13 ms·

Quadrooter: New Vulnerabilities Affecting Over 900M Android Devices [pdf]

175 points by ge0rg 10y ago

lvs 10y ago
The FCC absolutely must clamp down on EOL policies and security updates for phones. It's a telecom infrastructure issue. Sure it places a burden on companies like Google and Verizon, but they're the ones who deserve to carry that burden -- not consumers. The secure lifetime of a device that is hundreds of dollars should not be only 2-3 years. That leaves a dramatic number of consumers fully exposed and eliminates the secondary market for used technology. Edit: Furthermore, if the companies are going to lock down devices and driver blobs so nobody else can fix them, all the more reason that the security of the device is their absolute responsibility.
- Someone1234 10y ago
  I agree entirely with you. That being said, the FCC is a little toothless, and every time they try and do something consumer friendly the courts kick them in the shins. More likely to see something positive come out of the EU than FCC, but in either case these companies will make changes to all markets because it is more efficient than just doing the EU. Android in particular could learn a lot from Linux's distribution model (package managers, et al). I've been tempted to move to iOS just because of how much better updates and device lifespan are.
  - lvs 10y ago
    At a smaller scale, California or perhaps Massachusetts could do this independently -- as they often do -- and it will have the effect of reverberating across the country.
  - deleted 10y ago
    [deleted]
- 01Michael10 10y ago
  Don't you mean Android phone OEMs and carriers? Google already updates their phones every month for three years which is long enough for a device most people replace or break within two years. Verizon isn't the only carrier of course.
  - mjevans 10y ago
    Security updates need to be for the lifetime of the /device/ through all parties. Think of it the same way you would an airbag or break recall for a car. Feature updates? Sure those can go away as the manufacturer feels like it (though they should be required to be upfront about this).
    - 01Michael10 10y ago
      Who supplies security updates for the "lifetime" of their product in your fantasy world? Three years is a good amount of time for security updates but could be extended to four years since people are keeping their phones longer these days. You are comparing software security updates to products recalled for safety issues? Well phones are already subject to recalls for hardware/battery problems. Let me know when a phone kills or hurts someone due to lack of security updates.
      - danudey 10y ago
        The iPhone 5, introduced in 2012, is getting iOS 10, which means security updates into 2015. That's a five-year span, which is much longer than the average person uses their iPhone 5. iOS 9 supports the iPhone 4S and the iPad 2, which again is a five-year span (2011 to 2016). I have devices that are that old; the iPad 3 I have just prompted me to update to the latest 9.3 update, and it's so slow running newer apps that I gave it to my toddler to play games on instead. So I agree, three years is good, four years is better, but Apple is already at five years and has been for a while now.
      - mjevans 10y ago
        With replacement of consumable parts (mostly batteries), I would not be surprised to see current phones in use for 10+ years. Just like desktop computers they will reach a point where, for most people, they're 'good enough', even if they're really slow. For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise. Cell phones are a literal lifeline device, to the point that emergency calls (at least in the US, and probably in any civilized part of the planet) //WILL// always work; without unlocking the phone, without the phone being on a payment plan, as long as the device has the power to transmit that distress need. It is not difficult to imagine how issues with the security portion of the layer could allow anything from a computer virus to DDoS local infrastructure (jamming), to targeting specific individuals (lock out their ability to call for help, bug and track movement), to picking out individuals that are alone and in vulnerable moments. Those are attacks I thought of just typing this comment and are not an exhaustive list. This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device: not just by it's first owner, but all the way through to it's last. Or failing that, they should be required to both release the sources and provide everything necessary in a legal sense for other entities in the community to perform the security updates they are unwilling to do. Carriers should also be liable for failing to (offer to) distribute said security updates to devices on their network (it is in the interest of everyone that they do this and do not charge for it).
- ultramancool 10y ago
  Be careful what you wish for, this type of legislation may unintentionally prevent consumer level device modifications like rooting and custom roms which allow security researchers the ability to find these issues and basically restrict this to an NSA level of funding. If I were qualcomm that'd be my first response in order to minimize effort on my part. Ideally Google would just produce a version that was more directly update-able.
  - lvs 10y ago
    First, a nitpick that the FCC makes regulation not legislation, and it could do this under existing authority. Second, I think a fine solution would be to force open the buildable source including all drivers and firmwares upon EOL. If top-down security updates will stop, then all components must be open source at that point.
    - mjevans 10y ago
      All information required to build, package, and install; as well as a license for anyone using or working on affected hardware to the copyright and patents involved for use with affected devices.
    - vanattab 10y ago
      Aside from one being voted on by an elected body and on and unelected body what exactly is the difference between regulation and legislation?
  - andrey_utkin 10y ago
    I think qualcomm or anybody would have hard time justifying how rooting prevention (which actually already has some place) helps here. I hope this trend also eventually brings us proper no-bullshit free and open-source firmware. As long as there are organizations to request some sanity from vendors.
  - sbhere 10y ago
    Disagree. How about a simple "devices selling in excess of 500 units must have security devices updates provided for four years from the first date of sale"? Legislation doesn't have to be onerous. Automobile manufacturers are required to produce parts for a certain number of years in support of their vehicles...
- pasbesoin 10y ago
