Slashdot Mirror
Linux Traffic Hijack Flaw Also Affects Most Android Phones, Tablets (zdnet.com)
Zack Whittaker, writing for ZDNet: As many as 80 percent of Android devices are vulnerable to a recently disclosed Linux kernel vulnerability. Security firm Lookout said in a blog post on Monday that the flaw affects all phones and tablets that are running Android 4.4 KitKat and later, which comes with the affected Linux kernel 3.6 or newer. According to recent statistics, the number of devices affected might run past 1.4 billion phones and tablets -- including devices running the Android Nougat developer preview. Windows and Macs are not affected by the vulnerability. The flaw, disclosed at the Usenix security conference last week, is complicated and difficult to exploit. If an attacker can pull off an exploit, they could inject malicious code into unencrypted web traffic from "anywhere". However, the source and destination IP address would need to be known in order to intercept the traffic, adding to the complexity of carrying out a successful attack.The exploitability isn't easy, though.
it's
Time for the Slashdot crowd to tell us why this is a good thing and why Android still rulez.
How is this different from a typical MITM attack?
Is this saying that it's a MITM attack that can exploit a flaw in the kernel resulting in arbitrary code execution?
If so, wouldn't a regular (compromised/malicious) website be able to do the same thing without the MITM being necessary, HTTPS or not?
If it's not saying that it's a MITM attack that can exploit a flaw in the kernel resulting in arbitrary code execution, WTF is it saying?
Google has perhaps known about this for ages and used the knowledge as motivation to promote wider use of encryption.
My now apparently unsupported moto x 2014 (thanks Lenovo) runs kernel 3.4
I guess that makes me safe?
The link was from here, which also suggests a fix for unpatched systems:
echo 'net.ipv4.tcp_challenge_ack_limit = 999999999' >>/etc/sysctl.conf;sysctl -p
(Courtesy of this site.)
And Apple has an excellent history of bug fixes compared to Linux.
Apple has an excellent history of hiding fixes compared to Linux. FTFY
Compared to Linux? No, they don't, not even close.
Compared to Android as shipped in phones (i.e. not AOSP), then yes, Apple has a much better track record.
I love my Moto X Force. Motorola has absolutely no software support for their phones! There was one update to Android 6.0 Dec 15 . Absolutely no security updates!! So no fixes for ANY security issues.
I've got the mitigation on all of my Linux machines, but does it work on Android? Looks like the user would be forced to root an Android in order to apply the fix, if it works.
"As many as 80 percent of Android devices are vulnerable to a recently disclosed Linux kernel vulnerability"
"Windows and Macs are not affected by the vulnerability."
Wait, run that past me again? You're absolutely sure this linux issue doesn't affect devices which don't run linux?
My Nexus 6 is similar to your X Force... perhaps somebody can get one of the Nexus 6 ROMs to work on not just your device but all the other Motorola models that are relatively similar.
But even Google says they will stop guaranteeing updates for the Nexus 6 once Nougat is released. Keep in mind, the Nexus 6 was still a current product up until 9 months ago and you can still get them new in the box. But they've already warned us to not expect much. Not sure if this is Google or Motorola or both declaring this thing dead but damnit this was still a mainline product within the last year. And now it's already an orphan?
Well, I suppose I should not be too upset: the four Android phones I had before this one got only one or two updates between them, ever. The Nexus 6 has gotten monthly security patches and IIRC 3 major OS updates in the last few months.
Sig for hire.
This would worry me if there were any active exploits of security flaws. The fact is that mobile phone users in general are dumb as doorknobs and there are far easier ways to exploit the user and gain access to the phone through the legitimate pathways that the OS provides rather than exploiting security holes.
"Do you wan"OK yes OK I've clicked OK already just go away stupid popup asking me a question I didn't read!
Linux/Androd flaw, 30ish comments and the only modded up ones are espousing the greatness of Lnux, despite the fact this will never be fixed on a majority of devices.
iOS flaw, 300 comments modded up talking about how shitty the platform and how awesome Android is, despite the face that said flaw will likely be fixed on any device from the last 5+ years.
