3 ms·

If you already have root, then you don't need to execute a rowhammer attack to gain root. I'm asking if an Android app with no root access on an un-rooted phone

If you already have root, then you don't need to execute a rowhammer attack to gain root. I'm asking if an Android app with no root access on an un-rooted phone has a way to execute code that wasn't included with the apk, in order to hide the code that executes the rowhammer attack. If not, then a static analyzer that detects rowhammer attacks in the code of an apk would be sufficient.

zigzigzag 10y ago
Yes, it can.
lorenzhs 10y ago
Even then it's impossible to be certain, see https://en.wikipedia.org/wiki/Rice%27s_theorem https://en.wikipedia.org/wiki/Rice%27s_theorem - you cannot prove that a programme will or won't do a certain thing. It's not very intuitive, and the whole thing comes down to a clever reduction to the halting problem. The same reasoning also excludes the existence of a perfect virus scanner (even if you were to define a virus to be a programme that may open a dialog saying "VIRUS"). That doesn't mean that you can't catch most of the cases where a programme would do something like this. As they say, perfect is the enemy of good—in this case perfect is provably impossible, but that doesn't mean we shouldn't strive to find something that improves the current state. Google automatically scans all Play Store submissions for known malicious behaviour, they might be able to detect rowhammer exploits the same way.
- Dylan16807 10y ago
  >The same reasoning also excludes the existence of a perfect virus scanner (even if you were to define a virus to be a programme that may open a dialog saying "VIRUS"). It's a cute theorem, but it's more misleading than it is useful. Let's say we use a simple bytecode format for your programs. They can only open that dialog by having a call to the open-dialog function with a fixed parameter saying "VIRUS". We may not be able to say if an arbitrary program will run that call, but we can state with certainty whether it has that call. Such a program is either a virus or a virus decoy, and either way should be blocked. We don't need to answer the question "Are we certain the program does X at runtime?". If we can answer "Does the program have an X-performing module?" that's good enough. On android we can't answer that because the execution model is too powerful. But it's possible to make a practical app platform with the ability to answer that question.
  - cyphar 10y ago
    The problem is that your execution model has to become incredibly constrained (no execve, no mmap, no function pointers and no reflection) in order to make that virus scanner work. I don't think that a general purpose programming language will be that useful if you disable all of those features.
viraptor 10y ago
You can even execute the rowhammer attack from the loaded javascript: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs There's no protection against it really. It doesn't matter if you can scan APKs for this behaviour if any app can open a webview with the right page.
- rcthompson 10y ago
  Thanks, this pretty clearly answers the question.
quotemstr 10y ago
mprotect(..., PROT_EXEC) works just fine on Android

zigzigzag 10y ago

Yes, it can.

lorenzhs 10y ago

Even then it's impossible to be certain, see https://en.wikipedia.org/wiki/Rice%27s_theorem https://en.wikipedia.org/wiki/Rice%27s_theorem - you cannot prove that a programme will or won't do a certain thing. It's not very intuitive, and the whole thing comes down to a clever reduction to the halting problem. The same reasoning also excludes the existence of a perfect virus scanner (even if you were to define a virus to be a programme that may open a dialog saying "VIRUS"). That doesn't mean that you can't catch most of the cases where a programme would do something like this. As they say, perfect is the enemy of good—in this case perfect is provably impossible, but that doesn't mean we shouldn't strive to find something that improves the current state. Google automatically scans all Play Store submissions for known malicious behaviour, they might be able to detect rowhammer exploits the same way.

Dylan16807 10y ago
>The same reasoning also excludes the existence of a perfect virus scanner (even if you were to define a virus to be a programme that may open a dialog saying "VIRUS"). It's a cute theorem, but it's more misleading than it is useful. Let's say we use a simple bytecode format for your programs. They can only open that dialog by having a call to the open-dialog function with a fixed parameter saying "VIRUS". We may not be able to say if an arbitrary program will run that call, but we can state with certainty whether it has that call. Such a program is either a virus or a virus decoy, and either way should be blocked. We don't need to answer the question "Are we certain the program does X at runtime?". If we can answer "Does the program have an X-performing module?" that's good enough. On android we can't answer that because the execution model is too powerful. But it's possible to make a practical app platform with the ability to answer that question.
- cyphar 10y ago
  The problem is that your execution model has to become incredibly constrained (no execve, no mmap, no function pointers and no reflection) in order to make that virus scanner work. I don't think that a general purpose programming language will be that useful if you disable all of those features.

viraptor 10y ago

You can even execute the rowhammer attack from the loaded javascript: https://github.com/IAIK/rowhammerjs https://github.com/IAIK/rowhammerjs There's no protection against it really. It doesn't matter if you can scan APKs for this behaviour if any app can open a webview with the right page.

rcthompson 10y ago
Thanks, this pretty clearly answers the question.

quotemstr 10y ago

mprotect(..., PROT_EXEC) works just fine on Android