  I bought a 2013 Moto X in early 2014. A significant factor in my decision was "owned by Google" and a "promise" of "timely updates". It was significantly less than two years before I was left on a vulnerable version of 5 with no further updates. Well before my two year "phone agreement" or whatever term ('it's not a "contract"') Verizon was then using, was up. Because of a special deal, I'm on a Nexus 5x right now. (That Verizon does not officially support -- whatever...) But it may well be my last Android phone. I've no confidence left in the Andriod ecosystem. I cringe more than a bit at Apple's "walled garden". But, at least they keep it up-to-date. And increasingly, I view the cell phone as a quasi-public medium. If I want true privacy for some aspect of communication, I simply have to take it out-of-band. For the time being, I may also trust the likes of Signal (Whisper Systems). But most other parties I communicate with have no clue and no desire to get one. Fortunately, three letter agencies and scammers don't seem to be too interested in my semi-disfunctional relationships. And I don't do banking, shopping, etc. on the thing nor use email accounts tied to same. P.S. Just found this comment: https://news.ycombinator.com/item?id=12249195 https://news.ycombinator.com/item?id=12249195 http://www.androidcentral.com/quadrooter-5-things-know-about-latest-android-security-scare http://www.androidcentral.com/quadrooter-5-things-know-about... on this thread: https://news.ycombinator.com/item?id=12248824 https://news.ycombinator.com/item?id=12248824 The cited article having a bit more perspective -- albeit one essentially wrapped in speculation as opposed to confirmed fact. And yeah, save your upvotes for the user who actually posted it.
  - kevin_thibedeau 10y ago
    The problem you have is with Verizon and their pathetically delayed updates. They do it to tease their impatient customers into new phones with fresh contracts. Just switch to Cyanogen and get your Nougaty goodness today without a middleman to screw you over. And stop buying subsidized carrier phones in the first place. They need to disappear into the annals of history like landline phones owned by AT&T.
    - pasbesoin 10y ago
      Why do you think I switched to a Nexus 5x? For some of my and my family's use when traveling, Verizon is the only non-local carrier to provide coverage. Anyway, as I said, I don't trust the Android "ecosystem". Even if and when one can, sometimes with considerable time and effort, find local maxima within it, it overall just sucks in this respect. By contrast, even on Verizon, Apple has the muscle to tell them to fuck off and to push updates directly. On Verizon, buy an iPhone and you stay as up-to-date as everyone else.
- curt15 10y ago
  If the OEMs are choosing to sign off on the OS and be the gatekeeper for core system updates, then they effectively own the security flaws and they should be held responsible for defects in their product. To me, this is a consumer protection issue.
- mattaltieri 10y ago
  I think either what you said needs to happen, or they need to unlock the devices before declaring them EOL so that the user is free to load something open source if they so choose... Or, they could be nice, and allow it from the beginning... Like that's ever going to happen.
- posterboy 10y ago
  Given that the unsuspecting consumer expects a working device, it would be in the suppliers best interest to keep updating to not be held liable for damages. It's debatable how reasonable that expectation is nowadays. Otherwise the consumer would be liable. I don't think this counts as an unavoidable accident unlike a hail storm might.
- wyager 10y ago
  Jesus, can we not encourage this? Getting the FCC to more tightly regulate phones will have two primary effects: 1. No more open source phones. We'll be even worse off than we are now. 2. Phone prices go up. Huge regulatory cost increases for little (or perhaps negative) gain. Just because you think devices should be supported for longer doesn't mean you should try to use the government as a bludgeon to screw over poor people, security-oriented people (who don't want locked-down phones in the long run), and tinkerers/open source advocates. A vastly better approach would be to require phones to be open source in the same way as gambling machines in the US. The code isn't entirely out in the open if the company doesn't want it to be, but anyone can audit it. In the case of phones, people could also fix bugs if they wanted to.
  - lvs 10y ago
    Elsewhere I've agreed with exactly this. The regulators will inevitably take action on this, and they should, but it's up to us to influence that outcome toward open devices. The device should either be pre-EOL with a process for security review or fully open or both. We want the company to take primary responsibility for the products they sell, obviously.
- mercora 10y ago
  While i like the idea and most of the others here i think a more practical approach would be to force a labeling requirement for the guaranteed time span a device will get timely security updates. This way it becomes part of the specs manufactures try to be competitive on and therefore creates an incentive to let that number go up. It would be clear from the start what is the lifespan i could expect of the device and makes me able to better understand price advantages which now are often hidden or not exposed.
  - mtgx 10y ago
    Maybe a mix of both would work best. Like right now in the EU they are considering making software updates mandatory for all devices for as long as the warranty exists (which is 2+ years for all electronics). Maybe do that, too, in the U.S., and then do something like "We guarantee warranty period +1/+2/+5 years of updates." Smartphones aren't even the devices with the longest lifecycle. Think about all of the "smart TVs" and "smart fridges" out there that people want to use for 10+ years, but they may never get a single update. Something definitely needs to do be about this regulatory wise, and it needs to happen soon before we're already surrounded by dozens of smart electronics everywhere we go, and not one of them had received a single updated after purchase.
- smrtinsert 10y ago
  This seems like a market thing more than regulation. If you believe Android is always drowning in malware, go iOS.
- NEDM64 10y ago
  Or you could buy a decent phone from a decent company.
tdkl 10y ago
So I can now finally root my unlockable device ? Cool !
mvdwoord 10y ago
"An attacker can exploit these vulnerabilities using a malicious app. These apps require no special permissions to take advantage of these vulnerabilities, alleviating any suspicion users may have when installing." So If I understand correctly, it does require you to side-load an app. Can I assume Google Play apps are "safe", at least from this type of vulnerabilities?
- mattbee 10y ago
  If I understand correctly, the exploit needs no special privileges to run the exploit code. Google Play doesn't vet apps before they go up, they take down apps in response to complaints. So no it's not safe, but I'd (maybe naively) expect them to notice a dangerous app pretty quickly.
  - warkdarrior 10y ago
    Google Play does vet apps before they go up. They have several mechanisms to analyze apps before they are published in the app store. Look up Google Bouncer. This said, it is not clear that their analysis would catch apps that try to exploit these vulnerabilities.
    - gregmac 10y ago
      > This said, it is not clear that their analysis would catch apps that try to exploit these vulnerabilities. I would hazard a guess that right now there a bunch of people at Google making sure that it does.
  - digi_owl 10y ago
    I could have sworn that all apps are run inside a test environment before allowed onto the store. But the process is automated and likely will not catch novel attacks.
    - ocdtrekkie 10y ago
