4 ms·

Seems useless and pointlessly breathless to me to even talk about something being "unhackable". What's important is hackable by who, and in what way. If you tu

by ufmace 10y ago

Seems useless and pointlessly breathless to me to even talk about something being "unhackable". What's important is hackable by who, and in what way. If you turn off Android's setting to only allow app installs from the play store, then install a sketchy third-party store and download a flashlight app with a huge permission list that scrapes your email address book and sends it off to Russia, is that really a hack? It's pretty tough to prevent that without locking the phone down even harder than the iPhone. Doesn't seem worth worrying much about to me. Android seems to be pretty safe against more dangerous stuff like visiting a website or displaying a web ad installs an app, bypassing user approval. Or worse, doing something with root permissions. At least I haven't heard of anything like that. If it's out there, presumably whoever has found such exploits keeps them under wraps for high-value targets. The Stagefright one sounded pretty dangerous, but I haven't heard of any large-scale attacks with it in the wild. Presumably carrier-level general protections against mass MMSing and specifically against payloads for that bug were effective. Given the difficulties the Android rooting community seems to be having, it's hard to believe that a drive-by exploit could gain persistent root.

tarancato 10y ago
Problem with Android is the amount of devices that will never get updates. How many devices are there in the wild that have yet to be patched against stagefright? I bet it's over 50%
ufmace 10y ago
Just spent a little while googling around for Android security info, and I'm feeling pretty safe. I haven't been able to find any reports of anybody actually doing anything interesting off of the Stagefright exploit. Sounds like Android is pretty good at defense in depth. Though Stagefright is bad, it sounds like getting from whatever it does to anything interesting to any potential attackers is not easy, and if anybody knows how to do it, they aren't talking about it or using it widely. One of the more interesting exploit dissections I read was of a 2013 Pwn2Own exploit of Chrome on Android[0] good enough to earn the designer $50k. Long story short, a series of vulnerabilities are exploited through Javascript of a visited webpage eventually resulting in sending that Chrome's cookies to a remote server. Impressive effort, and certainly not good, but then again, how many people have any important cookies in their mobile Chrome? And how many websites will actually allow you to do something that is interesting to an attacker after you hijack somebody's cookies? Of course those bugs are long since fixed on all Androids, since it's in Chrome. Even if they were active, I still wouldn't worry much, because you can't get much interesting info unless you can get system/root permission and read the data of all of the other apps on the device. Actually, if I was designing that as an actual attack, I think I'd send off the autofill info too. That ought to be possible for an exploit that can read the cookie jar, and it sounds much more likely to contain credit card info, home addresses, and other stuff an attacker might be able to monetize. [0] https://docs.google.com/document/d/1tHElG04AJR5OR2Ex-m_Jsmc8S5fAbRB3s4RmTG_PFnw/edit https://docs.google.com/document/d/1tHElG04AJR5OR2Ex-m_Jsmc8...
- pjmlp 10y ago
  Maybe you should go through the actual set of issues. "Presentation on Threats and Vulnerabilities in Android OS" https://www.youtube.com/watch?v=CZAejnPrqJc https://www.youtube.com/watch?v=CZAejnPrqJc "Android: Protecting the Kernel by Jeffrey Vander Stoep, Google" https://www.youtube.com/watch?v=WxbOq8IGEiE https://www.youtube.com/watch?v=WxbOq8IGEiE
micro_softy 10y ago
"What's important is hackable by who, and in what way." I strongly agree with this statement but my explanantion of it may be somewhat different. Hackable means controllable. Hack = control. A computer, including a small form factor one called a "mobile phone", should be hackable by its user. Freedom to tinker. A user can then, if so desired, set up and use the computer in such a way as to be less hackable by others. There is nothing more discouraging for an attacker than a highly idiosyncratic, non-standard system. A user cannot protect a computer over which she does not have meaningful control. This is common sense. Mobile phones are just computers... with a lot of unneeded complexity. And third parties such as telecoms and search engine companies have greater control over them than users. Trying to protect a user's computer by delegating control to a third party or combination of third parties, while denying control to the user, is an exercise in futility. A computer that is sealed shut, with a locked bootloader and which can only use a narrow choice of OS, etc. is not hackable by its user. It can be secured against users perhaps, but it cannot be secured in any meaningful way against third parties that truly benefits the user. This is because the user does not have the most control over the computer. It does not matter how much effort the user wants to make including how much money they are willing to spend in order to protect the computer because the user is not allowed to have as much control as various third parties. A $5-$25 credit card-sized development board is easier to protect than a mobile phone. Because it is "hackable" by it user.
fnkym0nky 10y ago
Android is notoriously broken among the AppSec community. For proof all you have to do is look at the last 90 days of Android bug reports[1]. The reason why your not hearing of exploits is because of the price war that currently exists for them. Zerodium recently raised the price for a Android RCE to $200,000, with iPhone RCEs at 1.5 million[2]. [1] https://source.android.com/security/bulletin/2016-10-01.html https://source.android.com/security/bulletin/2016-10-01.html [2] https://www.zerodium.com/program.html https://www.zerodium.com/program.html
- pjmlp 10y ago
  After watching the presentations about the state of the union in regards to kernel security in Android, I came to realize that I was wrong in bashing Google for their constrained NDK. Actually, they should constrain it even more, given the poor state of kernel exploits and how the whole security updates doesn't happen across Android devices.

