Slashdot Mirror
Open Ports Create Backdoors In Millions of Smartphones (bleepingcomputer.com)
An anonymous reader writes: "Mobile applications that open ports on Android smartphones are opening those devices to remote hacking, claims a team of researchers from the University of Michigan," reports Bleeping Computer. Researchers say they've identified 410 popular mobile apps that open ports on people's smartphones. They claim that an attacker could connect to these ports, which in turn grant access to various phone features, such as photos, contacts, the camera, and more. This access could be leveraged to steal photos, contacts, or execute commands on the target's phone. Researchers recorded various demos to prove their attacks. Of these 410 apps, there were many that had between 10 and 50 million downloads on the official Google Play Store and even an app that came pre-installed on an OEMs smartphones. "Research on the mobile open port problem started after researchers read a Trend Micro report from 2015 about a vulnerability in the Baidu SDK, which opened a port on user devices, providing an attacker with a way to access the phone of a user who installed an app that used the Baidu SDK," reports Bleeping Computer. "That particular vulnerability affected over 100 million smartphones, but Baidu moved quickly to release an update. The paper detailing the team's work is entitled Open Doors for Bob and Mallory: Open Port Usage in Android Apps and Security Implications, and was presented Wednesday, April 26, at the 2nd IEEE European Symposium on Security and Privacy that took place this week in Paris, France."
Is there a list of the problematic apps that they found? Their paper - which can be found here: http://web.eecs.umich.edu/~jac... - lists a few example, but it would be useful to know the full list.
How about a port of "little snitch" to android phones. I've got it on my Macs and I love it.
I searched the PDF of the paper and found no mention of either Apple or iOS, but Android and Java are mentioned multiple times.
ES File Explorer is apparently the poster child.
I am now using Solid Explorer which is just as good in all the other ways
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Can you suggest a reason why a smartphone application should listen on a port without you knowing it?
I don't need to know what ports have been opened by an app, as long as it works. It's what the app does with that connection that is of interest.
I'd be more concerned with the app reporting back to HQ with whatever data they mine from your use of it.
slashdot: A failed experiment.
Because you're going to get really tired of being notified real fast.
Because it's essential for its operation, for example?
Ezekiel 23:20
Open ports by themselves don't constitute a security risk.
This comment is sadly the kind of horrifically dangerous and stupid comment that permeates the Android technical community.
If a port is opened on an Android device, that 100% means that an app opened it for some reason, which means that 100% there is for some period of time going to be a service running that receives on that port. Maybe the user deletes the app but why would they? Most people wouldn't bother. Many probably do not even know HOW.
So that means that ALL of the most vulnerable people are at risk, which you casually dismiss because an open port "means nothing", the way an orange glow and smoke pouring from a house "means nothing" until the external edifice is reduced to ashes...
I mean, a separate comment I saw pointed out that android users really should use netstat of the phone. Good grief.
This is why I cannot in good conscious do anything except steer every non-technical user away from Android.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
How many people root their Android device? Has anyone looked into SuperSU and how the simple su binary works? Nope.
The su binary that is passed around for all rooted Android distros has no source. It is maintained by a random person with financial motivation to not be conservative with your privacy or security.
I don't think Android users really care about backdoors to be honest
Of course the problem can be reduced if we were allowed to control a root level firewall on our android or iphone devices.
But of course we are paying for phones so someone else can use them to suck data and use it to spy or advertise to me in a really creepy way. Pretty damn frustrating.
My ism, it's full of beliefs.
Why should an app call listen()? For what operation?
Once more, for what reason should an app call listen()? Be specific.
BTW that is absolutely false. While an already open (and active) point to point connection is relatively hard to compromise, an application that is listen()ing on a port can be compelled to accept data from any source, at will, and repeatedly.
This makes buffer overflow (or other remote exploits) attacks trivial to both test and execute successfully.
There is a difference between calling listen() and connect().
It depends on what the app does. It may be essential for the service it provides. 2 examples I use frequently - SSH Server and XServer XSDL.
