Slashdot Mirror
Active Drive-By Exploits Critical Android Bugs, Care Of Hacking Team (arstechnica.com)
Dan Goodin, reporting for Ars Technica: An ongoing drive-by attack is forcing ransomware onto Android smartphones by exploiting critical vulnerabilities in older versions of Google's mobile operating system still in use by millions of people, according to research scheduled to be published Monday. The attack combines exploits for at least two critical vulnerabilities contained in Android versions 4.0 through 4.3, including an exploit known as Towelroot, which gives attackers unfettered "root" access to vulnerable phones. The exploit code appears to borrow heavily from, if not copy outright, some of these Android attack scripts, which leaked to the world following the embarrassing breach of Italy-based Hacking Team in July. Additional data indicates devices running Android 4.4 may also be infected, possibly by exploiting a different set of vulnerabilities.Blue Coat, a California-based provider of security and networking solutions writes: This is the first time, to my knowledge; an exploit kit has been able to successfully install malicious apps on a mobile device without any user interaction on the part of the victim. During the attack, the device did not display the normal "application permissions" dialog box that typically precedes installation of an Android application. After consulting with analyst Joshua Drake of Zimperium, he was able to confirm that the Javascript used to initiate the attack contains an exploit against libxslt that was leaked during the Hacking Team breach. Drake also confirmed that the payload of that exploit, a Linux ELF executable named module.so, contains the code for the "futex" or "Towelroot" exploit that was first disclosed at the end of 2014.
To the moon!
That when a backdoor is held by the "good guys" (I use that term loosely but Hacking Team sold primarily to governments) it's just a matter of time before the bad guys get ahold of it and start fucking everyone over. Pay attention, Mrs. Feinstein.
Which suits the carriers - who make money off bundling shitware and selling "upgrades" to new phones - just fine, but what the fuck, Google. It's been half a decade. It's long past time for you to tell the carriers to permit users to download their own security patches.
Imagine if users couldn't get Windows updates from Microsoft, but relied on their own ISP - and whether it's Comcast or AT&T doesn't really matter.
Fuck. That. Noise. Get the carriers out of the OS business.
WTF
Why aren't there more lawsuits against manufacturers and carriers for not providing updates? When I buy a phone, I should be able to expect security updates for at least 24 months, preferably 36 months. Manufacturers aren't interested in supporting older phones because they make money when people update. Carriers seem primarily concerned with loading up the updated versions with crapware that people don't want, can't easily remove, and may well contain vulnerabilities of its own. Why aren't there more lawsuits demanding reasonable support? Android 4 isn't that old; lots of phones still run it.
How many times can you factory reset the stock firmware on these devices?
TowelRoot? That only worked on a handful of devices reliably. And yes, when I used it I got zero sleep for the rest of the week. A single click root? Not good folks, and clearly someone has taken on the task of using that for nefarious purposes. Notice, though, how everyone is blaming hackingteam for this stuff, and not the NSA who likely knew about this long before them.
Basically, unpatched software is vulnerable... seems about right
Google is developing an extremely bad reputation. Tracking everyone. Allowing abuse.
Soon even Microsoft will be jealous.
Patching is only part of the problem. Avoiding the need to patch to begin with is perhaps more important.
That's why I need to ask, does Android need to be rewritten using the Rust programming language?
The Rust web site says that Rust is, with emphasis added, "a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety."
So I think Rust offers everything that's needed for a rewrite of Android, including the Linux kernel. It's a systems programming language. It's fast. It prevents segfaults. It guarantees thread safety.
There is no need for patches if software written in Rust doesn't suffer from the kinds of problems that require patches.
First Google could rewrite the Linux kernel using Rust. This wouldn't just be good for Android, of course, but all users of the Linux kernel. If these other Linux kernel users pitch in, the rewrite could be finished even faster.
Then Google could rewrite the Android-specific subsystems using Rust.
Finally, app developers could switch to Rust for their Android apps.
Once all of this work is done, Android would be Rust code from the very bottom to the very top. It would be nearly impregnable thanks to Rust being so ultra-safe.
Heres my logic. It may be messed up but....
If a homeowner can own guns, not lock them up and then they get taken and used in a crime, the homeowner can be held accountable.
If a hacking company has exploits, doesnt lock them up properly, they get taken and used in a crime, can the hacking company be held responsible?
Thank God my HTC EVO 4G with Android 2.3 is safe
If I have been able to see further than others, it is because I bought a pair of binoculars.