3 ms·
Details are missing. If a device downloads updates over a non-secured channel, it doesn't automatically mean that it will execute the update unconditionally. F
by huhtenberg 10y ago
Details are missing.
If a device downloads updates over a non-secured channel, it doesn't automatically mean that it will execute the update unconditionally. For example, a package might be signed with vendor's key, the public part of which is shipped with the device. If the sig is missing or invalid, the device will discard the package.
- huxley 10y agoThe OTA updater was pre-installed and ran as root, is it possible that this would allow it to disregard signatures?
- chrononaut 10y agoThe original research article [0] provides more insight into the actual issue at hand. Specifically, it enables the execution of arbitrary commands. [0] http://blog.anubisnetworks.com/blog/ragentek-android-ota-update-mechanism-vulnerable-to-mitm-attack http://blog.anubisnetworks.com/blog/ragentek-android-ota-upd...
- huhtenberg 10y agoOh, jeez. That's a blatant backdoor alright.