Slashdot Mirror
Severe Deserialization Vulnerabilities Found In Android, 3rd Party Android SDKs
An anonymous reader writes: Closely behind the discoveries of the Stagefright flaw, the hole in Android's mediaserver service that can put devices into a coma, and the Certifi-gate bug, comes that of an Android serialization vulnerability that affects Android versions 4.3 to 5.1 (i.e. over 55 percent of all Android phones). The bug (CVE-2015-3825), discovered by IBM's X-Force Application Security Research Team in the OpenSSLX509Certificate class in the Android platform, can be used to turn malicious apps with no privileges into "super" apps that will allow cyber attackers to thoroughly "own" the victim's device. In-depth technical details about the vulnerabilities are available in this paper the researchers are set to present at USENIX WOOT '15.
Google has already patched the SDKs, but I think any apps made with them have to be updated as well.
this is getting silly. I'm gonna go get an old ass nokia non-smart phone and just be happy.
> can be used to turn malicious apps with no privileges into "super" apps
Malicious apps are a problem :-)
I dropped the entire Google platform last year. It's fantastic sitting back and watching the Google fanboy's house of cards come crashing down.
Sent from my Windows Phone.
I assume this came from Hacking Team. I am familiar with the basics of the crack of Hacking Team, but don't know much else regarding them. It seems like, based on these serious flaws that are in the news, that Hacking Team had some pretty serious firepower. There is a paradox here: because Hacking Team sold their exploits to "good guys" (a.k.a. governments), they are considered an above-the-board company. If they had been on the "darknet" in one of the marketplaces, they'd have been an illegal operation because of what they sell.
What is Hacking Team up to now? Still business as usual? No one with the means to stop them is casting a concerned eye at them? I suppose it's better to keep those people where you can control them, if you're a government. And let them build you better toys to spy on people, oh, I mean "enemies".
If you haven't seen the last episode of The Daily Show, Jon Stewart had a great monologue about bullshit. This, dear reader, is a great instance of the bullshit of which he spoke.
captcha: braids
...will that also eliminate the ability to root phones which are handset/provider "protected" against allowing such privileges?
Unlikely to have fixes pushed out by carriers in a timely manner. Ever-changing TOS (crafted by a room full of lawyers) turned me off the app store, thus no updates anyway. Nothing users can do.
Perhaps someone with more Java/Android experience can elaborate but my quick read on serialization leads me to believe that this is a flaw in Java itself and that per the below, while steps can be taken to mitigate the risk, it can't be eliminated.
Can somebody put this to good use and let me root my S5 running 5.0.1, thanks.
Is there anything Android does do right? Just yesterday I was reading how Android handsets even leak users fingerprints.
It is Google after all, though. I guess you shouldn't expect any level of privacy.
I realize this needs to be patched, however just what are the odds of this happening? Apple OSes, linux, Windows, bds's all have various issues. They are routinely taken care of. My guess is the odds are extremely low if not zero. Google probably pays these kind of folks for discoveries like this.
That's what I did, because I know that iOS is secure, that is... secure comparatively speaking to the steaming pile of crap that Android is. I'm not saying that iOS is 100% secure, no, that's not at all what I'm saying. What I am saying is that comparatively speaking, iOS seems more secure than Android.
Defective products should be returned for a full refund or fixed at the supplier's expense.
Severgate? Deserializationgate? Vulnerabilitygate? Foundgate? Ingate? Androidgate? 3rdgate? Partygate? SDKgate?
I need a buzzword to help me out.
With so much news and controversy generated by these stories, many many more security researchers and companies are going to start doing deeper dives into Android source code and the various forks individual companies use.
This at once great and scary. Great because it's better to get these vulnerabilities out in the open so they can be dealt with accordingly. Scary because of the market fragmentation, the vast majority of phones will never see security updates. A minority of Android users have the knowhow to update or go to a custom ROM. People won't care about how vulnerable any information stored on these devices might be until it's too late.
If this was as easy as upgrading individual packages/kernel packages, it would be a non issue.
Can I use this to root my android devices?
John_Chalisque
We always get a fanboi!
Psssst... this article is about Android.
Hows that chinese certificate authority that apple refuses to delist working out for you? Yeah, more secure my ass.