      This is correct, they do now test apps before they go up. But yeah, plenty of malware is regularly found in the Play Store, so you can't just "trust Google" to protect you.
Miner49er 10y ago
Would rooting your phone, and then using an app like SuperSU protect you from this? When a malicious app attempted to get root, would it be able to bypass SuperSU or would the user have to give it permission though SuperSU?
- digi_owl 10y ago
  SuperSU will do nothing. This is no different from how someone would get root on say a web server.
- ultramancool 10y ago
  SuperSU is simply a tool which allows apps to gain root access with user permission via an API. Apps that use exploits like this can still gain root with no need for user permission. However, exploits like this can also be used for users to root their phone and install SuperSU or similar, allowing them to take advantage of the root-only apps on phones with locked down bootloaders and similar issues. This may also allow patching of devices which don't get official updates in similar fashion to "fixer" worms.
giis 10y ago
SELinux enabled devices also affected by this?
- Moral_ 10y ago
  In N and in some later versions of M SE Linux will stop this. They are exploiting a series of gpu bugs, and a IPC driver: https://android.googlesource.com/kernel/msm.git/+/e8408e6dca1067f8759a5baeadbc454a8a2293bc https://android.googlesource.com/kernel/msm.git/+/e8408e6dca... https://www.codeaurora.org/invalid-path-check-ashmem-memory-file-cve-2016-5340 https://www.codeaurora.org/invalid-path-check-ashmem-memory-... https://www.codeaurora.org/use-after-free-due-race-conditions-kgsl-module-cve-2016-2504-cve-2016-2503 https://www.codeaurora.org/use-after-free-due-race-condition... https://www.codeaurora.org/projects/security-advisories/linux-ipc-router-binding-any-port-control-port-cve-2016-2059 https://www.codeaurora.org/projects/security-advisories/linu... Which is now blocked by SELinux. The android security team has started killing off IOCTL calls which aren't necessary for normal apps. They are also nuking access to weird socket types. Including some Wifi related socket closures, which nukes a huge attack surface on the wlan side of things: http://kernsec.org/files/lss2015/vanderstoep.pdf http://kernsec.org/files/lss2015/vanderstoep.pdf https://security.googleblog.com/2016/07/protecting-android-with-more-linux.html https://security.googleblog.com/2016/07/protecting-android-w...
  - giis 10y ago
    thanks for the details & links. Good to know some version of SELinux prevents this.
drdaeman 10y ago
From the PDF it seems that this only applies to kernels that have a few Qualcomm patches applied.
- wmf 10y ago
  So only 65% of Android phones (100% on Verizon/Sprint?).
  - drdaeman 10y ago
    No idea about the exact percentages, but no doubt it's a large fraction of phones. I'm not debating it's insignificant or something - sure, it's giant. Just thought that pointing out it's Qualcomm-specific issue should make other chipset phone users feel somewhat at ease. (I have an Intel SoC-based one and got nervous upon seeing the title.)
wepple 10y ago
interesting that they highlighted how ecosystem fragmentation makes patching more difficult; they didn't highlight how fragmentation makes exploitation of their headline-grabbing "900m devices" also very tricky. This is one of the key reasons the world didn't end when the stagefright series of bugs was released. Cool bugs nonetheless..
- thecosas 10y ago
  As a layperson, I read the report that the exploit could apply broadly (since it's the baseband), but the patches were potentially difficult to roll out because of the layers of fragmentation in approving and pushing out the patches to the baseband firmware and the various mechanisms which might or might not be in pace to do so.
  - wepple 10y ago
    They all look like kernel code/driver bugs to me, meaning there will likely be memory layout and config variations much more significant that you'd see in baseband code which might be a lot more duplicated across devices.
    - thecosas 10y ago
      I think I get it more based on your explanation. Essentially, because the potential exploits rely on a larger variety of configurations, it's unlikely that any widespread exploits would take place; the work just wouldn't be worth it. More likely that they would focus on the largest subset, hence leading to security through variety.
Oletros 10y ago
If a device has Marshmallow it can't write the system partition, isn't? It can't be rooted because it will be detected at boot
- honkhonkpants 10y ago
  You mean it can't have a persistent rootkit installed. That is not the same thing.
gregmac 10y ago
> The vulnerabilities are found in Qualcomm’s software drivers that come with its chipsets. Pre-installed on devices at the point of manufacturing, these vulnerable drivers can only be fixed by installing a patch from the distributor or carrier. Distributors and carriers can only issue patches after receiving fixed driver packs from Qualcomm. > The research team provided Qualcomm with information about the vulnerabilities in April 2016. The team then followed the industry-standard disclosure policy (CERT/CC policy) of allowing 90 days for patches to be produced before disclosing these vulnerabilities to the public. > Qualcomm reviewed these vulnerabilities, classified each as high risk, and confirmed that it released patches to original equipment manufacturers (OEMs). The complexity of this is really a problem for security updates. It's bad enough for Android updates: the OEM packages it and adds their stuff, then the carrier packages it and adds their stuff. A firmware update like this is yet another layer.. While Checkpoint did the right disclosure thing here, I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today.
- ac29 10y ago
  >I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today. There were a handful of "Critical" Qualcomm specific bugs fixed in the July [0] and August [1] Android security updates. I can tell you that my Nexus 5X, which is on the July patch level, is still vulnerable to 2 of the bugs according the checkpoint security scanner. One is listed as being fixed in the August update, the other isn't. [0] https://source.android.com/security/bulletin/2016-07-01.html https://source.android.com/security/bulletin/2016-07-01.html [1] https://source.android.com/security/bulletin/2016-08-01.html https://source.android.com/security/bulletin/2016-08-01.html
  - icc97 10y ago
    I'm on a Nexus 5, can I take it there's basically nothing we can do until Google push out patches.
    - kuschku 10y ago
      Correct, because you don’t even have the required data to fix the device, and instead are fully dependent on someone else. A someone which has been proved to be unreliable again and again.
hannob 10y ago
