28 ms·

Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

411 points by lp001 7y ago

mehrdadn 7y ago
> The researchers speculate the bug is being used by NSO, an Isreal-based group known to sell tools to authorities to exploit iOS and Android. > Due to evidence of in the wild exploit, we are now de-restricting this bug 7 days after reporting to Android. Why is this a good idea?
- beojan 7y ago
  Well, Google are themselves the vendor here. Also seems it's fixed and this might encourage manufacturers to push out an update.
  - mehrdadn 7y ago
    Right, I realize they're the vendors, but isn't this just going to make even more people exploit the vulnerability before consumers get patches? Like actual hackers targeting random people in the wild, not merely law enforcement?
    - simion314 7y ago
      It may depend who are targeted by this exploits, if the targets are politicians and people with high positions is better to make it public and have this people not use their phones.
  - xvector 7y ago
    I feel like this goes against responsible disclosure. Google should give the manufacturers a month to push updates themselves, just like Google would expect a month to fix an issue someone reported to them.
    - jdm2212 7y ago
      It's being actively exploited, which changes the calculus.
      - mehrdadn 7y ago
        "Actively exploited" by... law enforcement? Do all consumers really need to freak out about this the same way they would if hackers had access? Doesn't that detail change the calculus here?
        infinityplus1 7y ago
        Not all law enforcements are working for the good of their people, probably.
        mehrdadn 7y ago
        That still doesn't counter my point.
        msbarnett 7y ago
        > "Actively exploited" by... law enforcement "Actively exploited" by at least law enforcement. It’s sheer folly to presume that if one motivated group has already discovered this that nonetheless somehow others won’t have as well.
    - beojan 7y ago
      The manufacturers don't need to fix anything though, they just need to push out the update. The entity that needs to fix (and has fixed) the bug is Google itself.
  - eternalny1 7y ago
    I just received an system update notification on my Galaxy S9. I can't help but wonder if it is related to this news.
- typical182 7y ago
  Well, one thing is it was apparently already publicly reported over 2 years ago by syzkaller: https://twitter.com/dvyukov/status/1180195777680986113 https://twitter.com/dvyukov/status/1180195777680986113
  - creato 7y ago
    That was apparently fixed? > No longer occurring on linux-next, probably fixed by the following commit: > #syz fix: ANDROID: binder: remove waitqueue when thread exits. https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUh...
    - sp332 7y ago
      Not sure if it's that exact one, but according to https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... it was fixed in "Dec 2017 in the 4.14 LTS kernel, AOSP android 3.18 kernel, AOSP android 4.4 kernel, and AOSP android 4.9 kernel".
    - typical182 7y ago
      Yes, fixed upstream near start of 2018, but apparently never merged back to various “stable” kernels. See for example: https://mobile.twitter.com/grsecurity/status/1180059539233804288 https://mobile.twitter.com/grsecurity/status/118005953923380...
- Felk 7y ago
  I don't know the reasons behind that policy, but I'd guess with the exploit already being used, there is less incentive to keep silent about the issue. The opposite is true: putting more pressure on the vendors to provide patches, and disclosing any malicious actions that are already underway as soon as possible
  - mehrdadn 7y ago
    They could tell vendors about the issue earlier without telling the rest of the world earlier though, can't they?
    - ebiggers 7y ago
      Well, the longer that vulnerabilities are kept secret, the longer that users are unable to take any action to protect themselves, and the less incentive that vendors have to roll out fixes quickly and to prevent vulnerabilities in the first place. See the Project Zero disclosure FAQ: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl...
- ehsankia 7y ago
  The general reasoning is that since it's already being exploited, there's more value in warning people so they can decide to not use said affected devices, rather than being in the dark.
- PeterisP 7y ago
  Because the "bad guys" already know about the vulnerability, so there's no benefit from keeping it secret but a duty to the consumers to inform them as well - especially since the kernel patch already exists.
  - mehrdadn 7y ago
    How many consumers across the world would actually be at risk from NSO having details of the exploit vs. all the other "bad guys" though? Isn't there a significant distinction that's being brushed under the rug here?
    - detaro 7y ago
      > How many consumers across the world would actually be at risk… We don't know, because we don't know who bought it and how widespread they deployed it.
      - mehrdadn 7y ago
        Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?
        sp332 7y ago
        Sure, just model the relative probability that each hacking group will find a vulnerability. For a simple example, let's just say there are 5 organizations in the world that are equally good as NSO. So the odds that NSO were the first to find this one are 20%. In reality I think the odds would be quite a bit worse.