The slashdot web server listens on port 80, that's a huge security risk!
Run home and wrap tin foil on your heads everyone!
I love burekas in the morning
We're not talking about server apps like sshd.. Obviously that would listen on 22. We're talking about random apps that call listen without your knowledge.
How about using Starbuck's W-LAN?
Security? Meh.
Yes, I'm being sarcastic, if unclear.
Sines of Impending Sines
Do they assign every customer an own ip with open port? I do not think so ... I guess you're just getting a LAN IP and NAT to the internet again. ...
With IPv6 it gets interesting again
Who said anything about "you knowing it"? You run closed source software, that is what you get. You don't know what an app is doing? My comment said nothing about that.
If I wrote an app that allowed you to transfer photos to the phone via a socket, how would the photos get transferred? Magic? Most server type process needs ports. Open ports aren't the problem. Closed source is.
Actually, given that most software (except some carefully hardened server software) is insecure, an open port is very much a risk if it connects to an app.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Indeed. Methinks some people here do not understand the difference between a listening port and a port used in an active connection.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
One endpoint is calling listen(). Are you saying calling listen() is a security risk? That makes no sense. You have dozens of ports "open" on the computer you use every day. A mobile phone normally doesn't have a public IP anyway, and is behind a carrier NAT usually. I think you guys are confusing "open ports" with "closed source". Open ports are fine. The Internet is full of them. That is how things communicate. The problem is you don't know what these "apps" are doing.
Really? You do realize your computer has dozens of "open ports" right now, right? How do you think computers communicate? Magic? Open ports are not by themselves a security risk.
Any "app" you download can do ANYTHING THEY WANT without your knowledge. If you cared about security you wouldnt use them.
Well, if my flashlight app wants to open a listening port on the network, that in and of itself seems fishy to me. Furthermore, the more services are listening for connections, the higher the chance that one of them is badly coded and will allow an attacker to get access to my data.
There i'd be more concerned they didn't enable wireless isolation on their router.
Why is that more fishy then it connecting to a server in China and sending all your data there? What is the difference? You are installing a closed source app. It could be doing anything. If you were concerned about your data, why would you install a flashlight app from a random person?
Open ports are not by themselves a security risk.
Not by themselves, but there's no such thing as an open port by itself. We're obviously talking about listening, so we need not discuss ports opened outward, although there are definitely ways to compromise an application in reverse, so opening a TCP connection outward is an opportunity for an incoming attack, if you connect to a host which is malicious (whether inherently, or because it has been compromised.) But at minimum, listening ports provide an opportunity to attack the networking stack of the device, and the application (or daemon, etc etc.) which opened the port. So yes, open ports absolutely do increase your security risk. If there are zero open ports on the device, then the only parts of the networking subsystem with which you interface are the network interface and its driver, which means there's less opportunity to exploit a vulnerability.
Saying open ports are not a security risk is like saying that open windows are not a security risk. What? Of course they are.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
This was my most recent comment on Android and 'apps': https://slashdot.org/comments..... With this, I see no reason to change my mind. There's some reason we close all the ports we can and create solid firewall rules, isn't there?
I'm going to try this next: https://jolla.com/about/ but I'm not at all convinced that it's better.
On y va, qui mal y pense!
I've not seen a good iptables app on f-droid. The ones I've seen seem to allow you to block all network activity for an app, I'd like to block inbound connections but allow outbound.
Dos bowlos. Bobbin malwarey? Bop in male wary? Bah. Been Mallory? Maybe "Bob and Mallory" is an anagram for "anal dorm lobby"?
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
Then maybe we can load up 3 layers of anti-virus software. And also just accept that your phone is going to get hacked every several months, so you should learn how to wipe it clean and start over. Or pay someone at Best Buy to do it for you. This is exactly the strategy that lead to Windows becoming a cesspool of malware during the early 2000s--let's totally replicate it with all the computers we keep in our pockets. You know, the ones that have our payment info and all of our contacts.