This is in a certain sense a typical checkpoint finding. It's probably a good finding and it's good that they point out the problematic andorid ecosystem. But their announcement is then filled with some nonsense and marketing bullshit that's more likely to confuse users than help. In their blog post they say [1]: * "Use known, trusted Wi-Fi networks or while traveling use only those that you can verify are provided by a trustworthy source." What's that supposed to mean? Is a Wifi trustworthy if it's named Starbucks, because I just bought a coffee there? * "End users and enterprises should consider using mobile security solutions designed to detect suspicious behavior on a device, including malware that could be obfuscated within installed apps." I call bullshit. * And then further on [2]: "ZoneAlarm® Mobile Security for Android™ keeps your mobile devices fully protected from malicious apps and Wi-Fi attacks." Oh really? Can they explain how they overcame the theoretical limits (halting problem) that prevent something like this from being possible? A lot of it reminds me to the Misfortune Cookie vuln a while ago. Also a good find from Check Point in DSL routers, yet they claimed Zone Alarm can protect you, which was outright nonsense. [1] http://blog.checkpoint.com/2016/08/07/quadrooter/ http://blog.checkpoint.com/2016/08/07/quadrooter/ [2] https://www.checkpoint.com/resources/quadrooter-vulnerability-consumer/ https://www.checkpoint.com/resources/quadrooter-vulnerabilit...
skykooler 10y ago
I'm curious as to whether this affects the Jolla as well, as it uses Qualcomm's chipset and kernel drivers (but not Android)
milankragujevic 10y ago
This is just getting worse and worse. I'm not going to bash Android specifically, because iOS does get some exploits, but seriously we need to have a more locked down system that allows the user to only install the apps that are downloaded from a app store, that runs the apps in a container and doesn't allow special access to forbidden parts of the system. Of course if the user doesn't like it and wants freedom to use any apps, as well to be open to security risks that come with it, they MUST be allowed to do that, but don't make that the default option on billions of devices...
- 0x6c6f6c 10y ago
  > only install the apps that are donwloaded from a app store That's how it is by default. You have to enable the ability to install third-party applications
  - milankragujevic 10y ago
    Yet Google's track record of spam and malware in the Play store is horrific. They obviously care more about quantity of apps rather than quality, and therefor don't do something like Apple with a manual review process. Though apps should still be run in a sandbox...
    - kuschku 10y ago
      > Though apps should still be run in a sandbox... They are. All these exploits are sandbox breakouts, in this case, by exploiting the IPC system
    - lorenzhs 10y ago
      Google's automatic scanning is actually quite good. Most malware comes from random apk downloads and third-party app stores (often piracy-related). This has been pointed out many times throughout this thread (with links to back it up).
wyldfire 10y ago
I wonder if most apps have a reason to use the ioctl syscall normally. I think termios uses ioctl(), but what else? Do apps even need terminal control? Seems like ioctl() could be blacklisted with seccomp. Or maybe whitelist the permitted nodes with seccomp.
icc97 10y ago
Seems like a pretty good reason to switch to a nightly cyanogenmod build
- mdaniel 10y ago
  Perhaps I'm not following your intention, but for those with bootloader-locked devices, if we could have gotten enough control over our devices then we would have already jumped off of the antiquated builds. So it's a terrible catch-22: those with super old bootloader-locked devices are actually the most vulnerable to a whole host of these style attacks, but are the least able to do anything to the hardware that we paid good money to buy. Also, while this may just be my experience with cyanogenmod and the devices that I have managed to root, one can often end up not having access to the necessary blobs to make the phone run as well as it did under the bloated rom. That actually is very similar to Linux and the Win-modems and a ton of Win-printers that followed: sure, you can run a FLOSS setup, you'll just need to be very, very choosy about the hardware that goes into it.
niftich 10y ago
Some enterprising lawyer could look for people whose phones or accounts get hacked as a direct result of manufacturer-provided security patches not integrated in time by Android core, the device maker, or the carrier. Then start a class-action lawsuit, with the stated outcome of forcing carriers to allow, at no cost to all users of no-longer-security-patched phones still being paid off on their plan, a switch to newer phone that are still being patched. While it'd likely result in a settlement, this may be a way to get the ball rolling, and turning our multi-year outrage into actual (if underwhelming) results.
profeta 10y ago
> BlackBerry Priv YES! i bought this phone only to "vote with my wallet" that more companies should make android phones with keyboards. It is pure garbage in any other aspect. It is the lame phablet size. The keyboard doesn't even have a DOT or COMMA key, let alone numbers, tab, etc. The only redeeming features is the OLED screen and keyboard. But then they made the software for the keyboard pure garbage, and filled the OS with bloatware. I've been waiting for root on this phone so i can start to hack away for months. But blackberry with its cave man corporate mentality, thinks that giving out root will scare the 5 old men still buying their products. I can't even buy a developer version like motorola (which have the same mentality) allowed before. So, thank you for the sloppy coding, Qualcomm! Thank you for not doing your homework, Blackberry! and thank you AT&T for holding OS updates until you can bother to patch your bloatware!
- Karunamon 10y ago
  I have one of these phones, and this was my first thought too. "Woohoo! Root vulnerability! Now I can run what I want on my own device!" :(
  - mdaniel 10y ago
    As a former Samsung owner, that's actually the same feeling I get every time I heard of an Android vuln but definitely without the frowny face. I only get frowny face when the exploits don't work on my specific device. Or, rather, used to then I noped right out of that situation and got a Nexus device. In the same way I never intend to get "free phone with contract" ever again, I hope to never again buy a device that is subject to vendor "enhancements."
- jugbee 10y ago
  Do you really own the same priv as i do? Because i sit with a superb phone on august 5th patch. Dedicated Comma, dot, numbers keys? Buy a laptop. Or stay with priv, double-click alt and voila! Use all those buttons you named - write numbers and put comma in between without doing anything else. I regret accidently upvoting your unsubstantiated rant
arca_vorago 10y ago
All I ever wanted was pure linux on a phone, so I could do what I wanted to with it, including securing it. Instead what we got was a half open half proprietary peice of crap that even google bent over backwards to let the carriers fuck up with their custom ROMs on top of stock droid. What we need is an open source phone, metal to screen, so to speak. Oh wait, the cell radio firmwares are all proprietary too? I blame carriers and their bullshit first, google for not allowing more granular ACL's natively, and consumers for accepting android because they were so ready for anything different.
- arvinsim 10y ago
  > and consumers for accepting android because they were so ready for anything different. What would be the alternative for those who can't afford premium phones?
  - pjmlp 10y ago
    For a while it was Symbian, Maemo and WP but thanks to how Nokia and Microsoft managed it , those options are now gone.
qwertyuiop924 10y ago
Can you root your phone using the exoloit yet? It's only a matter of time.

