Slashdot Mirror

← Back to Stories (view on slashdot.org)

Linux Traffic Hijack Flaw Also Affects Most Android Phones, Tablets (zdnet.com)

Posted by msmash on from the security-blues dept.

Zack Whittaker, writing for ZDNet: As many as 80 percent of Android devices are vulnerable to a recently disclosed Linux kernel vulnerability. Security firm Lookout said in a blog post on Monday that the flaw affects all phones and tablets that are running Android 4.4 KitKat and later, which comes with the affected Linux kernel 3.6 or newer. According to recent statistics, the number of devices affected might run past 1.4 billion phones and tablets -- including devices running the Android Nougat developer preview. Windows and Macs are not affected by the vulnerability. The flaw, disclosed at the Usenix security conference last week, is complicated and difficult to exploit. If an attacker can pull off an exploit, they could inject malicious code into unencrypted web traffic from "anywhere". However, the source and destination IP address would need to be known in order to intercept the traffic, adding to the complexity of carrying out a successful attack.The exploitability isn't easy, though.

5 of 39 comments (clear)

  1. Re:What? by quenda · · Score: 3, Informative

    How is this different from a typical MITM attack?

    The attacker does not have to be "in the middle" .
    But standard defence against MITM - don't trust unencrypted connections - would work fine for this as well, I would think.

  2. Patch already available (I think...) by by+(1706743) · · Score: 2, Informative
    Patch.

    The link was from here, which also suggests a fix for unpatched systems:

    echo 'net.ipv4.tcp_challenge_ack_limit = 999999999' >>/etc/sysctl.conf;sysctl -p

    (Courtesy of this site.)

    1. Re:Patch already available (I think...) by by+(1706743) · · Score: 3, Insightful

      (Here's the patch from a more familiar source, kernel.org.)

    2. Re: Patch already available (I think...) by buchanmilne · · Score: 2

      All the different distributions of Linux combined with no user friendly way of keeping the latest patches installed is just asking to be trouble.

      All the distros I have used have had both n00b-friendly and cli-autobatible options for installing updates for more than a decade. E.g. red icon pops up in systray, click it to see what updates are available, deselect some if you need to defer restarting something, click the update button. and carry on with what you were doing. If a kernel or very common lubrary update was installed, you're informed at the end that you should reboot and you are asked if you want to reboot or do it yourself later.

      I don't know how it could be any more user friendly.

  3. One more reason I hate Lenovo/Mororola support (NO by blueskiesokie · · Score: 3, Informative

    I love my Moto X Force. Motorola has absolutely no software support for their phones! There was one update to Android 6.0 Dec 15 . Absolutely no security updates!! So no fixes for ANY security issues.