Slashdot Mirror
Certifi-gate: Another Huge Android Vulnerability
An anonymous reader writes: Security research firm Check Point has released information about a new vulnerability called Certifi-gate, which they say compromises the security of hundreds of millions of Android devices. The flaw exists within the mobile Remote Support Tools, which are intended to enable screen sharing and simulated taps for tech support purposes. Unfortunately, the way mRSTs validate the remote operator is easy to exploit. Because the software is designed to allow both monitoring of a device's screen and simulated input, the potential for misuse is quite serious. The flaw was disclosed to manufacturers a month ago. HTC, for one, has confirmed it is already starting to roll out a fix.
Certifi-gate
Okay, y'all have had your fun. Enough of this bullshit.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
Why is it HTC's responsibility to patch it? Why not a global patch from Android.
In addition if a car manufacturer knows there is a serious issue with a car and doesn't recall, they are liable for the accidents that happen.
Why aren't software corps held to a similar standard if security researchers have informed them of the bug.
"If any question why we died, Tell them because our fathers lied."
I wish the phone I use was running something newer than 2.3.4.
HTC updated it ONCE.
It still works fine, but I probably need to get a new phone.
Why is it HTC's responsibility to patch it? Why not a global patch from Android.
Who is "Android"? Do you mean Google?
If so, why should they be responsible - after all, HTC is the one who took a build of Android and customized it for your phone.
In fact between HTC and Google, really HTC *should* be responsible since they are the ones that customized it in a way that you could not just take straight patches from Google.
The problem is of course, that none of the phone makers are serious about security at all (they are making noises, but I'll bet it's just to placate the howling internet). So not only do they not patch Android themselves, they don't want to do the work to even fold in the fixes Google makes.
What would be refreshing is to see a handset maker that really took ownership of the whole system. Sure they would build on Android to start, but they could do so much more - they could have their own security QA team looking for problems, fixing what they found and responding to security vulnerabilities even faster than Google.
They could contribute that work back to Google even, safe in the knowledge it wouldn't even help competitors since they are unable to incorperate Android patches.
Samsung *could* be that company. It's a mystery to me why they are not... they also are making noises about being serious about security but there has been so much hot air in the past around Google and phone makers cooperating "for real" that I refuse to take any statement at face value.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
It says there's no way to work around it. ..
But the description says it can only hijack existing sessions.
Considering the user is likely on the phone with the real support, it'll become extremely obvious what's going on, not to mention the easiest mitigation: don't use the remote assist, or at least not on an untrusted network.
I have a pretty decent phone. A flagship phone that's now 3 years old, the Moto Razr Maxx HD. It's a bit long in the tooth, but it still has a sharp, bright screen, decent battery life, and while it's not lightning fast, it does everything I need smoothly and comfortably.
But Moto doesn't sell it anymore. I'm pretty sure it's EOL anymore, which probably makes me SOL.
But it keeps chugging on, and as a consumer, shorting of reading tech sites like /., I would never know that there's any problem at all. Meanwhile, my security keys are being lifted, my email passwords are stolen, and somebody's posting Donkey pictures on my Facebook account and I have no idea how or why.
But, even if I *weren't* SOL, there's the issue that, while my Linux laptop gets updated daily, and my Windows laptop gets updated weekly, my phone gets updated (perhaps) a few times per year.
See the problem, yet? We're seeing just the bare beginning.
The bright boys at Google need to figure out a way to update Android and bypass the carriers, or at least, provide a side-channel way to roll out security updates, or their whole ecosystem will collapse in an orgy of viruses and malware.
For my next phone, I just might make sure I can run Cyanogenmod on it, if for no other reason than the hope of getting security updates in a reasonable timeframe.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Yo Damn, deez companies can't keep they data together. How many o' dem simply don' update they security patches? is dere really dat many new ways ta hack?
Can anybody from da security field say whether mo' or from failure ta patch or from new ways o' attacking? It seems ta be getting worse.
ah share muh daqta as little as ah can now.
My next phone might be an apple. I need to go scrub myself now...
and Android has failed. I have three Android, all very different. This is insane. I am moving the to dark side (Apple).
This should prob. have been an interstitial ad instead of a story!
What exactly is going on? Is it a problem with the installed certificates? Weakness in the tools? Which ones are effective and which are weak? How can I determine if my Android has this crapware installed?
How did the moderators decide to let this story through?
The links provide nothing more than a security scanner! There are no specifics other than 'Google is working with OEMs...'. So what? How about providing some information I can use....not ads that are designed to look like news stories.
As always with Android support durations: Android Support vs iOS Support which is in turn an update of Android Orphans: Visualizing a Sad History of Support
It's not that iOS is good -- compare it to how long Microsoft support a Windows version. It's that Android OEMs are shocking.
Security research firm Check Point has released information about a new vulnerability called Certifi-gate
Well then clearly it isn't that big of a vulnerability, since they felt the need to use the -gate suffix. The only people who use -gate do so because they know the thing they are talking about won't stand on its own merits.