Slashdot Mirror
Android Phones Can Be Hacked Remotely By Viewing Malicious PNG Image (csoonline.com)
An innocent-looking image -- sent either via the internet or text -- could open your Android phone up to hacking. "While this certainly doesn't apply to all images, Google discovered that a maliciously crafted PNG image could be used to hijack a wide variety of Androids -- those running Android Nougat (7.0), Oreo (8.0), and even the latest Android OS Pie (9.0)," reports CSO Online. From the report: The latest bulletin lists 42 vulnerabilities in total -- 11 of which are rated as critical. The most severe critical flaw is in Framework; it "could enable a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process." Although Google had no report of the security flaws being actively exploited, it remains to be seen if and how long it will take before attackers use the flaw for real-world attacks. Android owners were urged to patch as soon as security updates becomes available. But let's get real: Even if your Android still receives security updates, there's no telling how long it will be (weeks or months) before manufacturers and carriers get it together to push out the patches.
Really glad all these software engineers who railed against malicious PDFs delivered through the Flash plugin, can't do any better when left to their own devices.
In before the smug Apple fans who want desperately to pretend this is as bad as FacePalm.
It's not. It's a theoretical exploit that may lead to actual exploits, but even then, they likely have to be crafted for the specific phone. Compare that to a broken feature that you can use from any device with FaceTime on it.
And at least you'll be able to get the bug fix with a simple security update, without having to also "upgrade" the rest of the phone's OS and accept random UI changes and new software designed to throttle the speed of old phones "for battery reasons" that, strangely, no phone from any other manufacturer suffers from.
Since the carriers are no longer providing updates.
Regretfully, I upgraded yesterday.
Wow, did the NSA ask for that to be added or is Google's whiteboard torture interview style just not selecting good candidates?
let's get real: Even if your Android still receives security updates, there's no telling how long it will be before manufacturers and carriers get it together to push out the patches
...I still prefer an iPhone.
Slashdot, fix the reply notifications... You won't get away with it...
Here's how: APK Hosts File Engine 1.0++ 64-bit for MacOS h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r M a c O S . z i p
Yields more security/speed/reliability/anonymity vs. any 1 solution (99% of threats use hostnames vs. IP address most firewalls use) more efficiently/FASTER + NATIVELY 4 less!
Vs. "Bolt on 'MoAr' illogic-logic" slowing you hosts speed u up 2 ways: Adblocks + Hardcode fav. sites u spend most time @ vs. competition loaded w/ security bugs (DNS/AntiVir) + overheads slowing u (messagepass 'souled-out' to advertisers easily detected & blocked addons + firewall filtering drivers) & their complexity leads to exploitation!
* ONLY 1 of its kind in GUI 4 MacOS!
(Better vs. Windows model in speed/efficiency)
APK
P.S.=> Protects against ALL known & unknown vulnerabilities. Now supports port filters in hosts. My work is world-class & China copied it because they can't do better. I am God's gift to Slashdot... apk
Block all images of naked women and replace them with dicks that I am ready to HOST... GAYpk
You can use this bug to execute privileged code? I assume that means as root. If someone publishes example code at some point, we could get a really convenient way to root phones. Maybe I should avoid updates for a while.
More OS memory access bugs, yay.
According to this breakdown, 88% of Android OS is written in Java, C, and C++ -- all of which are notorious for memory access bugs (in the runtime environment, in the case of Java). Perhaps the #1 security best practice should be to use a language designed to be memory safe. Right below that would be "don't try to bolt on security to insecure software."
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Google has been EXTREMELY self-destructive by allowing Android to be a method of abusing customers, in my opinion.
Android generally gets NO updates. That policy is intended to make more money for cell phone providers.
With Apple, you have to worry whether your device is up-to-date and secure.
With Droid, we can always be sure that we'll never be secure. It's refreshing and assuring.
Why can't non-x86 world ever get its shit together? One unified Windows or Linux image installs on countless hundreds of different x86 things.
Meanwhile everywhere else it's always bake a custom rom specific to each and every variant of every device. Why is it still tolerated? The old excuses of abstraction costing too much made sense 20 years ago. Today it's a joke/lame excuse for tolerating the indefensible.
Wwwwaaaaayyyy past time to fire the cooks.
