Slashdot Mirror
Many Android Users Susceptible To Plug-In Exploit -- And Many Of Them Have It
Ars Technica reports that a recently reported remote access vulnerability in Android is no longer just theoretical, but is being actively exploited. After more than 100,000 downloads of a scanning app from Check Point to evaluate users' risk from the attack, says Ars, In a blog post published today, Check Point researchers share a summary of that data—a majority (about 58 percent) of the Android devices scanned were vulnerable to the bug, with 15.84 percent actually having a vulnerable version of the remote access plug-in installed. The brand with the highest percentage of devices already carrying the vulnerable plug-in was LG—over 72 percent of LG devices scanned in the anonymized pool had a vulnerable version of the plug-in.
...I'm not being exploited!
I know I'm shocked...how about you? Is this shocking tech news or what??
Just cruising through this digital world at 33 1/3 rpm...
I just realized that my LG G3 has the exploit vulnerability - and I'm freaking out because I know that it has been exploited!!!
Oh, wait...I put that on there so I could root my device.
Nevermind.
Is it just my observation, or are there way too many stupid people in the world?
1. Am I affected?
2. What is the fix?
Is Confederate submarines. You're sailing along peacefully. Next thing you know you're sunk. BOOM! Glug, glug, glug.
The article states it "discovered installed on an infinitesimal percentage of devices". These are devices with TeamViewer installed, an application DESIGNED to allow someone to remotely control your device over the network.
If you install TeamViewer on Windows, people can take over your machine over the internet. If you install TeamViewer on Mac, people can take over your machine over the internet. That's what it's designed for. Therefore, from a security perspective TeamViewer is a very bad idea.
It's no surprise that an application designed to give someone else full control of your machine is imperfect, and therefore can sometimes allow full access by someone who shouldn't have access.
When you DON'T make the user able to administrate the machine, s/he cannot secure it because of insufficient rights.
The carriers of course DON'T care because more bandwidth being fraudulently used by malware equals MORE MONEY.
The same problem exists with tablets.
And yes, I know there is a way to root the devices but this is not within the reach of even the most technical users.
Just bought a new Android here and I only installed ONE third party app (Ustream)
Problem: I can't update my phone because: Insufficient storage: This device doesn't have enough space to download....
Yet....
Phone storage: 4.00GB Total
Total Space 1.57GB
Available 140MB
Apps 1.15GB
Pictures, videos: 265MB
Music Ringtones Podcasts 220KB
Downlaods 5.84MB
Cached data: 22.98MB
Miscellaneous: 19.09MB
What the fuck? The above does not add up to 4GB! I can't uninstall anything except Ustream
Am I infected?
> Check Point researchers found an app that is actively exploiting the vulnerability. A tool called “Recordable Activator” from UK-based Invisibility Ltd is advertised as an “EASY screen recorder” that doesn’t require root access to the device. But in fact once installed from the Google Play store, the app downloads a vulnerable version of the TeamViewer plug-in from another source... "“it’s [the plug-in] considered trusted by Android, and is granted system-level permissions. From this point ‘Recordable Activator’ exploits the authentication vulnerability and connects with the plug-in to record the device screen.”
Am I the only one that thinks this is incredibly cool? It's not clear to me whether this is exactly the same thing as a root exploit, but some screen recording app developers figured out they could hijack an old version of a well-known app that can do screen recording. This is just a beautiful hack.
But I didn't think having system-level permissions was enough to root a device. And furthermore, does this hack let you do arbitrary actions, or only the actions that the plugin would do?
A cat can't teach a dog to bark.
If you install TeamViewer on Mac, people can take over your machine over the internet. That's what it's designed for. Therefore, from a security perspective TeamViewer is a very bad idea.
It's no surprise that an application designed to give someone else full control of your machine is imperfect, and therefore can sometimes allow full access by someone who shouldn't have access.
Wee difference there. On Android, nobody is supposed to get full control of the system. If someone is using TeamViewer to control it, they should not need more permissions than the local user has. After all, it's a screen sharing app. The remote user can only do what the local user can do.
It seems like the app has additional permissions to do things that normally wouldn't be possible (screen capture is what the article mentions), but somehow these extra permissions are made available to one of the users. That must be the vulnerability.
A cat can't teach a dog to bark.
Lol
> If someone is using TeamViewer to control it, they should not need more permissions than the local user has. After all, it's a screen sharing app. The remote user can only do what the local user can do.
The local user can root the device and can replace operating system files. As expected (but not exactly as designed), TeamViewer can be used to get quite a bit of access.
The design is that the local user has some limits, or at least that it's _inconvenient_ for the local user to do certain things, including installing a new OS. The local user has to be technically saavy in order to install a new OS. The psuedo-local user using Team Viewer has to be technically saavy to use TM to do exceed the designed permissions. Same thing, really.
The permissions are more than designed, and exactly as expected.
the check point scanner page (not the app itself, that would be silly to link to in this context) is https://play.google.com/store/...
-Styopa
Who the hell would voluntarily install software from Check Point on their phone?!?
It does so for a reason. They want you on a support contract, and the more unreasoning fear, the better. Google designed it that way.
Android, ewwww, rip off of the real thing.
The M7 was released in March 2013. By May 2013, there were youtube videos showing how to root it.
http://www.xda-developers.com/...
"Unless you use HTC tools", what kind of criterion is that? If HTC provides a tool to root the phone, why wouldn't you use it? You _could_ write your own tool that does the same thing as the HTC tool, but why bother? With your M7, like all other devices, local access is in fact full access. (Btw I do this stuff for a living.)
My claim is that if you install Team Viewer, you can expect security vulnerabilities. As it turns out, Team Viewer does indeed cause vulnerabilities, so that's correct.
Sometimes I work with explosives. From time to time, you'll find that an explosive device might go off under certain conditions other than when it's designed to. The "bug report" would look like:
XYZ can explode if heated to 280F rather than the design temperature of 350F.
So the device isn't quite within design spec, but you shouldn't be surprised that an explosive can explode. Team Viewer is made give other people control of your device. Don't be surprised when Team Viewer gives other people control of your device.
If you are using the Exchange Connector for gmail, your phone is already chowned. Why hasn't google suspended that component?
"Check Point discovered that one application in the Google Play store is exploiting the vulnerability .. While the app was discovered installed on an infinitesimal percentage of devices checked by Check Point"
Download and install a compromised app from the Google Play store - doh !
I understand the problem is that vulnerable software was signed and is therefore trusted. Google did not set up any way to revoke certificates?
I wish i could get security updates for my (very well known brand) phone without it costing me aggreeing to pages and pages of conditions.
I think our apparent "disagreement", might stem from talking about different things. You seem to be talking about how things _should_ work, how it would be if people were perfect, their designs were perfect, and their implementation was perfect. I hear you saying "this shouldn't be, it's an error".
I agree it's an error. I _expect_ errors. I've looked at a lot of code over the last 20 years, thousands of examples written by thousands of different programmers. I can count the bug-free instances on one hand. So bugs are not surprising, they are expected. Team Viewer is doing something it's not supposed to do - well yeah, practically all software does something it's not supposed to do.
So we have some software which is designed to allow someone remote access. Because it's software, it has bugs. One of those bugs affects the remote access. That's not surprising. That's expected. If you install a remote-access app, you will probably have remote-access bugs, because apps have bugs.