3 ms·

What's unstated here but recognized by unrevoked is that Sprint had skyagent purposefully on their phones so that they could easily gain root access and keep th

What's unstated here but recognized by unrevoked is that Sprint had skyagent purposefully on their phones so that they could easily gain root access and keep their phones under their command.

po 16y ago
If is recognized by unrevoked that that is true, then why does it state, "At this time, we believe that skyagent was a debugging binary left over from manufacture. We have been consistently impressed with the actions taken by Google, Sprint, and HTC to expeditiously resolve this issue."
- joubert 16y ago
  But a few paragraphs later they write: However, the security vulnerabilities present in skyagent are of less cause for concern than the purpose of the program. It appears that the binary was designed as a backdoor into the phone, allowing remote control of the device without the user's knowledge or permission. When the program is invoked, it listens for connections over TCP (by default, port 12345, on all interfaces, including the 3G network!) that accepts a fixed set of commands. These commands appear to be authenticated only by a fixed “magic number”; the commands are neither encrypted on the way to the device or on the way back. The commands that we have knowledge of at this time include: sending and monitor user tap and drag input (“PentapHook”), sending key events (“InputCapture”), dumping the framebuffer (“captureScreen”), listing processes (“GetProc”), rebooting the device immediately, and executing arbitrary shell commands as root (“LaunchChild”)
  - po 16y ago
    OK yeah that's a bit creepy. I missed that part. Why do they seemingly absolve them of any suspicion earlier in the report? I still feel like we should trust the judgement of the reporters. They're taking a measured response to this.
  - illumin8 16y ago
    Typical debugging routines. It's fairly obvious some developer wrote this to troubleshoot devices and they forgot to remove it from the final golden master build. This happens a lot, and there is nothing malicious about it. Now, if they had spawned this process from init and left it running on all phones leaving the factory, that would be another story.
  - ramchip 16y ago
    Isn't your comment fully supporting the previous poster? It sounds a lot more like a debugging tool than a malevolent program: a backdoor sitting in an obvious folder, with an easy default port and no encryption, that allows to see system status, events, or run commands. Also, "We do not believe that skyagent could ever be invoked remotely".
    - joubert 16y ago
      Curious name for a "debugging tool", but maybe that's just me.
  - cjoh 16y ago
    You mean skyagent makes it easybto take screenshots on an android device? Sign me up!

What's unstated here but recognized by unrevoked is that Sprint had skyagent purposefully on their phones so that they could easily gain root access and keep their phones under their command.

po 16y ago

If is recognized by unrevoked that that is true, then why does it state, "At this time, we believe that skyagent was a debugging binary left over from manufacture. We have been consistently impressed with the actions taken by Google, Sprint, and HTC to expeditiously resolve this issue."

joubert 16y ago
But a few paragraphs later they write: However, the security vulnerabilities present in skyagent are of less cause for concern than the purpose of the program. It appears that the binary was designed as a backdoor into the phone, allowing remote control of the device without the user's knowledge or permission. When the program is invoked, it listens for connections over TCP (by default, port 12345, on all interfaces, including the 3G network!) that accepts a fixed set of commands. These commands appear to be authenticated only by a fixed “magic number”; the commands are neither encrypted on the way to the device or on the way back. The commands that we have knowledge of at this time include: sending and monitor user tap and drag input (“PentapHook”), sending key events (“InputCapture”), dumping the framebuffer (“captureScreen”), listing processes (“GetProc”), rebooting the device immediately, and executing arbitrary shell commands as root (“LaunchChild”)
- po 16y ago
  OK yeah that's a bit creepy. I missed that part. Why do they seemingly absolve them of any suspicion earlier in the report? I still feel like we should trust the judgement of the reporters. They're taking a measured response to this.
- illumin8 16y ago
  Typical debugging routines. It's fairly obvious some developer wrote this to troubleshoot devices and they forgot to remove it from the final golden master build. This happens a lot, and there is nothing malicious about it. Now, if they had spawned this process from init and left it running on all phones leaving the factory, that would be another story.
- ramchip 16y ago
  Isn't your comment fully supporting the previous poster? It sounds a lot more like a debugging tool than a malevolent program: a backdoor sitting in an obvious folder, with an easy default port and no encryption, that allows to see system status, events, or run commands. Also, "We do not believe that skyagent could ever be invoked remotely".
  - joubert 16y ago
    Curious name for a "debugging tool", but maybe that's just me.
- cjoh 16y ago
  You mean skyagent makes it easybto take screenshots on an android device? Sign me up!