175 points by ge0rg 10y ago

lvs 10y ago

The FCC absolutely must clamp down on EOL policies and security updates for phones. It's a telecom infrastructure issue. Sure it places a burden on companies like Google and Verizon, but they're the ones who deserve to carry that burden -- not consumers. The secure lifetime of a device that is hundreds of dollars should not be only 2-3 years. That leaves a dramatic number of consumers fully exposed and eliminates the secondary market for used technology. Edit: Furthermore, if the companies are going to lock down devices and driver blobs so nobody else can fix them, all the more reason that the security of the device is their absolute responsibility.

Someone1234 10y ago
I agree entirely with you. That being said, the FCC is a little toothless, and every time they try and do something consumer friendly the courts kick them in the shins. More likely to see something positive come out of the EU than FCC, but in either case these companies will make changes to all markets because it is more efficient than just doing the EU. Android in particular could learn a lot from Linux's distribution model (package managers, et al). I've been tempted to move to iOS just because of how much better updates and device lifespan are.
- lvs 10y ago
  At a smaller scale, California or perhaps Massachusetts could do this independently -- as they often do -- and it will have the effect of reverberating across the country.
- deleted 10y ago
  [deleted]
01Michael10 10y ago
Don't you mean Android phone OEMs and carriers? Google already updates their phones every month for three years which is long enough for a device most people replace or break within two years. Verizon isn't the only carrier of course.
- mjevans 10y ago
  Security updates need to be for the lifetime of the /device/ through all parties. Think of it the same way you would an airbag or break recall for a car. Feature updates? Sure those can go away as the manufacturer feels like it (though they should be required to be upfront about this).
  - 01Michael10 10y ago
    Who supplies security updates for the "lifetime" of their product in your fantasy world? Three years is a good amount of time for security updates but could be extended to four years since people are keeping their phones longer these days. You are comparing software security updates to products recalled for safety issues? Well phones are already subject to recalls for hardware/battery problems. Let me know when a phone kills or hurts someone due to lack of security updates.
    - danudey 10y ago
      The iPhone 5, introduced in 2012, is getting iOS 10, which means security updates into 2015. That's a five-year span, which is much longer than the average person uses their iPhone 5. iOS 9 supports the iPhone 4S and the iPad 2, which again is a five-year span (2011 to 2016). I have devices that are that old; the iPad 3 I have just prompted me to update to the latest 9.3 update, and it's so slow running newer apps that I gave it to my toddler to play games on instead. So I agree, three years is good, four years is better, but Apple is already at five years and has been for a while now.
    - mjevans 10y ago
      With replacement of consumable parts (mostly batteries), I would not be surprised to see current phones in use for 10+ years. Just like desktop computers they will reach a point where, for most people, they're 'good enough', even if they're really slow. For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise. Cell phones are a literal lifeline device, to the point that emergency calls (at least in the US, and probably in any civilized part of the planet) //WILL// always work; without unlocking the phone, without the phone being on a payment plan, as long as the device has the power to transmit that distress need. It is not difficult to imagine how issues with the security portion of the layer could allow anything from a computer virus to DDoS local infrastructure (jamming), to targeting specific individuals (lock out their ability to call for help, bug and track movement), to picking out individuals that are alone and in vulnerable moments. Those are attacks I thought of just typing this comment and are not an exhaustive list. This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device: not just by it's first owner, but all the way through to it's last. Or failing that, they should be required to both release the sources and provide everything necessary in a legal sense for other entities in the community to perform the security updates they are unwilling to do. Carriers should also be liable for failing to (offer to) distribute said security updates to devices on their network (it is in the interest of everyone that they do this and do not charge for it).
ultramancool 10y ago
Be careful what you wish for, this type of legislation may unintentionally prevent consumer level device modifications like rooting and custom roms which allow security researchers the ability to find these issues and basically restrict this to an NSA level of funding. If I were qualcomm that'd be my first response in order to minimize effort on my part. Ideally Google would just produce a version that was more directly update-able.
- lvs 10y ago
  First, a nitpick that the FCC makes regulation not legislation, and it could do this under existing authority. Second, I think a fine solution would be to force open the buildable source including all drivers and firmwares upon EOL. If top-down security updates will stop, then all components must be open source at that point.
  - mjevans 10y ago
    All information required to build, package, and install; as well as a license for anyone using or working on affected hardware to the copyright and patents involved for use with affected devices.
  - vanattab 10y ago
    Aside from one being voted on by an elected body and on and unelected body what exactly is the difference between regulation and legislation?
- andrey_utkin 10y ago
  I think qualcomm or anybody would have hard time justifying how rooting prevention (which actually already has some place) helps here. I hope this trend also eventually brings us proper no-bullshit free and open-source firmware. As long as there are organizations to request some sanity from vendors.
- sbhere 10y ago
  Disagree. How about a simple "devices selling in excess of 500 units must have security devices updates provided for four years from the first date of sale"? Legislation doesn't have to be onerous. Automobile manufacturers are required to produce parts for a certain number of years in support of their vehicles...
pasbesoin 10y ago
I bought a 2013 Moto X in early 2014. A significant factor in my decision was "owned by Google" and a "promise" of "timely updates". It was significantly less than two years before I was left on a vulnerable version of 5 with no further updates. Well before my two year "phone agreement" or whatever term ('it's not a "contract"') Verizon was then using, was up. Because of a special deal, I'm on a Nexus 5x right now. (That Verizon does not officially support -- whatever...) But it may well be my last Android phone. I've no confidence left in the Andriod ecosystem. I cringe more than a bit at Apple's "walled garden". But, at least they keep it up-to-date. And increasingly, I view the cell phone as a quasi-public medium. If I want true privacy for some aspect of communication, I simply have to take it out-of-band. For the time being, I may also trust the likes of Signal (Whisper Systems). But most other parties I communicate with have no clue and no desire to get one. Fortunately, three letter agencies and scammers don't seem to be too interested in my semi-disfunctional relationships. And I don't do banking, shopping, etc. on the thing nor use email accounts tied to same. P.S. Just found this comment: https://news.ycombinator.com/item?id=12249195 https://news.ycombinator.com/item?id=12249195 http://www.androidcentral.com/quadrooter-5-things-know-about-latest-android-security-scare http://www.androidcentral.com/quadrooter-5-things-know-about... on this thread: https://news.ycombinator.com/item?id=12248824 https://news.ycombinator.com/item?id=12248824 The cited article having a bit more perspective -- albeit one essentially wrapped in speculation as opposed to confirmed fact. And yeah, save your upvotes for the user who actually posted it.
- kevin_thibedeau 10y ago
  The problem you have is with Verizon and their pathetically delayed updates. They do it to tease their impatient customers into new phones with fresh contracts. Just switch to Cyanogen and get your Nougaty goodness today without a middleman to screw you over. And stop buying subsidized carrier phones in the first place. They need to disappear into the annals of history like landline phones owned by AT&T.
  - pasbesoin 10y ago
    Why do you think I switched to a Nexus 5x? For some of my and my family's use when traveling, Verizon is the only non-local carrier to provide coverage. Anyway, as I said, I don't trust the Android "ecosystem". Even if and when one can, sometimes with considerable time and effort, find local maxima within it, it overall just sucks in this respect. By contrast, even on Verizon, Apple has the muscle to tell them to fuck off and to push updates directly. On Verizon, buy an iPhone and you stay as up-to-date as everyone else.
curt15 10y ago
If the OEMs are choosing to sign off on the OS and be the gatekeeper for core system updates, then they effectively own the security flaws and they should be held responsible for defects in their product. To me, this is a consumer protection issue.
mattaltieri 10y ago
I think either what you said needs to happen, or they need to unlock the devices before declaring them EOL so that the user is free to load something open source if they so choose... Or, they could be nice, and allow it from the beginning... Like that's ever going to happen.
posterboy 10y ago
Given that the unsuspecting consumer expects a working device, it would be in the suppliers best interest to keep updating to not be held liable for damages. It's debatable how reasonable that expectation is nowadays. Otherwise the consumer would be liable. I don't think this counts as an unavoidable accident unlike a hail storm might.
wyager 10y ago
Jesus, can we not encourage this? Getting the FCC to more tightly regulate phones will have two primary effects: 1. No more open source phones. We'll be even worse off than we are now. 2. Phone prices go up. Huge regulatory cost increases for little (or perhaps negative) gain. Just because you think devices should be supported for longer doesn't mean you should try to use the government as a bludgeon to screw over poor people, security-oriented people (who don't want locked-down phones in the long run), and tinkerers/open source advocates. A vastly better approach would be to require phones to be open source in the same way as gambling machines in the US. The code isn't entirely out in the open if the company doesn't want it to be, but anyone can audit it. In the case of phones, people could also fix bugs if they wanted to.
- lvs 10y ago
  Elsewhere I've agreed with exactly this. The regulators will inevitably take action on this, and they should, but it's up to us to influence that outcome toward open devices. The device should either be pre-EOL with a process for security review or fully open or both. We want the company to take primary responsibility for the products they sell, obviously.
mercora 10y ago
While i like the idea and most of the others here i think a more practical approach would be to force a labeling requirement for the guaranteed time span a device will get timely security updates. This way it becomes part of the specs manufactures try to be competitive on and therefore creates an incentive to let that number go up. It would be clear from the start what is the lifespan i could expect of the device and makes me able to better understand price advantages which now are often hidden or not exposed.
- mtgx 10y ago
  Maybe a mix of both would work best. Like right now in the EU they are considering making software updates mandatory for all devices for as long as the warranty exists (which is 2+ years for all electronics). Maybe do that, too, in the U.S., and then do something like "We guarantee warranty period +1/+2/+5 years of updates." Smartphones aren't even the devices with the longest lifecycle. Think about all of the "smart TVs" and "smart fridges" out there that people want to use for 10+ years, but they may never get a single update. Something definitely needs to do be about this regulatory wise, and it needs to happen soon before we're already surrounded by dozens of smart electronics everywhere we go, and not one of them had received a single updated after purchase.
smrtinsert 10y ago
This seems like a market thing more than regulation. If you believe Android is always drowning in malware, go iOS.
NEDM64 10y ago
Or you could buy a decent phone from a decent company.

