Slashdot Mirror
CyanogenMod Android ROMs Accidentally Logged Screen Unlock Patterns
tlhIngan writes "Heads up CyanogenMod users — you will want to update to the latest nightly build as it turns out that your unlock patterns were accidentally logged. The fix has been committed and is in the latest build. While not easy to access (it requires access to a backup image or the device), it was a potential security hole. It was added back in August when Cyanogen added the ability to customize the screen lock size.`"
Your location has been observed and logged. We have dispatched the black helicopters. Your co-operations is appreciated.
That's one of the issues with many committers, you can't review all the code before it ships off in a build. I seem to remember a bug in openssl where some kid commented an entropy line "because it showed warnings at compile-time" and managed to commit it without raising suspicions.
Bottom line, where are the code reviewers in this process? QA?
FUD:
* it's an open-source project
* the fix has been commited
* it requires access to the device
The Cyanogenmod team (however precisely it is defined) might not be responsible for that one: the guy who added that "feature" seems to be working independently: he used his username directly in the code...
The guy is part of the Cyanogenmod team, he used his username so he could grep the debug output he created with that log line while a testing a feature he was working on.
To sum it up:
Not a big deal, just left over debug code.
Not really a vulnerability either, because in most cases where you can read the local log file you already unlocked the phone in the first place.
--
Me
If an official ROM did this it would be taken as an evil invasion of privacy by Samsung, HTC or Google, but when the Cyanogen team does it it's immediately accepted as an accident.
Interesting.
No, things like this have happened with the larger developers and it has always been explained as a bug and accepted as incompetence. The times you see outrage is when the larger developers logs data and send it to them as part of the intended function. Cyanogen has not done anything like that yet and indie teams generally don't have an interest to do so.
Not interesting in the slightest. The difference between evil invasion of privacy and an accident is purely intent.
If a company had done it you can't prove it one way or another so it's safe to assume the worst.
If on the other hand it's done to code that is openly published at a time where a feature is modified which during developing would have clearly called for logging the actions to file for debugging purposes it shows quite a different level of intent.
You can still assume the worst, but if you do in this case we'll just assume your tinfoil hat would need to be retuned.
Or you have a program running on it that is looking for that information and sending it to you via the cellular data channel.
Imagine what the criminals of the world will do with a database of android unlock codes and gestures!
Do not look at laser with remaining good eye.
Simple unlock patterns are inherently flawed, anyway. Your password is finger-painted on the screen. Even direction is easy enough to determine.
Oh, it's open source so it's all good?
Open source is so fast to get a pass on being Evil(tm) around here. More people who own an Android phone have the skills to rebuild an engine than to properly interpret the source code of their phone. Open source only matters if you have the skills to understand the code. The vast majority of people running CyanogenMod don't have this skill set.
You have to unlock it to access the dialog to enable USB storage.
Maybe you are thinking of USB debugging?
And it's a nightly build! Not a stable release!
Wait, was that sarcasm?
I have a condition where I cannot determine sarcasm before 7am.
You are welcome on my lawn.
Basically, the story is that:
It is debugging code left in a development build, that happens to be used by many persons as nightlies.
It does not write to a file. It is debug information written to a ring buffer in RAM. You would need to have an app installed with permission on the logs, or connect a cable in debug mode and trace the log to even get these messages.
It was found in a code review, and removed.
So much a non-issue that it is a wonder that Ars even reported it. Seems Ars misread a mailing list heads-up. We are waiting for Ars to publish the correction to their article.
Prediction for end of Universe #42: Fencepost error in Quantum_bogosort.cpp
A issue in a nightly build! OMG!
Ahh, you miss the point. The vast majority do not need to understand the code.
Open source's strength is not that everyone has to read/understand the code -- it is that everyone can. It takes only one person to find an issue, then others can see for themselves and confirm/fix. If the vendor not fixing it fast enough, a fork or patch can be done without vendor's approval. On the other hand when Apple logged your location, it was only found by accident because they left data laying around. Then you had to wait for Apple to fix it, which, for all we know, they did by not leaving the data easily findable.
Of course that is not perfect and plenty of bugs and issues do not get found quickly in Open Source - but if it is popular enough, it is much harder to be evil on purpose and hide it.
Oh, it's open source so it's all good?
Open source is so fast to get a pass on being Evil(tm) around here. More people who own an Android phone have the skills to rebuild an engine than to properly interpret the source code of their phone. Open source only matters if you have the skills to understand the code. The vast majority of people running CyanogenMod don't have this skill set.
RelevantElephants: A Somatic WebComic...