Slashdot Mirror
One Billion Android Devices Open To Privilege Escalation
msm1267 (2804139) writes "The first deep look into the security of the Android patch installation process, specifically its Package Management Service (PMS), has revealed a weakness that puts potentially every Android device at risk for privilege escalation attacks. Researchers from Indiana University and Microsoft published a paper that describes a new set of Android vulnerabilities they call Pileup flaws, and also introduces a new scanner called SecUP that detects malicious apps already on a device lying in wait for elevated privileges. The vulnerability occurs in the way PMS handles updates to the myriad flavors of Android in circulation today. The researchers say PMS improperly vets apps on lower versions of Android that request OS or app privileges that may not exist on the older Android version, but are granted automatically once the system is updated.
The researchers said they found a half-dozen different Pileup flaws within Android's Package Management Service, and confirmed those vulnerabilities are present in all Android Open Source Project versions and more than 3,500 customized versions of Android developed by handset makers and carriers; more than one billion Android devices are likely impacted, they said." Handily enough, the original paper is not paywalled.
The researchers said they found a half-dozen different Pileup flaws within Android's Package Management Service, and confirmed those vulnerabilities are present in all Android Open Source Project versions and more than 3,500 customized versions of Android developed by handset makers and carriers; more than one billion Android devices are likely impacted, they said." Handily enough, the original paper is not paywalled.
What the summary fails to explain properly is that this vulnerability only works with permissions that are new when the device gets an OS update. Say you install an app and it asks for permission to use NFC, but your device's OS is old and doesn't support NFC (pre 4.0 I think). You install it anyway. Then you upgrade the OS and now it supports NFC. The app then gets the NFC permission without any further prompts or warning to the user.
That is certainly an issue, but not the huge gaping security flaw the summary makes it sound like. Apps can only ask for normal permissions that the OS offers, not bypass security or the sandbox. It's basically a UI issue.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Wow, a freeby from Microsoft, how incredibly generous. Google will probably thank them for pointing it out. Isn't it nice how everybody just, *gets along*.
My ism, it's full of beliefs.
I expected better from Google.
My karma is not a Chameleon.
This depends on upgrades. Carriers, upgrade?
Hell, my wife and I are on different versions of Android, same carrier, same phone, both say they're fully up to date.
That is certainly an issue, but not the huge gaping security flaw the summary makes it sound like
A security flaw is a security flaw. Whether or not it's a "gaping hole" it still can be exploited.
For that, I sincerely thank Microsoft for so kindly pointed out that security flaw.
No matter what's the ultimate intention / agenda of Microsoft in this case, with this security flaw exposed, let us hope that Google can do something to plug it, and make those "Billion Android Devices" just a little bit more safer.
Muchas Gracias, Señor Edward Snowden !
Luckily for most Android users Android is almost never updated, so in real life there's no real vulnerability.
"For that, I sincerely thank Microsoft for so kindly pointed out that security flaw."
"Kindly"? Are you serious? There was nothing "kind" about it. It's anti-Android PR for Microsoft. Why the hell do you think Microsoft was involved with looking into it in the first place? The goodness of their hearts? Puh-leeeeeze.
There are one billion Android devices? That's awesome!
Coder's Stone: The programming language quick ref for iPad
Now let's talk about that last patch batch where IE couldn't even safely display a JPEG in any currently supported version on any version of Windows.
Help stamp out iliturcy.
"Kindly"? Are you serious? There was nothing "kind" about it. It's anti-Android PR for Microsoft. Why the hell do you think Microsoft was involved with looking into it in the first place? The goodness of their hearts? Puh-leeeeeze.
What do you think of IE vulnerabilities found by Googlers ?
http://www.google.com/about/ap...
That there are 3,500 customized versions of Android developed by handset makers and carriers is really a news story unto itself.
Considering the amount of money that Microsoft makes in patent licensing fees from Android I don't know how they could have any financial reason to want Android to go away. At the moment I suspect that Microsoft makes more money from Android than it does Windows Phone.
Article X: The powers not delegated... by the Constitution...are reserved...to the people
"What do you think of IE vulnerabilities found by Googlers ?"
I wasn't saying Microsoft is any worse. Just that they weren't doing it for the sake of charity.
"Considering the amount of money that Microsoft makes in patent licensing fees from Android I don't know how they could have any financial reason to want Android to go away. At the moment I suspect that Microsoft makes more money from Android than it does Windows Phone."
That last bit is exactly why they want Android to go away. They don't make nearly as much money on Android as they'd make if all those same phones were Windows. Every Windows phone they can sell in place of an Android phone is more money in their pockets.
Sure, they'll make money off of Android where they can. But they'd rather it simply wasn't there.
As long as the research is valid and the conclusions correctly presented (which, in this case, they do not seem to have been), I don't care for the motive.
Shachar
In that it still doesnt allow line-item veto of app priveleges.
This should be the most basic feature.
As long as the research is valid and the conclusions correctly presented (which, in this case, they do not seem to have been), I don't care for the motive.
No argument. The research seems decent and worthwhile. The tone of the press release is what's eye-rollingly ridiculous. This is a minor security UI deficiency, but they're selling it as a "privilege escalation", which is normally understood to mean the ability to break out of the sandbox at least, and usually implies root access.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Using Privacy Guard, I can see that Facebook has attempted to read my contact list 94 times. These attempts were blocked.