Slashdot Mirror
Active Drive-By Exploits Critical Android Bugs, Care Of Hacking Team (arstechnica.com)
Dan Goodin, reporting for Ars Technica: An ongoing drive-by attack is forcing ransomware onto Android smartphones by exploiting critical vulnerabilities in older versions of Google's mobile operating system still in use by millions of people, according to research scheduled to be published Monday. The attack combines exploits for at least two critical vulnerabilities contained in Android versions 4.0 through 4.3, including an exploit known as Towelroot, which gives attackers unfettered "root" access to vulnerable phones. The exploit code appears to borrow heavily from, if not copy outright, some of these Android attack scripts, which leaked to the world following the embarrassing breach of Italy-based Hacking Team in July. Additional data indicates devices running Android 4.4 may also be infected, possibly by exploiting a different set of vulnerabilities.Blue Coat, a California-based provider of security and networking solutions writes: This is the first time, to my knowledge; an exploit kit has been able to successfully install malicious apps on a mobile device without any user interaction on the part of the victim. During the attack, the device did not display the normal "application permissions" dialog box that typically precedes installation of an Android application. After consulting with analyst Joshua Drake of Zimperium, he was able to confirm that the Javascript used to initiate the attack contains an exploit against libxslt that was leaked during the Hacking Team breach. Drake also confirmed that the payload of that exploit, a Linux ELF executable named module.so, contains the code for the "futex" or "Towelroot" exploit that was first disclosed at the end of 2014.
That when a backdoor is held by the "good guys" (I use that term loosely but Hacking Team sold primarily to governments) it's just a matter of time before the bad guys get ahold of it and start fucking everyone over. Pay attention, Mrs. Feinstein.
Which suits the carriers - who make money off bundling shitware and selling "upgrades" to new phones - just fine, but what the fuck, Google. It's been half a decade. It's long past time for you to tell the carriers to permit users to download their own security patches.
Imagine if users couldn't get Windows updates from Microsoft, but relied on their own ISP - and whether it's Comcast or AT&T doesn't really matter.
Fuck. That. Noise. Get the carriers out of the OS business.
Why aren't there more lawsuits against manufacturers and carriers for not providing updates? When I buy a phone, I should be able to expect security updates for at least 24 months, preferably 36 months. Manufacturers aren't interested in supporting older phones because they make money when people update. Carriers seem primarily concerned with loading up the updated versions with crapware that people don't want, can't easily remove, and may well contain vulnerabilities of its own. Why aren't there more lawsuits demanding reasonable support? Android 4 isn't that old; lots of phones still run it.
TowelRoot? That only worked on a handful of devices reliably. And yes, when I used it I got zero sleep for the rest of the week. A single click root? Not good folks, and clearly someone has taken on the task of using that for nefarious purposes. Notice, though, how everyone is blaming hackingteam for this stuff, and not the NSA who likely knew about this long before them.
Thank God my HTC EVO 4G with Android 2.3 is safe
If I have been able to see further than others, it is because I bought a pair of binoculars.
That's why I need to ask, does Android need to be rewritten using the Rust programming language?
Well, you can certainly ask... But rewriting over fifteen million lines of code (not to mention the billions of lines written to those C-based APIs) built, tested, hardened, and tested over the course of decades is a non-starter. And besides that, no matter how perfect a *language* is, programmers will still find ways of screwing up by the numbers. C does make that easier, of course, but I don't believe there's a way to avoid the problem completely. And like it or not, our computer infrastructure is likely to remain based on C for decades to come simply due to sheer inertia.
What we can perhaps *practically* achieve is a new attitude and awareness about patching and supporting these devices for a reasonable lifetime. The carriers and manufacturers simply need to get out of the damned way, or else we may ultimately have to legislate them out of the way - and I don't like going there if it can at all be avoided. Google is slowly moving towards putting core components into the Play store, where they can be patched without interference by anyone. I definitely think that's a move in the correct direction. And manufacturers need to understand that they're selling tiny computers on which people store the most intimate details of their lives, not throwaway hardware toys, with all the responsibility that entails.
It's hard to predict what will happen when we start to approach "peak smartphone" market saturation as smartphones themselves continue to stabilize in form and function. On the one hand, slowing technical and functional growth is likely to have a stabilizing influence on the software simply because of less churn. Unfortunately, a shrinking market may put pressure on manufacturers to reduce already miserable long-term support.
Irony: Agile development has too much intertia to be abandoned now.
How do you know the hackers didn't come-up with the exploit themselves? Or that they didn't actually have it before the good guys did?
Heres my logic. It may be messed up but....
If a homeowner can own guns, not lock them up and then they get taken and used in a crime, the homeowner can be held accountable.
If a hacking company has exploits, doesnt lock them up properly, they get taken and used in a crime, can the hacking company be held responsible?
A better gun analogy would be you design a gun which can be manufactured on a 3D printer and leave the plans for the gun unprotected on your server. Someone downloads the plans, makes the gun on their 3D printer and uses the gun to commit a crime. Can the designer who didn't protect the plans adequately be held liable? I really don't know one way or the other, but I think it's a better analogy.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Basically, unpatched software is vulnerable... seems about right
Basically, software is vulnerable ... seems about right