Slashdot Mirror
Software Flaw Puts Mobile Phones and Networks At Risk Of Complete Takeover (arstechnica.com)
Dan Goodin, reporting for Ars Technica: A newly disclosed vulnerability could allow attackers to seize control of mobile phones and key parts of the world's telecommunications infrastructure and make it possible to eavesdrop or disrupt entire networks, security experts warned Tuesday. The bug resides in a code library used in a wide range of telecommunication products, including radios in cell towers, routers, and switches, as well as the baseband chips in individual phones. Although exploiting the heap overflow vulnerability would require great skill and resources, attackers who managed to succeed would have the ability to execute malicious code on virtually all of those devices. The code library was developed by Pennsylvania-based Objective Systems and is used to implement a telephony standard known as ASN.1, short for Abstract Syntax Notation One."The vulnerability could be triggered remotely without any authentication in scenarios where the vulnerable code receives and processes ASN.1 encoded data from untrusted sources," researchers who discovered the flaw wrote in an advisory published Monday evening. "These may include communications between mobile devices and telecommunication network infrastructure nodes, communications between nodes in a carrier's network or across carrier boundaries, or communication between mutually untrusted endpoints in a data network."
I've done my bit to try to eradicate ASN.1 from standards I work on. But there's always 2 or 3 vocal people going to great lengths to keep it in there. It's become more clear over time that they don't only work for their stated employers.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
First I've heard.
Yet again..ASN.1 rears it's head.
And the hackers are already using that vulnerability to insert random apostrophes into posts made from mobile devices.
Don't disappoint your bird dog. Go to the range.
Outlaw revealing of information related to design and vulnerabilities, and declare victory.
This is what happens when the lawmakers we got are stuck in the mindset of 1950s.
ELOI, ELOI, LAMA SABACHTHANI!?
Donald will fix it. He'll regulate the telecoms back to the fifties, when everything was Great.
Obama's fault
Yes and no. ASN.1 predates his term in office. But his grant of retroactive immunity to the telecoms just perpetuates this sort of dirty dealing. A standards-making body might try to demand that participants declare their interests in patents or government espionage units. But if they have a 'get out of jail free' card from him, they can say or hide anything they want.
Have gnu, will travel.
So... could the Feds use a Stingray to distribute this to a targeted phone?
I wonder how far we are from a point when patching a vulnerability (that NSA, etc. depend on) will be prosecuted as an act of war/terrorism/think of the children/whatever irrational fear we're rallying against this week.
If we had unicode here, that apostrophe would be a virus.
Donald will fix it. He'll regulate the telecoms back to the fifties, when everything was Great.
It will be "fixed" before he gets in office.
It's revealed now so the NSA (ASN backwards!) backdoors can't be used by enemies of the left.
This is a clear sign the left knows they are going to lose in November.
ASN.1 is quite complex, and quite more complex than it should be, because of a long history of committee-driven development. In particular, it includes a lot of distinct character string types for no apparent reasons, and its types to encode dates are remarkably inefficient and hard to handle (and one of them is subject to Y2K issues, currently scheduled for 2050). Faced with this complexity, developers often found attractive the idea of doing specialized decoding "just for certificates", in order to avoid the daunting task of implementing a generic and systematic decoder (in particular, it is possible but inconvenient to implement a full-featured generic ASN.1 decoder in languages such as C which lack automatic memory management, e.g. garbage collectors).
Doing specialized code "by hand", to avoid the overhead of a systematic approach, means that the developer will need to think a lot more about possible issues when presented with "abnormal" data. This is a fertile ground for vulnerabilities (developers are only human, after all) and this is precisely what happened in OpenSSL.
The bug is with a commonly used third party library that implements ASN.1, it has nothing to do with the ASN.1 standard itself. Your solution is for everyone to stop using SSL/TLS because of bugs with OpenSSL?
Those who do not understand ASN1 are doomed to re-invent it. Poorly.
Look at abominations like binary xml.
"They";
- Could,
- might,
- it's possible
Fuck off with the paranoia and prove it in the wild before more scare-mongering to make everyone buy new shit every few years. I am just so getting tired of it.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
Anyone know?
"ASN.1 is a mental masutrbation-fest."
MasUTRbation? That's what happens when you try to type with the wrong hand because the other's (getting) busy.
This flaw resides in a version of the library implemented on a specific platform, namely Windows running on x86 hardware. Makes a good case for not running your infrastructure on a software monoculture. This isn't the first such discovery, see Microsoft ASN.1 Library Length Overflow Heap Corruption from July 2003.
If you stand next to an AC outlet it is plugged into it won't be at risk of complete takeover.
This is a bullshit story. How it really is, is all mobile networks are already spy networks. Every SMS, every voice call, and voice pattern, and web surfing, and email, and the rest are all tracked and stored along with GPS. GPS won't shut off like you think because it is there for E911 emergency services.
You people are some totally stupid fuckers with these stories.