Slashdot Mirror
Students, Start-Up Team To Create Android 'Master Key' Patch App
chicksdaddy writes "The saga of the application-signing flaw affecting Google's Android mobile phones took another turn Tuesday when a Silicon Valley startup teamed with graduate students from Northeastern University in Boston to offer their own fix-it tool for hundreds of millions of Android phones that have been left without access to Google's official patch. Duo Security announced the availability of an Android utility dubbed 'ReKey' on Tuesday. The tool allows users to patch the so-called 'Master Key' vulnerability on Android devices, even in the absence of a security update from Android handset makers and carriers who service the phones, according to a post on the Duo Security blog. Jon Oberheide, the CTO of Duo Security, said that ReKey provides an in-memory patch for the master key vulnerability, dynamically instrumenting the Dalvik bytecode routines where the vulnerability originates, patching it in-memory. Oberheide said that ReKey will also 'hook' (or monitor) those routines to notify you if any malicious applications attempt to exploit the vulnerability. Despite the availability of a patch since March, many Android users remain vulnerable to attacks that take advantage of the application signing flaw. That is because Android handset makers have been slow to issue updates for their handsets. For platforms (HTC and Samsung) that have been patched, carriers delayed the rollout to customers further. 'The security of Android devices worldwide is paralyzed by the slow patching practices of mobile carriers and other parties in the Android ecosystem,' said Oberheide. However, the fragmentation of the Android ecosystem is significant enough that it is no longer feasible for Google to take over responsibility for distributing patches. Third parties may need to step in to fill the void."
A related article makes the case that the release of the Master Key vulnerability started an important conversation within the open source community.
Leaves out 99% of the devices out there.
---- Booth was a patriot ----
The patching thing is a bit of a joke. If I had an android phone, I'd want an equivalent to Ubuntu to provide a 3rd-party OS with regular updates. I think 3rd-party Android distributions are out there, do they handle security updates well?
Looks like a great way for someone to create a fake update and publicize it as a third-party patch. Google needs to make good on do no evil by proactively doing good.
The reviews on the Play store are showing a fairly high possibility of a bootloop. While I'm all for open source and public patches where appropriate, I expect I'll be passing on this one for now.
I'm guessing someone's going to sue them for their efforts. As we've seen time and again, no good deed goes unpunished.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I have a Nexus 4 that shows up as unpatched by the bluebox scanner. After installing this, it still shows up as unsecure in that app. My Samsung S3 shows up as patched in the Bluebox scanner, but this app says it's vulnerable. Whom do I believe?
But, but, if it's no longer feasible for Google to provide patches, how come he says his company, with vastly fewer resources, can do it?
It stands to reason that if Google can't patch your phone because of "fragmentation of the ecosystem," nobody else can either. That makes me not at all anxious to install his patch.
With desktop Windows and Linux, the latest version works on all (powerful enough) computers. Why can't it be this way on Android?
force them to give the unlock codes no questions asked even if you are on a phone payment plan.
And by you, I mean all you people who don't merely tolerate the behavior of the cellular phone companies, but actually encourage it by giving them silly amounts of money every month.
It's YOUR DEVICE. We've been down this goddamn road before. Nobody remembers Ma Bell? Nobody remembers Ma Bell owning all devices connected to their precious network? Nobody remembers what a debacle that was? How has this been allowed to arise again?
A smartphone is a stupid name for a pocket computer. And apparently, thanks to the cellular companies, it's going to behave just as badly as a desktop computer of yesteryear. It's like every Windows 98 machine ever shipped was connected to the modern internet yesterday. Madness.
And it's all your fault.
This doesn't solve the actual problem in the handset world, especially with android.
That problem?
Closed source binary drivers for novelty features in specific handsets that are incompatible with newer android builds, due to improved/newer linux kernels being in them.
Take for instance, my horribly crippled, antique android device:
SGH-T839 (Sidekick 4G)
This device runs Froyo, and has been officially abandoned by T-mobile and Samsung for almost 2 years now. It has a 1ghz hummingbird cpu, and approx 512mb of ram, of which about 300mb is useable for programs. It has a strange camera driver, to make use of both rear facing and front facing cameras, and a strange hardware keyboard driver.
It is otherwise very similar inside to an older galaxy based device.
The only roms in existence for this device are recooked images of the (bloated as hell) stock rom. There is no CM support. There is no official ICS upgrade, despite it being theoretically possible. Nada. This, despite the complete source for the kernel of the device being GPLed by samsung when they EOLed it, and said sources being publicly available.
The device had a root access ad bootloader unlocker within weeks of release.
This community patch is the only security fix I have been able to apply to this handset in a very long time.
IMHO, better option is to require handset makers to offer at least one major android revision upgrade per device lifecycle.
This device was born froyo, it will eventually die froyo. I would rather it die ICS. Most times, EOLed devices are physically capable of running the next higher android release, but the maker refuses to sink the development money. I would pay 50$ extra or more for having the garantee of getting the next major android release during the product lifespan. The handset makers don't see that their refusal to provide extended support in this fashion hurts their brands, and hurts the device ecosystem. All they see is "the next big thing!" On the horizon.
They don't want to "waste time" with "old, legacy devices" like mine. They are much more interested in selling me a brand new device, that they will EOL in 1 year.
