3 ms·

As of 7 days ago they do.

Someone1234 8y ago
According to who or what? That's definitely not what the bug report and Epic themselves say, they never fixed the execution of unverified code issue, they just moved where the unverified code was stored so that other apps couldn't replace it easily. They still need to actually verify that what they're executing is what they verified.
- Dylan16807 8y ago
  > They still need to actually verify that what they're executing is what they verified. They did. Why would you say otherwise? If they can't trust the private storage to be private, then you're looking at a compromised phone where they can't trust any mechanism.
  - Someone1234 8y ago
    > They did. Why would you say otherwise? Because I read the bug report? Where Epic specifically say they didn't fix the execution, instead they changed the storage context from External to Internal. The main issue is that they verify after download instead of before execution. You put an exclusive write lock on the file, verify the file, and then execute the file without releasing the lock. It is what every other major installer or updater does. Epic's version instead downloaded the file, verified it, then [Sleep], and installed whatever was at that location. It is insecure.
    - Dylan16807 8y ago
      Internal app-specific storage is private. That's all it needs to do. I'm not sure holding a lock even works to prevent file renaming on most OSes...
      - namibj 8y ago
        Maybe a lock on the directory.
      - im3w1l 8y ago
        Interesting! can you execute a file directly from the file descriptor though?
        Dylan16807 8y ago
        No idea, but it doesn't need to execute it, it needs to trigger an install of it.
        zaarn 8y ago
        Replace execve with fexecve and you can run file descriptors.
  - UncleMeat 8y ago
    Plenty of other vulns can lead to write access in private storage. You don't need a compromised phone for this to still be a security challenge.
    - Dylan16807 8y ago
      If you have that, you probably don't need to wait for an apk install.

According to who or what? That's definitely not what the bug report and Epic themselves say, they never fixed the execution of unverified code issue, they just moved where the unverified code was stored so that other apps couldn't replace it easily. They still need to actually verify that what they're executing is what they verified.

Dylan16807 8y ago
> They still need to actually verify that what they're executing is what they verified. They did. Why would you say otherwise? If they can't trust the private storage to be private, then you're looking at a compromised phone where they can't trust any mechanism.
- Someone1234 8y ago
  > They did. Why would you say otherwise? Because I read the bug report? Where Epic specifically say they didn't fix the execution, instead they changed the storage context from External to Internal. The main issue is that they verify after download instead of before execution. You put an exclusive write lock on the file, verify the file, and then execute the file without releasing the lock. It is what every other major installer or updater does. Epic's version instead downloaded the file, verified it, then [Sleep], and installed whatever was at that location. It is insecure.
  - Dylan16807 8y ago
    Internal app-specific storage is private. That's all it needs to do. I'm not sure holding a lock even works to prevent file renaming on most OSes...
    - namibj 8y ago
      Maybe a lock on the directory.
    - im3w1l 8y ago
      Interesting! can you execute a file directly from the file descriptor though?
      - Dylan16807 8y ago
        No idea, but it doesn't need to execute it, it needs to trigger an install of it.
      - zaarn 8y ago
        Replace execve with fexecve and you can run file descriptors.
- UncleMeat 8y ago
  Plenty of other vulns can lead to write access in private storage. You don't need a compromised phone for this to still be a security challenge.
  - Dylan16807 8y ago
    If you have that, you probably don't need to wait for an apk install.