between people tend to be 0cm at certain times of the day, not hard to put your cell phone next to someone else's pocket.
Clearly you don't watch much Japanese porn.
If my phone is in my pocket screen-out, it's going to be nearly impossible to establish an NFC connection in a crowded subway. The phone itself (plus the battery... on my phone, the NFC antenna is actually in the battery, so that it can be close to the back surface) is a pretty good shield.
-Dave Haynie
And, if they just go the next step and steal the phone, they cam get whatever they want off of it and sell it... Or they can knife you and take your whole pack, purse and/or life. This vulnerability to 2cm away proximity is a tremendous flaw.
BTW, my keyless entry system on my car is vulnerable to someone with specially built transceiver equipment fooling my car into opening for them, assuming they follow me into a restaurant and relay the signals to a device left in the parking lot next to my car. This does not keep me up at night, and my car has yet to be stolen. I'm much more likely to have my identity stolen because of info pulled from a hacked online retailer's database than someone with an NFC hack or virus. They're not all that common yet, it requires close proximity, and it will be patched long before it is common enough to be a viable vector for infection. Interesting, yes. Good reminder that every new technology exposes another surface that will be exploited by criminals and thieves. Worth panicking about? Reason not to have an S3? No. But if anyone disagrees, and they have an S3 they are now too scared to use, please leave your contact info. I'll safely take your phone off your hands, no charge.
that the iPhone 5 was criticized by Android fanboys for not having.
Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you
Android fanboys all over the Net pilloried iPhone 5 for not having NFC.
Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you