Slashdot Mirror
Linux Traffic Hijack Flaw Also Affects Most Android Phones, Tablets (zdnet.com)
Zack Whittaker, writing for ZDNet: As many as 80 percent of Android devices are vulnerable to a recently disclosed Linux kernel vulnerability. Security firm Lookout said in a blog post on Monday that the flaw affects all phones and tablets that are running Android 4.4 KitKat and later, which comes with the affected Linux kernel 3.6 or newer. According to recent statistics, the number of devices affected might run past 1.4 billion phones and tablets -- including devices running the Android Nougat developer preview. Windows and Macs are not affected by the vulnerability. The flaw, disclosed at the Usenix security conference last week, is complicated and difficult to exploit. If an attacker can pull off an exploit, they could inject malicious code into unencrypted web traffic from "anywhere". However, the source and destination IP address would need to be known in order to intercept the traffic, adding to the complexity of carrying out a successful attack.The exploitability isn't easy, though.
If you use leenux and open sores software, its your fault if you are so dumb to trust it. Better use apple operating systems, they are safe and secure, because their source is closed and therefore its hard to find bugs.
>"Windows and Macs are not affected by the vulnerability."
Oh, cute comment in the summary. Here, let me fix/expand that for you...
"MS-Windows and MacOS are not affected by THIS vulnerability but are affected by many, many thousands of others, plus this obscure and unlikely-to-be-exploited security issue has already patched in Linux over a month ago."
Patch: http://git.kernel.org/cgit/lin...
Or you can fix it on any Linux system with a simple kernel variable change: 1) Open /etc/sysctl.conf, with an editor, such as vim. 2) Enter the line: net.ipv4.tcp_challenge_ack_limit = 999999999 3) Save the file. 4) Use the shell command "sysctl -p" to update the configuration.