tdkl 10y ago

So I can now finally root my unlockable device ? Cool !

mvdwoord 10y ago

"An attacker can exploit these vulnerabilities using a malicious app. These apps require no special permissions to take advantage of these vulnerabilities, alleviating any suspicion users may have when installing." So If I understand correctly, it does require you to side-load an app. Can I assume Google Play apps are "safe", at least from this type of vulnerabilities?

mattbee 10y ago
If I understand correctly, the exploit needs no special privileges to run the exploit code. Google Play doesn't vet apps before they go up, they take down apps in response to complaints. So no it's not safe, but I'd (maybe naively) expect them to notice a dangerous app pretty quickly.
- warkdarrior 10y ago
  Google Play does vet apps before they go up. They have several mechanisms to analyze apps before they are published in the app store. Look up Google Bouncer. This said, it is not clear that their analysis would catch apps that try to exploit these vulnerabilities.
  - gregmac 10y ago
    > This said, it is not clear that their analysis would catch apps that try to exploit these vulnerabilities. I would hazard a guess that right now there a bunch of people at Google making sure that it does.
- digi_owl 10y ago
  I could have sworn that all apps are run inside a test environment before allowed onto the store. But the process is automated and likely will not catch novel attacks.
  - ocdtrekkie 10y ago
    This is correct, they do now test apps before they go up. But yeah, plenty of malware is regularly found in the Play Store, so you can't just "trust Google" to protect you.