THERE WILL ALWAYS BE CONSEQUENCES FOR YOUR LIES AND PROPAGANDA NAZI FAGGOT KEN DOLL UNTIL YOU DIE.
Filter error: Don't use so many caps. It's like YELLING. Filter error: Don't use so many caps. It's like YELLING. Filter error: Don't use so many caps. It's like YELLING.
Obviously we need complex multimedia formats that are decoded by C code complete with buffer overflows all running in Kernal mode.
But what would be even better is if the PNG could contain JavaScript inside it. Why limit the output to just a few algorithms? With JavaScript running actually inside the PNG much greater compression could be achieved for many applications. More importantly, a whole new plethora of animation techniques could be developed.
Indeed, if that JavaScript within the PNG was used to implement a Virtual Machine, a whole sub operating system could run inside that image. Just think of the possibilities!
We need more, Lots more. Of stuff.
Android Phones Can Be Hacked Remotely By Viewing Malicious PNG Image
I NEVER let my phone view PNG (or any other) images without supervision. I keep a small piece of electrical tape over the camera to make sure.
The x86 - or rather, the IBM-compatible - world is vastly different to the ARM world when it comes to system design. The entire family tree of x86-derived machines have gravitated towards open, or at least easily-licensed and inter-operable, hardware standards over the decades. Manufacturers want to keep their hardware reasonably compatible with everyone else, lest they be shut out of the market for being too 'niche'.
ARM, on the other hand, is almost the exact opposite. An ARM computer is often a custom-built hodge-podge of licensed hardware modules fitted around whatever ARM core the manufacturer licensed and etched onto silicon. Sound, graphics, memory. and other functions are not plug-and-play replaceable add-ons, but a custom chipset that the system designer picked out and configured. These bespoke system configurations will also have to contend with limitations on driver support and possibly the need to hand-configure settings.
Google has tried to correct this, and pull manufacturers to a more standardized system that would let Google handle a lot of the hard work, but this was never the norm in the embedded space.
Malicious PNG
All of those ARM chips (in Android) use GCC, an open compiler, so it isn't the chip that's causing problems. Most of the drivers are all open-sourced (the kernels is GPL, so they more-or-less have to), so it's not the hardware that's a problem.
The main problem is locked boot-loaders. If you can't install a custom ROM on a phone, that's probably the reason.
"First they came for the slanderers and i said nothing."
How do these things keep happening? What happened to sanity checking your input? Geezus, this is inexcusable.
How: C, C++, and Java making errors easy.
It's early days & we trade for speed with grossly unsafe situations. It's like a shortcut though a warzone.
We need contacts requiring:
- provably zero: buffer overflows, use-after-free, double-free, stack overflows, memory race conditions
- Malloc failures must crash if unrecoverable.
Then we could begin to have software with greater peace of mind.
Rust does this, as does JavaScript without extensions. Go does most and can be limited to a subset that does all. Some provers exist for C subsets.
Science & open-source build trust from peer review. Learn systems you can trust.
Not sure what's up with all the FUD about Android security patch irregularity. My Sony Xperia and One Plus phones are 3 years old and they are still receiving the monthly security updates from the manufacturer, so lag time is at most 2 months. It shouldn't be much different for Samsung and the other more popular brands and models.
It's true that updates between the major versions of Android are slow or even non-existent, but security updates are different. You can remain on an older version of Android and still receive security updates.
Move out of your shithole country and youll find plenty of devices with support, Drongo.
The reason I haven been installing updates in the past year! Common people, where is online no click root?
At least in comparison with any other Linux distribution.
I can understant the personalization and kernel issues to customize for a specific vendor. But kernel and drivers are a very specific piece of software.
Most components should be unified and distributed from a unique source, so Android should update without vendor intervention with most of the pieces of the Android base.
Actual way of Android only makes our phones completely insecure.
It seems a flaw made pointedly just to force us to update the hardware just because old hardware hasn't the needed software updates.
my vendor never pushed update beyond 6.0
Actually drivers are the problem. Particular drivers for radios.
In order to pass certification for things like FCC the drivers need to be certified too. If they were open source then the user could just crank up the transmit power on their cellular modem or wifi to illegal levels, and I imagine that the network operators wouldn't be too happy about it either.
This affects the x86 world too. Some laptops have a list of acceptable wifi cards baked into the BIOS. If you try to fit a non-certified one it won't work. Reason being that when you have 3 antennas they could potentially all be used to exceed acceptable transmission power limits if the user fits any random card, so the manufacturer has to limit to ones tested by the FCC etc. to never do that.