No one can look at apples codebase but apple. Apple continually holds back fixes, or denies the issue until they are FORCED to act. At least we have thousands of coders looking at the code base that makes up android, finding these exploits and bugs then resolving them.
Android is what, 75%ish of the mobile market? And you are suprised that your IOS device "seems" more secure? It's not a valid attack target, you go for the most bang for your buck.
Don't get me wrong, if my grandmother wanted a phone or tablet, I'd buy her an IOS device. But your ios device is only more secure because you have no idea what you are talking about. Apple did SOME things right, it's very hard to get malware onto the apple store, not impossible, but very tricky. IOS users have to jump through hoops to get out of that walled garden so most don't.
Android makes it as easy as 1 checkbox to allow content from untrusted sources, this is good for tinkers like me, but bad for the average user as it opens you to various attack vectors.
IOS seems more secure because apple has a closed door security policy. Android is out there, with many eyes in the code. A lot of the bugs being found aren't even really part of android, but stuff like openssl and other packages.
I can secure my android phone right to the level of locking out ports. What exactly can you do, without 3rd party apps or jailbreak, to secure your iphone? Trust apple to do it? I don't trust samsung to patch my phone in a timely manner, but google provides those patches pretty freaking quickly.
There's no such thing as a secure out of the box os. there isn't. You have to mitigate security with usability. I lean towards whatever device gives me enough control to be comfortable, this isn't the best fit for everyone.
Apple is only as secure as their code, and we're not allowed to look at it. But, I'll leave you with this badly garbled quote found somewhere in the original NSA dumps.
The NSA hacks/exploits/whatever you want to call them prefer apple ios devices over anything else as they reap the most rewards.
iOS and MacOSX have had tons of bugs to do with deserialization of messages passed inter-process, usually XPC type confusion issues.
This is a very neat sort of attack, but it requires quite a few rarely used features to appear in conjunction to pull off, which is why they only found one exploitable class in the entire Android SDK. Their mitigation suggestions are good and can be implemented with some fairly minor API upgrades. I don't think this bug in particular is going to tip the security balance between iOS and Android much.
It may be fixed but is your device going to get that patch? Oh I'm sorry, your phone is a year old... buy a new phone instead!
This should be a question for the FCC to ask all the US carriers. Failure to push OS security updates should result in massive fines against all of them, not just the usual level of 'spare change in the corner office couch cushions' type, as these vulnerabilities will sooner or later affect life and limb.
If you whine and slow-play some BS about making sure it won't harm your precious networks, okay. But the fines will be imposed and continue to increase until the all the patches are truly pushed out.
Carriers, either push out the security updates to all affected phones, or release unlockers to allow your customers to defend themselves; there should be no other options given to you.
Any vulnerability in Debian, Fedora, or Android is Linux-gate.
the ONLY way to be even semi-secure with Android is to only download "curated" Apps
True, but Android lets the user choose more than one curator. Other established curators include Amazon and F-Droid.
I still wouldn't change back to a device that you don't truly own even after paying $500+ for the device.
'The bug (CVE-2015-3825) .. can be used to turn malicious apps with no privileges into "super" apps'
:)
Except you forgot to mention that the malware (SerializePOC) has to be already installed on the device. So to get 'hacked' a) download and install malicious app
The latest iOS version with all the security fixes slowed your iPhone 3 to an unusable crawl? I'm sorry, buy a new iPhone instead.
Seriously, of all the stones you guys may have to throw, that's really not one of them.
Since iOS is an even bigger, more steamy pile of crap than Android, what will you do next? Where will you go, you poor little lass? Tizen perhaps? We are all waiting with bated breath for your next move. So important to know.
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
Put an object that is of a class known to the system class loader into an Intent extra. Broadcast the intent it such at it will be received by the system (by possibly targeting an intent filter that's already handled by something in the system process). The system, as soon as it reference any of the Intent extras, will deserialize all of them, including the malicious object (that's how the Bundle object, which backs intent extras works). Eventually, even if that object was never used, it's finalize() method will be called. Depending on the fields that were present in the serialized form, there is potentially an exploit. This could happen if the implementation of that system class's finalize() method could be tricked into doing something funny by the data in the serialized fields in the object.
This is only a theoretical exploit. It depends on finding a system class with a vulnerability that can be exploited by crafting the data in it's fields, and the usage of those fields in it's finalize() methods.