Miner49er 10y ago

Would rooting your phone, and then using an app like SuperSU protect you from this? When a malicious app attempted to get root, would it be able to bypass SuperSU or would the user have to give it permission though SuperSU?

digi_owl 10y ago
SuperSU will do nothing. This is no different from how someone would get root on say a web server.
ultramancool 10y ago
SuperSU is simply a tool which allows apps to gain root access with user permission via an API. Apps that use exploits like this can still gain root with no need for user permission. However, exploits like this can also be used for users to root their phone and install SuperSU or similar, allowing them to take advantage of the root-only apps on phones with locked down bootloaders and similar issues. This may also allow patching of devices which don't get official updates in similar fashion to "fixer" worms.

giis 10y ago

SELinux enabled devices also affected by this?

Moral_ 10y ago
In N and in some later versions of M SE Linux will stop this. They are exploiting a series of gpu bugs, and a IPC driver: https://android.googlesource.com/kernel/msm.git/+/e8408e6dca1067f8759a5baeadbc454a8a2293bc https://android.googlesource.com/kernel/msm.git/+/e8408e6dca... https://www.codeaurora.org/invalid-path-check-ashmem-memory-file-cve-2016-5340 https://www.codeaurora.org/invalid-path-check-ashmem-memory-... https://www.codeaurora.org/use-after-free-due-race-conditions-kgsl-module-cve-2016-2504-cve-2016-2503 https://www.codeaurora.org/use-after-free-due-race-condition... https://www.codeaurora.org/projects/security-advisories/linux-ipc-router-binding-any-port-control-port-cve-2016-2059 https://www.codeaurora.org/projects/security-advisories/linu... Which is now blocked by SELinux. The android security team has started killing off IOCTL calls which aren't necessary for normal apps. They are also nuking access to weird socket types. Including some Wifi related socket closures, which nukes a huge attack surface on the wlan side of things: http://kernsec.org/files/lss2015/vanderstoep.pdf http://kernsec.org/files/lss2015/vanderstoep.pdf https://security.googleblog.com/2016/07/protecting-android-with-more-linux.html https://security.googleblog.com/2016/07/protecting-android-w...
- giis 10y ago
  thanks for the details & links. Good to know some version of SELinux prevents this.

drdaeman 10y ago

From the PDF it seems that this only applies to kernels that have a few Qualcomm patches applied.

wmf 10y ago
So only 65% of Android phones (100% on Verizon/Sprint?).
- drdaeman 10y ago
  No idea about the exact percentages, but no doubt it's a large fraction of phones. I'm not debating it's insignificant or something - sure, it's giant. Just thought that pointing out it's Qualcomm-specific issue should make other chipset phone users feel somewhat at ease. (I have an Intel SoC-based one and got nervous upon seeing the title.)

wepple 10y ago

interesting that they highlighted how ecosystem fragmentation makes patching more difficult; they didn't highlight how fragmentation makes exploitation of their headline-grabbing "900m devices" also very tricky. This is one of the key reasons the world didn't end when the stagefright series of bugs was released. Cool bugs nonetheless..

thecosas 10y ago
As a layperson, I read the report that the exploit could apply broadly (since it's the baseband), but the patches were potentially difficult to roll out because of the layers of fragmentation in approving and pushing out the patches to the baseband firmware and the various mechanisms which might or might not be in pace to do so.
- wepple 10y ago
  They all look like kernel code/driver bugs to me, meaning there will likely be memory layout and config variations much more significant that you'd see in baseband code which might be a lot more duplicated across devices.
  - thecosas 10y ago
    I think I get it more based on your explanation. Essentially, because the potential exploits rely on a larger variety of configurations, it's unlikely that any widespread exploits would take place; the work just wouldn't be worth it. More likely that they would focus on the largest subset, hence leading to security through variety.

Oletros 10y ago

If a device has Marshmallow it can't write the system partition, isn't? It can't be rooted because it will be detected at boot

honkhonkpants 10y ago
You mean it can't have a persistent rootkit installed. That is not the same thing.

gregmac 10y ago

> The vulnerabilities are found in Qualcomm’s software drivers that come with its chipsets. Pre-installed on devices at the point of manufacturing, these vulnerable drivers can only be fixed by installing a patch from the distributor or carrier. Distributors and carriers can only issue patches after receiving fixed driver packs from Qualcomm. > The research team provided Qualcomm with information about the vulnerabilities in April 2016. The team then followed the industry-standard disclosure policy (CERT/CC policy) of allowing 90 days for patches to be produced before disclosing these vulnerabilities to the public. > Qualcomm reviewed these vulnerabilities, classified each as high risk, and confirmed that it released patches to original equipment manufacturers (OEMs). The complexity of this is really a problem for security updates. It's bad enough for Android updates: the OEM packages it and adds their stuff, then the carrier packages it and adds their stuff. A firmware update like this is yet another layer.. While Checkpoint did the right disclosure thing here, I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today.

ac29 10y ago
>I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today. There were a handful of "Critical" Qualcomm specific bugs fixed in the July [0] and August [1] Android security updates. I can tell you that my Nexus 5X, which is on the July patch level, is still vulnerable to 2 of the bugs according the checkpoint security scanner. One is listed as being fixed in the August update, the other isn't. [0] https://source.android.com/security/bulletin/2016-07-01.html https://source.android.com/security/bulletin/2016-07-01.html [1] https://source.android.com/security/bulletin/2016-08-01.html https://source.android.com/security/bulletin/2016-08-01.html
- icc97 10y ago
  I'm on a Nexus 5, can I take it there's basically nothing we can do until Google push out patches.
  - kuschku 10y ago
    Correct, because you don’t even have the required data to fix the device, and instead are fully dependent on someone else. A someone which has been proved to be unreliable again and again.

hannob 10y ago

This is in a certain sense a typical checkpoint finding. It's probably a good finding and it's good that they point out the problematic andorid ecosystem. But their announcement is then filled with some nonsense and marketing bullshit that's more likely to confuse users than help. In their blog post they say [1]: * "Use known, trusted Wi-Fi networks or while traveling use only those that you can verify are provided by a trustworthy source." What's that supposed to mean? Is a Wifi trustworthy if it's named Starbucks, because I just bought a coffee there? * "End users and enterprises should consider using mobile security solutions designed to detect suspicious behavior on a device, including malware that could be obfuscated within installed apps." I call bullshit. * And then further on [2]: "ZoneAlarm® Mobile Security for Android™ keeps your mobile devices fully protected from malicious apps and Wi-Fi attacks." Oh really? Can they explain how they overcame the theoretical limits (halting problem) that prevent something like this from being possible? A lot of it reminds me to the Misfortune Cookie vuln a while ago. Also a good find from Check Point in DSL routers, yet they claimed Zone Alarm can protect you, which was outright nonsense. [1] http://blog.checkpoint.com/2016/08/07/quadrooter/ http://blog.checkpoint.com/2016/08/07/quadrooter/ [2] https://www.checkpoint.com/resources/quadrooter-vulnerability-consumer/ https://www.checkpoint.com/resources/quadrooter-vulnerabilit...