Having said that, Google has largely fixed this now. Modern versions of Android can be patched by the Play Store services directly, and indeed in this case the issue has been mitigated that way even if the manufacturer doesn't supply updates.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Ok, so you've successfully argued that they need to deliver a binary kernel module for IO. The rest of the OS and all the libraries need to be upgradeable on the play store, even between Android versions.
(Isn't that what Android 8.0's Project Treble was supposed to do? And if not, WTF didn't they do that?)
What you say is true, but there aren't that many SoC vendors. Support for just 5 chipsets would probably cover 90% of phones, and if you had support for 100 chipsets, you'd probably cover 99.99% of smartphones in use today.
It's totally possible to create a single OS which auto detects which of the 100 chipsets it's running on and behaves accordingly.
this just sucks, as we all know a lot of phones are not going to get any fix for this and even the ones that do will have to wait for a longer then normal time. i'm used to almost always same-day fixes on my linux desktop/servers, which is nothing more then normal.
how do we fix this for devices other then pc's/servers?
in this case i see no other way but to make it a law. if, for example, the EU can dictate the standard connector to use for phone-chargers, they should be able to do the same for something way more serious.
make it a law that all devices must get a lot of years of security updates (i don't even care about OS upgrades at this point), make it a long enough time, something like 6 to 8 years.
what will happen is that companies MUST design the software part better otherwise it will be too expensive to maintain all these security fixes for all these different devices with different implementations. to keep their costs down, they will have to have one build that can be installed and used on their whole range.
again, don't tell me it is impossible, we've been doing it with linux distro's for more than 20 years.
On a long enough timeline, the survival rate for everyone drops to zero.
> But let's get real: Even if your Android still receives security updates, there's no telling how long it will be (weeks or months) before manufacturers and carriers get it together to push out the patches.
Let's get even more real: I own 4 Android devices, and not a single one of them has ever got a single OS patch.
I'm not going to own a fifth. And I refuse to get my electronics from a fashion accessories maker. Who does that leave out?
And people are surprised I don't carry a smartphone.
Because custom ROMs serve the interests of the people selling the phones, allowing them to issue the phone with undeletable adware or bloatware that they're paid to ensure is on every phone (and which is also undeletable). The fact that they do not serve the interests of the people using the phones is of no concern to them.
So my Galaxy S5 is still safe? ...
Android is so shit. With all this spying. Touch interface (on the whole surface too) and with the lack of updates.
Where's the PC equivalent?
20 years of support rule yourself.
Dude, your comment is 4 years too late. Google released its Hardware abstraction layer with Android version 8, it's now on Version 9, and yes, current phones get security updates very quickly from reputable vendors.
This month, my non-google phone got the February patch update a few hours before the Pixel release was available.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Worse than murderers and pedophiles, poisoners and spies? I think you may need to reassess.
I am sure you read that somewhere, but wherever you read that, I would not trust them as a source anymore. What phone can get past the bootloader, have a custom ROM installed, and then can't use the radio?
"First they came for the slanderers and i said nothing."
MacOS model's not done: Stop IMPERSONATING me lying & proof portfilter err's can't happen in my work https://news.slashdot.org/comm...
U IMITATING me means ya WISH ya were me! Imitation IS the sincerest form of FLATTERY you know...
* HILARIOUS you ADMIT you have a registered 'luser' account & yet you STALK me by UNIDENTIFIABLE anonymous too https://hardware.slashdot.org/... - YOU have ISSUES, lunatic!
APK
P.S.=> Hopefully, this 'sinks in' to your DULL BRAIN @ last, finally (for the 200th time now)... apk
See subject & https://yro.slashdot.org/comme...
APK
P.S.=> Of course, I also KNOW it's you doing the initial impersonating me too (you can't beat me on tech or fact so you pull PUSSY bullshit like impersonating me OR stalking me by UNIDENTIFIABLE anonymous posts like the LOSER you are)... apk
The custom ROMs use the binary blob radio drivers from the official ROMs.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
The x86 - or rather, the IBM-compatible - world is vastly different to the ARM world when it comes to system design. The entire family tree of x86-derived machines have gravitated towards open, or at least easily-licensed and inter-operable, hardware standards over the decades. Manufacturers want to keep their hardware reasonably compatible with everyone else, lest they be shut out of the market for being too 'niche'.
