Slashdot Mirror
New Cache Attack Can Monitor Keystrokes On Android Phones (onthewire.io)
Trailrunner7 quotes a report from OnTheWire:
: Researchers from an Austrian university have developed techniques that allow them to perform cache attacks on non-rooted Android phones that can monitor the keystrokes, screen taps, and even observe code execution inside the ARM processor's TrustZone secure execution environment. The attacks the team developed are complex and rely on a number of individual building blocks. The techniques are similar to some used against Intel x86 processor-based systems, but the team from Graz University of Technology in Austria shows that they can be used on ARM-based systems, such as Android phones, as well.
"Based on our techniques, we demonstrate covert channels that outperform state-of-the-art covert channels on Android by several orders of magnitude. Moreover, we present attacks to monitor tap and swipe events as well as keystrokes, and even derive the lengths of words entered on the touchscreen," the researchers wrote in their paper, which was presented at the USENIX Security Symposium this week.
It's a proof-of-concept attack. But interestingly, another recently-discovered Android vulnerability also required the user to install a malicious app -- and then allowed attackers to take full control of the device.
"Based on our techniques, we demonstrate covert channels that outperform state-of-the-art covert channels on Android by several orders of magnitude. Moreover, we present attacks to monitor tap and swipe events as well as keystrokes, and even derive the lengths of words entered on the touchscreen," the researchers wrote in their paper, which was presented at the USENIX Security Symposium this week.
It's a proof-of-concept attack. But interestingly, another recently-discovered Android vulnerability also required the user to install a malicious app -- and then allowed attackers to take full control of the device.
Actually, according to TFS, actually TWO separate Vulnerabilities.
Kinda reminds me of the "heyday" of Windows Exploits.
And of course, the worst thing is that most Android devices in the wild will never see a patch for any of them...
marketing companies in Brazil are loving it. I miss using swift because of those bluetooth suckers from Reweb. :/
Ah! E ai dar tua bundinha pra ver se passa essa sua mania esnobe de exibir que todo mundo te come. tu deveria sair desse estado, porque as gurias daqui não são cocota maconheira filha de rato.
The sky is falling, and it fucking hot and humid.
What it is nigga
It's amazing to me that there are so many ways to nail a phone with malware or spy on it or do something malicious to it or with it.
You'd have thought that eventually they'd run out of new vulnerabilities to find, but damn, it's just like a never-ending shitstorm of exploit after exploit after exploit that never seems to stop.
Yes, these are complex devices with a large attack surface (obviously, lol) but still, it's incredible that new exploits or holes or flaws are found almost every single day.
Just cruising through this digital world at 33 1/3 rpm...
It's at least once a week now it seems. Why would anyone want such insecure phone. This is just getting insane. Wave you're Google hardon all you like but the facts are this is a horrible platform for security.
It's bad enough having to deal with Microsoft's ineptitude on a daily basis, and now we have to look over our shoulder when using our phones? What decade is this? I thought we were past all this crap. Having to install third-party security utilities and/or waiting around for OTA updates is pathetic.
and then allowed attackers to take full control of the device.
Who's playing my Pokemon Go?!?
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.