skykooler 10y ago

I'm curious as to whether this affects the Jolla as well, as it uses Qualcomm's chipset and kernel drivers (but not Android)

milankragujevic 10y ago

This is just getting worse and worse. I'm not going to bash Android specifically, because iOS does get some exploits, but seriously we need to have a more locked down system that allows the user to only install the apps that are downloaded from a app store, that runs the apps in a container and doesn't allow special access to forbidden parts of the system. Of course if the user doesn't like it and wants freedom to use any apps, as well to be open to security risks that come with it, they MUST be allowed to do that, but don't make that the default option on billions of devices...

0x6c6f6c 10y ago
> only install the apps that are donwloaded from a app store That's how it is by default. You have to enable the ability to install third-party applications
- milankragujevic 10y ago
  Yet Google's track record of spam and malware in the Play store is horrific. They obviously care more about quantity of apps rather than quality, and therefor don't do something like Apple with a manual review process. Though apps should still be run in a sandbox...
  - kuschku 10y ago
    > Though apps should still be run in a sandbox... They are. All these exploits are sandbox breakouts, in this case, by exploiting the IPC system
  - lorenzhs 10y ago
    Google's automatic scanning is actually quite good. Most malware comes from random apk downloads and third-party app stores (often piracy-related). This has been pointed out many times throughout this thread (with links to back it up).

wyldfire 10y ago

I wonder if most apps have a reason to use the ioctl syscall normally. I think termios uses ioctl(), but what else? Do apps even need terminal control? Seems like ioctl() could be blacklisted with seccomp. Or maybe whitelist the permitted nodes with seccomp.

icc97 10y ago

Seems like a pretty good reason to switch to a nightly cyanogenmod build

mdaniel 10y ago
Perhaps I'm not following your intention, but for those with bootloader-locked devices, if we could have gotten enough control over our devices then we would have already jumped off of the antiquated builds. So it's a terrible catch-22: those with super old bootloader-locked devices are actually the most vulnerable to a whole host of these style attacks, but are the least able to do anything to the hardware that we paid good money to buy. Also, while this may just be my experience with cyanogenmod and the devices that I have managed to root, one can often end up not having access to the necessary blobs to make the phone run as well as it did under the bloated rom. That actually is very similar to Linux and the Win-modems and a ton of Win-printers that followed: sure, you can run a FLOSS setup, you'll just need to be very, very choosy about the hardware that goes into it.

niftich 10y ago

Some enterprising lawyer could look for people whose phones or accounts get hacked as a direct result of manufacturer-provided security patches not integrated in time by Android core, the device maker, or the carrier. Then start a class-action lawsuit, with the stated outcome of forcing carriers to allow, at no cost to all users of no-longer-security-patched phones still being paid off on their plan, a switch to newer phone that are still being patched. While it'd likely result in a settlement, this may be a way to get the ball rolling, and turning our multi-year outrage into actual (if underwhelming) results.

profeta 10y ago

> BlackBerry Priv YES! i bought this phone only to "vote with my wallet" that more companies should make android phones with keyboards. It is pure garbage in any other aspect. It is the lame phablet size. The keyboard doesn't even have a DOT or COMMA key, let alone numbers, tab, etc. The only redeeming features is the OLED screen and keyboard. But then they made the software for the keyboard pure garbage, and filled the OS with bloatware. I've been waiting for root on this phone so i can start to hack away for months. But blackberry with its cave man corporate mentality, thinks that giving out root will scare the 5 old men still buying their products. I can't even buy a developer version like motorola (which have the same mentality) allowed before. So, thank you for the sloppy coding, Qualcomm! Thank you for not doing your homework, Blackberry! and thank you AT&T for holding OS updates until you can bother to patch your bloatware!

Karunamon 10y ago
I have one of these phones, and this was my first thought too. "Woohoo! Root vulnerability! Now I can run what I want on my own device!" :(
- mdaniel 10y ago
  As a former Samsung owner, that's actually the same feeling I get every time I heard of an Android vuln but definitely without the frowny face. I only get frowny face when the exploits don't work on my specific device. Or, rather, used to then I noped right out of that situation and got a Nexus device. In the same way I never intend to get "free phone with contract" ever again, I hope to never again buy a device that is subject to vendor "enhancements."
jugbee 10y ago
Do you really own the same priv as i do? Because i sit with a superb phone on august 5th patch. Dedicated Comma, dot, numbers keys? Buy a laptop. Or stay with priv, double-click alt and voila! Use all those buttons you named - write numbers and put comma in between without doing anything else. I regret accidently upvoting your unsubstantiated rant

arca_vorago 10y ago

All I ever wanted was pure linux on a phone, so I could do what I wanted to with it, including securing it. Instead what we got was a half open half proprietary peice of crap that even google bent over backwards to let the carriers fuck up with their custom ROMs on top of stock droid. What we need is an open source phone, metal to screen, so to speak. Oh wait, the cell radio firmwares are all proprietary too? I blame carriers and their bullshit first, google for not allowing more granular ACL's natively, and consumers for accepting android because they were so ready for anything different.

arvinsim 10y ago
> and consumers for accepting android because they were so ready for anything different. What would be the alternative for those who can't afford premium phones?
- pjmlp 10y ago
  For a while it was Symbian, Maemo and WP but thanks to how Nokia and Microsoft managed it , those options are now gone.

qwertyuiop924 10y ago

Can you root your phone using the exoloit yet? It's only a matter of time.