Did you notice that the article didn't note any security problems at all with iOS applications opening ports? I wonder why...
If nobody calls listen(), what do you connect() to?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
"Security researcher" is the new term for failed CS majors.
The paper linked from the /. story explains how they analyzed the apps to check the vulnerability of the open ports. The paper is perfectly aware that open ports themselves are not necessarily dangerous, but emphasizes that roughly half of the smartphone apps that open ports do not secure them against attacks.
If "security researcher" is the new term for failed CS majors, what is the new term for people who criticize a paper without reading it?
What is the difference between an open port on an Android device and the dozens that are open on your personal computer? Nothing.
That is absolutely correct, and we all know that personal computers are rife with security flaws.
Part of that is because services are sitting at a number of different open ports, every service that is doing so increases the chances of a successful attack vector being present on your system,
So now we bring forward this same, known to be failed and dangerous, security model to the phone? Remember the original comment was talking about how open ports "are not dangerous" - with the implication that nothing is necessarily behind those open ports. But just like the PC we all know today, if something opened those ports that almost certainly means there is a service sitting there, listening, possibly vulnerable...
Or would you like to ignore decades of failed PC security?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I doubt that very much. If you actually had written any such software in any real sense, you would not write such nonsense. And incidentally, you have no idea how much networked software I have written.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
u are hand waving a bunch of dumb shit like "app opens a port and then the app is gone
There's the exact problem though. Why do you THINK the app is gone?
If the app has permission to open a port that means it had permission to have a long-running service sitting on that port.
Why else would it open the port if it were not going to do just that?
Most non-technical users rarely if ever delete apps...
I mean, I agree that android phones are utter shit
They aren't at all, they work really well.. it's just that they ALSO bring the same security risk as any PC to a group of users who by and large have no technical ability to understand, or deal with the risk they are taking on. Sp it propagates the decades of horrible security flaws the PC world has enjoyed, like bank account being compromised, or identities stolen.
It bullshit to claim that is OK, that it's not really a problem when it is a massive problem that affects the people who can least afford to deal with it.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Probably the same reason why an app to connect to your blood pressure machine via blue tooth to retrieve readings needs access to your images, contacts, email, and account information. If you can figure that out, let me know too. But my best guess would be to update or change the advertising and track you (and the ads displayed) should you disable internet access for the app itself (say a card game that only needs internet for advertising).
Thank you for making it clear to anyone who might have a doubt that you literally don't understand how networking works in case anyone thought I was being too hard on you.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
I would not hire you for any networking job.
Did you actually read my post?
None. Though that doesn't address the issue that there has to be a vulnerability to exploit. If there's no vulnerability, more open ports don't decrease security.
And you've illogically assumed that N+1 is always worse than N. By that reasoning, as we know windows are less secure than walls, no building should have more than one window. Everyone can share it. Any more than that must be, by nyet's definition, insecure.
Learn to love Alaska
You don't need an open port listening to scrape all your data and send it away. So why do the open ports matter more than the general security?
Learn to love Alaska
Why do you pretend P2P doesn't exist? I guess every P2P app should be blocked because you can't think of a good reason for P2P to exist.
How would you have IoT? Every device calling to a paid central server that can lock you out of your house/garage if you give them a bad review? Or a secure P2P communication so your devices can talk to each other without using ransomware, I mean central server?
Learn to love Alaska
You use connect(), not listen()/accept()
listen() is fundamentally more dangerous than connect().
Sure, the app maker may scrape all your data and send it to their server. How is it in any way better to then leave a port open so that anyone can try and compromise your device and grab a copy for themselves?
Do we really need a new term? Can't we just keep calling them Slashdotters?
With no apps installed, there'll be open ports. So it's up to you to prove that one more open port will greatly diminish the security of the device. And zero open ports still allows an malicious app to send everything to a central server, so the issue of "malicious apps" indicates they wouldn't need (or want) open ports.
Learn to love Alaska