ARM, on the other hand, is almost the exact opposite. An ARM computer is often a custom-built hodge-podge of licensed hardware modules fitted around whatever ARM core the manufacturer licensed and etched onto silicon. Sound, graphics, memory. and other functions are not plug-and-play replaceable add-ons, but a custom chipset that the system designer picked out and configured. These bespoke system configurations will also have to contend with limitations on driver support and possibly the need to hand-configure settings.
Google has tried to correct this, and pull manufacturers to a more standardized system that would let Google handle a lot of the hard work, but this was never the norm in the embedded space.
Yep. So much for a "hand computer" [rollseyes]
One of the Firefox for Android developers confirmed that they're using their own built-in libpng (with a link to its place in the source), so Firefox is likely unaffected. I didn't check separately on Firefox Focus, but I suspect it shares much of the code base.
I saw a reference to Chrome also having its own built-in PNG code (how could it not given its 51+MB download size?) but don't have the same details on it.
This mostly leaves email, messaging and social media as likely vectors for a malicious PNG.
fencepost
just a little off
That can still get you far, though.
Custom ROMs typically get all the drivers from the available update ROMs.
Aside the radio drivers, the camera drivers are often not open source.
That is not by coincidence the one aspect of smartphones that phone makers are still trying to differentiate in.
Project treble, on phones that got released with Oreo / Android 8 or later, should have all drivers sit on one partition, the Android OS should be on another, leading to a much easier update path.
Then, it's up to the manufacturer.
I know from experience that Nokia is doing well, one security update each month, 2 system version updates per device at least.
Support (chat) via built in app, also available when the phone is started with the pure system image, which I know from first hand experience.
Reason 2 for me to recommend Nokia.
Reason 3 is that they are newly set up to unlock boot loaders. Haven't tried yet.
Hope this helps,
aRTee
That's funny! My captcha image was %#*(@NO CARRIER
Sent from my Android
In order to pass certification for things like FCC the drivers need to be certified too. If they were open source then the user could just crank up the transmit power on their cellular modem or wifi to illegal levels
This is what RIL is for. Cell phones communicate with baseband processor using a standardized interface so the argument makes no sense on its face as the OS does not have the capability to command baseband to do something it isn't willing to.
The argument is further frustrated by the fact anyone can buy a USB stick with a GSM radio in it or a laptop with similar hardware to communicate over cellular networks. Yet the presence of such hardware does not preclude the successful installation of generic Linux distros nor detract from the ability to communicate with said radio.
This affects the x86 world too. Some laptops have a list of acceptable wifi cards baked into the BIOS. If you try to fit a non-certified one it won't work. Reason being that when you have 3 antennas they could potentially all be used to exceed acceptable transmission power limits if the user fits any random card, so the manufacturer has to limit to ones tested by the FCC etc. to never do that.
The FCC explicitly rejected this assertion. Systems need to be designed such that the radio interface cannot be commanded to exceed limits / bypass TDR detection..etc. They never said the entire operating system has to be locked down to achieve this.
Having said that, Google has largely fixed this now. Modern versions of Android can be patched by the Play Store services directly
No, Google play cannot update the operating system. They can only update shit that used to be part of Android but got moved into proprietary Google play malware stack as part of Google's never ending bid to own everything.
Dude, your comment is 4 years too late. Google released its Hardware abstraction layer with Android version 8, it's now on Version 9, and yes, current phones get security updates very quickly from reputable vendors.
This month, my non-google phone got the February patch update a few hours before the Pixel release was available.
In what year I will be able to install a generic Linux or Android distro on my cell phone?
Android also requires device maps to give you state-of-the-1980s base memory addresses for device MMIO.
There's no PCI(e) interface on your phone, or any other "safe" means of software discovering what hardware is in the device. Just like any 8-bit microcomputer you grew up with, hardware control is done by writing memory values to various hardcoded memory addresses. If the sound driver, for example, doesn't know the exact base address of the sound controller, it won't init the sound at all and may even accidentally crash the system if it ends up feeding the wrong commands into the wrong hardware subsystem.
Remember when Windows 95 and 98 would do auto-detect for non-PnP hardware and the ever-present warning that the process could hang the machine was present? Yep, exact same story here.