by ufmace 10y ago

tarancato 10y ago

Problem with Android is the amount of devices that will never get updates. How many devices are there in the wild that have yet to be patched against stagefright? I bet it's over 50%

ufmace 10y ago

Just spent a little while googling around for Android security info, and I'm feeling pretty safe. I haven't been able to find any reports of anybody actually doing anything interesting off of the Stagefright exploit. Sounds like Android is pretty good at defense in depth. Though Stagefright is bad, it sounds like getting from whatever it does to anything interesting to any potential attackers is not easy, and if anybody knows how to do it, they aren't talking about it or using it widely. One of the more interesting exploit dissections I read was of a 2013 Pwn2Own exploit of Chrome on Android[0] good enough to earn the designer $50k. Long story short, a series of vulnerabilities are exploited through Javascript of a visited webpage eventually resulting in sending that Chrome's cookies to a remote server. Impressive effort, and certainly not good, but then again, how many people have any important cookies in their mobile Chrome? And how many websites will actually allow you to do something that is interesting to an attacker after you hijack somebody's cookies? Of course those bugs are long since fixed on all Androids, since it's in Chrome. Even if they were active, I still wouldn't worry much, because you can't get much interesting info unless you can get system/root permission and read the data of all of the other apps on the device. Actually, if I was designing that as an actual attack, I think I'd send off the autofill info too. That ought to be possible for an exploit that can read the cookie jar, and it sounds much more likely to contain credit card info, home addresses, and other stuff an attacker might be able to monetize. [0] https://docs.google.com/document/d/1tHElG04AJR5OR2Ex-m_Jsmc8S5fAbRB3s4RmTG_PFnw/edit https://docs.google.com/document/d/1tHElG04AJR5OR2Ex-m_Jsmc8...

pjmlp 10y ago
Maybe you should go through the actual set of issues. "Presentation on Threats and Vulnerabilities in Android OS" https://www.youtube.com/watch?v=CZAejnPrqJc https://www.youtube.com/watch?v=CZAejnPrqJc "Android: Protecting the Kernel by Jeffrey Vander Stoep, Google" https://www.youtube.com/watch?v=WxbOq8IGEiE https://www.youtube.com/watch?v=WxbOq8IGEiE

micro_softy 10y ago

"What's important is hackable by who, and in what way." I strongly agree with this statement but my explanantion of it may be somewhat different. Hackable means controllable. Hack = control. A computer, including a small form factor one called a "mobile phone", should be hackable by its user. Freedom to tinker. A user can then, if so desired, set up and use the computer in such a way as to be less hackable by others. There is nothing more discouraging for an attacker than a highly idiosyncratic, non-standard system. A user cannot protect a computer over which she does not have meaningful control. This is common sense. Mobile phones are just computers... with a lot of unneeded complexity. And third parties such as telecoms and search engine companies have greater control over them than users. Trying to protect a user's computer by delegating control to a third party or combination of third parties, while denying control to the user, is an exercise in futility. A computer that is sealed shut, with a locked bootloader and which can only use a narrow choice of OS, etc. is not hackable by its user. It can be secured against users perhaps, but it cannot be secured in any meaningful way against third parties that truly benefits the user. This is because the user does not have the most control over the computer. It does not matter how much effort the user wants to make including how much money they are willing to spend in order to protect the computer because the user is not allowed to have as much control as various third parties. A $5-$25 credit card-sized development board is easier to protect than a mobile phone. Because it is "hackable" by it user.

fnkym0nky 10y ago

Android is notoriously broken among the AppSec community. For proof all you have to do is look at the last 90 days of Android bug reports[1]. The reason why your not hearing of exploits is because of the price war that currently exists for them. Zerodium recently raised the price for a Android RCE to $200,000, with iPhone RCEs at 1.5 million[2]. [1] https://source.android.com/security/bulletin/2016-10-01.html https://source.android.com/security/bulletin/2016-10-01.html [2] https://www.zerodium.com/program.html https://www.zerodium.com/program.html

pjmlp 10y ago
After watching the presentations about the state of the union in regards to kernel security in Android, I came to realize that I was wrong in bashing Google for their constrained NDK. Actually, they should constrain it even more, given the poor state of kernel exploits and how the whole security updates doesn't happen across Android devices.