See subject: I've pointed that out many times this proves it all the more (as Android's surely NOT Windows or iOS/MacOS X) - & as per my usual? So much for the CRAP spouted here on /. for decades of "Windows != Secure, Linux = Secure" horseshit (until ANDROID came around proving QUITE otherwise that is).
* Additionally: So much for "all those BLIND EYES on 'Open SORES' code", eh?
(Lies they spouted for YEARS on this site are falling apart around your ears... nigh constantly, courtesy of ANDROID!)
APK
P.S.=> Lastly: The reason for this post? I've had FOOLS around here say "Android is NOT a Linux" (whenever I've pointed out it IS a Linux variant) well again:
Using a Linux core, it's surely NOT Windows OR iOS/MacOS X - WHICH ARE NOT AFFECTED BY THIS EXPLOIT...
&
This problem proves my point yet again all the more that android IS a form of Linux (with a STUPID java ('dalvik') front-end making it even MORE vulnerable than ever due to all the TONS OF FLAWS in Java)... apk
For those who care about technical details, the exploit is CVE-2016-5696
About the importance to a man of a suitable clenchbox which will serve to drain
him speedily and with thoroughness.
For a man to remain municipally vital and spiritually proficient he must keep his
scagbag on all days freshly drained, To do this properly he must have an anode to his
diode which will urge the lungers from his lingam in rapturous fashion. Irreplaceable
in this mans testation is clenching, which must be garnered from the fleshfilled
aperture of another. Unless it is absolutely necessary, no hands or dairy products
should be used in the facilitation of dong-drainage, as doing so would refute the Lord's
roster of appropriate uses for semen.
About the ways of a man meeting the woman he wants for his wife; and apprising her of
his affections. When a man meets a woman he'd like to see on the receiving end of his
stinkhammer, he shall convey to her his affection by unsnapping the back flap of her Dr.
Dentons and worming his finger into her anus until she indicates her mutual attraction
by squeaking.
About the business of a man properly emptying his crimson kingfish within the confines of
his wife.
A man who wishes ro properly enact congress must execute the following procedures of
eroticism:
1. Foreplay
2. Penetration of the beefpit
3. Washing
4. Slumber
Firstly a woman must have her "breasts" enlarged and adorn herself with a wig which shall
kindle the embers of desire within a man in a way that he shall want to manifest via the
thrustfull expressions of his fishmallet. When a man is in bed with his wife and they are
wearing only their underclothes, he shall embark on "foreplay". "Foreplay" begins with
the man lightly touching the "breasts, which are the mounds of fat on a woman adjacent
to her biceps. Then, with his tongue and the palms of his hands, he caresses the deep,
pungent crinkles of her rectum, exciting the woman until her bouiiabaisse is moist and
fretful. These actions shall also make the man boil with the hot bristling hemoglobin of
passion, and he shall feel as if his stinkhammer were full of a hundred hard-beating
hummingbird hearts.
When "foreplay" is completed it is time for the man to place his cheeseflag into the flesh
filled fissure at the fork of the woman's gams, often called her "beef pit." Once penetration
is achieved he shall extrude his juice along the slippery walls of the woman's sperm-thirsting
stench trench, while she uses her fingernails to fondly taunt the fatty flesh that forms the
front curtain of the scrotum.
As this is being done the man shall exaltedly chant, "jean Baptiste hath sown the grayest
grapes" and selections from the New Testament, and the woman shall break into a joyful chorus
of "Kama kama kama ka - me - li - un' Once the baby gravy has been completely pumped, the
man shall reclaim his wilting stalk and walk it to the comfort Station for bathing.
Once in the bath, he makes for himself a hot shower, and with a large amount scouring soap and
loofah pads laves from his member the gunk which has accrued and made it all shiny and glisten-
ing and ripe like a chowder. After this the man returns to his mattress where he may enjoy the
rewards of sleep and thick vivid dreams about automobiles and fine tailoring.
(no further text)