Slashdot Mirror
Qualcomm Snapdragon SoC Vulnerability Could Compromise IoT Security (betanews.com)
Reader Mark Wilson writes: One of the greatest concerns surrounding the growth of the Internet of Things (IoT) is its security, and it seems that some people's worst fears have just been realized. Security experts at Trend Micro have discovered a vulnerability in Qualcomm Snapdragon-produced SoC (system on a chip) devices. In fact, it is the same vulnerability that cropped up earlier in the month, affecting Nexus 5, Nexus 6, Nexus 6P and Samsung Galaxy Edge Android handsets. This in itself is concerning as these are devices that are no longer in line for security updates, but more concerning is the fact that the same chips are used in IoT devices. The vulnerability makes it possible for an attacker to gain root access to the hardware, and this is worrying in a world of inter-connected devices. In the interests of trying to contain the problem, Trend Micro has not revealed full details of the vulnerability but is using the issue to highlight a serious problem not just for handset owners but also for adopters of the IoT.
Nexus 5, Nexus 6, Nexus 6P and Samsung Galaxy Edge Android handsets. This in itself is concerning as these are devices that are no longer in line for security updates
manishs, WTF is wrong with you. Didn't you even read the submission? This is outright wrong.
Please, this is the latest fail in a series of fails.
IoT devices may end up creating vulnerabilities in your otherwise secure network?
Say it ain't so...
My eyes reflect the stars and a smile lights up my face.
That only exists in the masturbatory fantasies of various techno-evangelist startups and large corps trying to cash in on a fad. In the real world I doubt many people want their white goods networked, or their home heating or their kettle or clothes or any of 101 other everyday objects that function perfectly well standalone and have no reason to be networked or even computerised. But where there's a sucker there's money to be made and the techno sharks are circling.
If there's one thing that I absolutely *DO NOT* equate with the "Internet of Things" it's security.
All I seem to read about are devices with idiot back doors, default administrator accounts/passwords etc. It's just like the people creating this crap have been asleep for the last 30 years worth of internet hacking.
It's all rather sad really as there's no way in hell I'm putting any of these devices into my home.
It's Qualcomm's top of the line chip. I don't know what they sell for but my WAG would be at least $20. Kinda hard to justify spending $20 on a CPU for your IoT device you plan to sell for $100.
The real link is Android Vulnerabilities Allow For Easy Root Access
And from that link:
Using these two exploits, one can gain root access on a Snapdragon-powered Android device.
So the click bait headline is that. Click bait. A more correct headline would mention that it is the combination of Snapdragon and Android.
I am Slashdot. Are you Slashdot as well?
There's some crucially missing information from TFS and TFA that you have to dig up from TF-source: http://blog.trendmicro.com/trendlabs-security-intelligence/android-vulnerabilities-allow-easy-root-access/
That information being:
Q. What is the vector?
A. by running a malicious app
Q. And what's the danger?
A. gain root access on the target device
While the second is obviously pretty bad, the first one means that your proverbial internet-connected toaster should be pretty safe, unless you're in the habit of... installing apps..on your toaster? Even for more reasonable examples, such as an internet-connected fridge where you might have an interface straight to grocery vendors to re-order things, there's very little reason to be installing third party apps - or even provide an interface for doing so.
Wake me when the proverbial internet-connected toaster can be remotely exploited without user interaction.
Not sure where the author got his info. Nexus phones still receive monthly security updates directly from Google.
They really tout the Snapdragon as an IoT device? Well, seems so:
https://developer.qualcomm.com...
I think these people need to realise that either;
(a) Your idiot - sorry "IoT" - device is a simple, locked down fairly "dumb" thing that is secured by design, or
(b) It's a fully-functional computer with a sophisticated OS that presents the same attack surface as a Mac, Windows or Linux box but, unfortunately, without the same knowledge base. i.e. You're going to have to throw serious resources at the thing to make it "secure".
For a device that will retail for a few bucks....
Google struggle to do it for Android; what's the betting that these things will continue to be buggy and insecure as hell?
What a terrible article. For two reasons:
1. Isn't at all clear on what the vulnerability is. It is in fact a bug in the kernel (presumably a device driver for this SoC). I only found this out by reading a different article. This one makes it sound like some sort of problem in the silicon.
2. Isn't news. This vulnerability is already known.
We're all becoming sadly more and more used to articles that try to make a story sound bigger by relating it tenuously to some possible impact (every article about some incremental improvement in battery technology needs 4 paragraphs about electric cars, grid storage and longer battery life for phones), but this really does take the piss by not even attempting to cover the actual story and only going on about the potential impact on IoT security.
Sure, we all need to be aware of the dangers of IoT security (or lack of it), but this is not the way to go about it.
Modern app appers know that the Appernet of Apps is 100% appy, unlike LUDDITES like Qualcomm who use the LUDDITE Internet of Things!
Apps!
..but I hug my dumb toaster every morning. I know it's probably only going to kill me if I stick a fork in it to unjam the bread.
From the article: "This attack allows an attacker to escalate the privileges of any code that is executed on a target device. However, this scenario still relies on the attacker getting his malicious code onto the device in the first place. Users should be very careful of installing apps from untrusted sources, especially those outside of the Play Store."
Unless your IoT device allows you to install some third party software with malicious code, this isn't a concern. I'm not sure how many IoT devices would be running software installed from a 3rd party source. To boil it down, if this exploit affects you, you probably brought it upon yourself. Doubly so if it's an IoT device.
An article in ARS Techica calls security in IoT hilariously broken and getting worse.
http://arstechnica.com/securit...
Being that people have been claiming nobody is paying attention to IoT security, it reminds me of Clark's first Law
"When a distinguished but elderly scientist states that something is possible, he is almost certainly right."
The summary isn't very clear about the nature of the problem. The CVE report is a little better. The problem is a bug in the Qualcomm "performance component", which is in a Linux kernel module. So, it's essentially a driver bug, which is nothing remotely new or surprising. The only noteworthy bit here is that it's a bug in a driver that is used on a huge number of devices, many of which aren't easy to update.
The moral of this story is: bugs happen, updates are crucial for security.
Unless your IoT device allows you to install malicious software from a third party, this isn't a concern. Basically, if this exploit affects you, you probably brought it upon yourself. Doubly so if it's an IoT device.
this is what happens when you copy articles from Trend Micro's blog without understanding what they wrote
The post title was interesting, but wrong. The problem isn't with the SoC, but rather the implementation of Android wrt said SoC. Very different...
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
"ou know what? It IS damn useful to be able to look at an app on my phone while I'm out of the house, and see whether or not the doors are locked, or the outside motion-sensor lights are on"
How about you make sure they are before you leave? Just a thought.
"or whether there's suddenly water standing on the basement floor"
Paranoia? Much? And what if there is - what you doing to do , rush back from work or fly back from holiday to sort it out? Too late by then anyway, damage is done.
"or to see which cars are at home in the driveway."
Don't you even know who lives at your house?
You sound like the sort of person who shouldn't be let out unaccompanied frankly.