That is because Android handset makers have been slow to issue updates for their handsets.
I have a Google Nexus 4, supposedly gets all the updates right away, first to get new versions of Android, etc. I haven't seen an update since I bought the phone 6+ months ago. Samsung has apparently patched their phones; Google announced a code fix months ago.
What's Google's excuse for not patching my device? No carriers involved, current model, etc.
Please help metamoderate.
... android patches YOU!!!!
This sig is not paradoxical or ironic.
Whilst it's common (and often justified) to have a pop at the carriers for delaying or preventing updates to devices, it's worth pointing out that I've got access to a whole range of Android devices direct from a number of different OEMs and not a single one of them has yet received an OTA update to fix this vulnerability.
The carriers may still slow down this process, but it's already going slow enough with just the OEMs involved.
Avantslash - View Slashdot cleanly on your mobile phone.
As this will only effect 1% of the people who even know about the problem, and only 1% of those 1% have phones that can be fixed,
it answers the question why Google doesn't give a crap about you.
Thought I'd point out that it's the vertical integration design of Android that has led to this carrier conundrum in which updates and upgrades are forced to go through the carriers, but the carriers are focused on new sales not maintaining old hardware. So the engineering resources they're willing to invest are minimal, leaving users out in the cold.
This is something that's of interest to me in the design of Firefox OS, which completely separates out the the Linux kernel, and the two layers on top of that (the Gecko engine and the UI). All of these can be updated independently. Updates to the kernel require the carrier's knowledge of the underlying hardware, but most security, feature & performance updates will be to the top layers. So updates should be installable when they're first released. This should help to avoid a lot of what we're seeing with the carrier foot-dragging (or outright abandonment) hurting consumers.
I'm unfamiliar though with the the design of Ubuntu Touch and Tizen. Does anyone know if they have a similar advantage?
That'd unlock the SIM card slot, I'm not sure what it would do for getting new software onto the device.
No kidding!!! What do you say at this point?
Welcome to the mobile phone handset business model. This was the business model for these suppliers long before Android came along, do you really think they are going to change now? Instead of fixing older handsets they want to release new variants every few months to tempt the unwary with a new bright shiny thing.
The only company doing anything different, no matter how much Slashdot hate them, is Apple. The limited hardware targets they have to deal with allows them to provide longer support and its something that they've done since day one. Sadly the Android/iOS holy war prevents this advantage being seen.
You may think me a tired, old, cynic. I'd have to disagree about the tired bit.
AT&T has never issued a software update for any of our Android devices. Not one. Once they release a phone, they wash their hands of it and never think about it again.
As long as 4.x requires half a GB of RAM, there will still be 2.x devices.
Oh, no, it isn't, its you going to a seller of phones and buyng a shitty contract because you merkins don't have any customer protection and the phone companies can fuck you over every which way from sunday.
Don't buy a phone under a shitty contract and you're fine.
There are scores of "Android" sellers, and several of them are as good or better than Apple at updating or not locking out the owner of the device.
YOU are taking the worst of the Android ones and comparing it to Apple so Apple appears better in comparison.
Blame the carriers for charging as much per month for service on an unsubsidized phone as on a contract. Blame the CDMA2000 carriers for not using CSIM and refusing to activate phones they didn't sell.
. This was the business model for these suppliers long before Android came along, do you really think they are going to change now?
So how come Apple did it? My iPhone has no bloatware from AT&T. None. And I get regular updates from Apple, even my dads 3gs gets updates.
Face it. Google doesn't give a fuck about the users. All they care about is that the handset has all their proprietary google service crap added to the OS. Apple's only hope is to get money upfront and thats why their product is awesome and why still Android sucks compared to iOS. Google meanwhile gives out their stuff for free and then exploits users personal data to make money later on. I know which company I trust.. Hint: Not Google.
Google on the other hand has absolutely zero say when it comes to the OEMs
"Absolutely zero" is strong language. Google Play Store is not FOSS, and Google could sue any OEM that ships an infringing copy of Google Play Store on a device. Google licenses the Gapps only for distribution as part of the preload on devices that pass the tests for conformance to a particular Android version's Compatibility Definition Document. To get 2.x (and the underpowered hardware that needs 2.x) out of the channel, Google could declare a date after which Gapps are no longer available on new 2.x phones. I guess it doesn't do so because it depends on ad revenue from 2.x users who would have otherwise chosen a feature phone.
Think the OEMs give a rat's ass about a store that makes GOOGLE money but NOT them?
Say an OEM decides to go this route of shipping a device running outdated AOSP and its own store. How would it go about attracting Android application developers to its own store? In order to get its own 30% cut, such an OEM would have to spend time==money hosting, curating, and promoting its own store. I seem to remember only Amazon making a wholehearted effort at setting up its own store for the Kindle Fire. Other 1.x/2.x devices without the Gapps, such as seventh and eighth generation Archos tablets, ended up building a bad reputation once users discovered that they couldn't find their favorite apps in AppsLib (the store that Archos devices shipped with) or SlideME (a commonly sideloaded store).
I have a Nexus 4, not a Nexus 7, and yes, according to the scanner tool, it's still unpatched.
Please help metamoderate.