5 ms·
Many Android devices of that age and even newer had flaws resulting in the failure to properly validate HTTPS connections as they would accept invalid certifica
by patcheudor 9y ago
Many Android devices of that age and even newer had flaws resulting in the failure to properly validate HTTPS connections as they would accept invalid certificates. As a result, every time I fire up an off the shelf WiFi Pineapple in public and run SSLSplit (not to be confused with Moxies SSLStrip), I get credential after credential, typically starting with e-mail accounts. This is obviously bad because if someone is using an e-mail account on their phone for banking, an attacker could gain access to account recovery.
These are the sorts of transparent attacks you don't notice and which cannot be mitigated with anti-virus or avoiding downloading sketchy apps. The sketchy stuff is already running on the device in the form of the OS and apps you use within it. Note that a large number of these vectors were never publicly disclosed including a vulnerability with Samsung Knox that I reported. When it was in use, the device would accept any cert.
- 5ilv3r 9y agoIsn't it telling that the antifeatures pushed by the updates are so much worse than the threat of data interception?
- guelo 9y agoMost of these "oh no, security!" issues can be mitigated by avoiding public WiFi or using a VPN on them.
- patcheudor 9y agoVPN can be a problem, especially on these older devices as those services themselves are vulnerable due to underlying OS issues. In terms of WiFi, keep in mind LTE is effectively broken because of the emergency tower redirection implementation. It's possible for attackers to direct devices to their own OpenLTE tower. https://sourceforge.net/projects/openlte/files/ https://sourceforge.net/projects/openlte/files/
- yaantc 9y ago> keep in mind LTE is effectively broken because of the emergency tower > redirection implementation And it will fails after only a few message, when the phone modem tries to authenticate the network (MME) and fails. LTE and 3G do have mandatory mutual authentication where the device authenticates the network very early on. It's 2G that's the problem: a 2G network does authenticate the device, but not the other way round, which opens the door to the well known MITM attacks on 2G (stingrays). The worst a LTE/3G rogue cell can do is try to attack the modem during the early non-authenticated messages (send corrupted messages), and waste UE time or jam it. But it can't do MITM. So if you're paranoid and you can afford it due to good 3G/4G coverage, disable 2G on your handset ;)
- patcheudor 9y agoA good talk covering the issue: https://www.youtube.com/watch?v=hNDChDM1hEE https://www.youtube.com/watch?v=hNDChDM1hEE
- distances 9y agoAnd there are tools to avoid even scanning public wifi networks to prevent e.g. in-store tracking, e.g. Smarter WiFi Manager remembers where you've used wifi before based on cell tower locationing, and disables it elsewhere. Works like a charm for me.
- paganel 9y ago> This is obviously bad because if someone is using an e-mail account on their phone for banking, an attacker could gain access to account recovery. I'm still using a iPhone4 with iOS 5.something on it, it's obviously un-patched or anything like that, the secret is that I don't have any baking applications installed on it nor is my email attached to any recurring payments scheme. The even deeper secret is that I don't have an online baking account set-up with my bank at all, as I don't trust any of the banks with their online security. I chose to eat up the opportunity costs of actually physically going to the the bank over the sometimes illusory security and ease-of-use offered by online banking.
- glenneroo 9y agoThe difference is that you are a well-read HackerNews enthusiast who comments on threads relating to OS security i.e. one of the 0.001%, whereas > 99% of the people affected have no idea what dangers await an out-of-date device.