        detaro 7y ago
        I don't know - I can't, maybe Google/other researchers can. But true, my comment was a bit needlessly glib. It also seems like you could discover the bug from public sources - it had been created and fixed in the kernel. Apparently at the time not registered as a security issue, but review could discover the link and check for Android's not having the fix. In the case of Android, "just tell the vendor" is also kind of awkward: There's dozens, if not hundreds of those. If there's an active threat, it's kind of hard to justify not to inform all of them, but could you trust an embargo over so many parties?
- mathisonturing 7y ago
  You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content." I guess it informs us what not to do at the very least. Given the track record, I'm not very optimistic of the vendors pushing a patch very soon (if ever). This keeps us informed at least.
  - mehrdadn 7y ago
    > You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content." They can easily give that^ information without exposing details of the bug though?
  - asdfasgasdgasdg 7y ago
    Or the attacked surface has to be exposed to the browser sandbox, which apparently this one is, per: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
asdfasgasdgasdg 7y ago
People, many on this very site, often erroneously claim that P0 does not disclose vulnerabilities in Google's own products. Or they claim that Google gets favorable treatment, like the disclosure only of less severe bugs, or longer disclosure deadlines. Here is a countervailing datapoint.
delibes 7y ago
> However, if you install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content. So, you have to sideload an app or from some other source. Is it unreasonable to say don't do that? How common is it anyway? I work with IT folks and only a few ever seem to load outside the Play store. Perhaps in other parts of the world it's more common...?
- mehrdadn 7y ago
  There are lots of sites out there that host APKs of apps (older versions, etc.)... I'd wager they have more than a few users.
  - klingonopera 7y ago
    ...there need to be more developers like these! I'm not sure, but aren't Play Store submittals APKs anyways? Is additionally self-hosting them that much more complicated? I've heard that developers often go Play Store exclusive, for fear that Google might block them. Is that true?
- soulofmischief 7y ago
  Some of us are just trying to remove ourselves from Google's teat because we don't want to be sucking from Apple's teat instead, but it's getting increasingly harder to do so.
- detaro 7y ago
  I believe the article is translating that badly from the bug report. An app installed through the Play store is also an "untrusted app code execution" - Play deploys some scanning tools on submitted apps during the review, but do you trust them to catch it always? There's also things like Amazon devices with Amazon app store, ... Similarly, Chrome is only mentioned because it's notable that it can be effective from inside its isolation if combined with a browser exploit. That likely applies to all browsers, but the article recommends to switch browsers.
- 7y ago
userbinator 7y ago
This is another great chance to root your phone and take complete control of what you should rightly own.
- notmokjklhr 7y ago
  And your chance to share this complete control with every installed app. Phones should be like desktop computers. You install an app, you give it access to everything your account can touch on the computer.
  - zelly 7y ago
    Android has one of the best security models and sandboxing for apps. It's based around SELinux.
    - vengefulduck 7y ago
      Which this vulnerability bypasses, so kinda a moot point.
      - mrb 7y ago
        "Best" security model ≠ "Perfect" model. In fact, no model is perfect.
    - zzzcpan 7y ago
      > Android has one of the best security models and sandboxing for apps. It's based around SELinux. You mean a security model that misses the fact that the kernel cannot be updated and relies on a "sanboxing" solution that doesn't bother limiting kernel attack surface. No, I don't think they even had a security model in mind, a threat model or anything beyond random ad hoc ideas. And if they did some thinking, they would not have chosen SELinux either, as it's not a decent solution to anything, it's more like a solution to "we must to do something, this is something, we must do this".
      - 7y ago
dunkindonuts 7y ago
Any negative development for the most backwards, disgusting nation on earth is a positive development for humanity and civilization
klingonopera 7y ago
> However, if you install an application from an untrusted source, attackers can take advantage of that. I'm slightly confused: Do they mean any app or a compromised app?
- sp332 7y ago
  A compromised app. The vulnerability requires local code execution, so either an app you install and run, or a malicious webpage that somehow breaks out of the browser sandbox, or... loading a specially constructed video file in a vulnerable version of VLC, or something. Basically you need to combine this with some other vulnerability or convince the user to just straight up run the code.
  - klingonopera 7y ago
    Thanks, the ambiguous wording from the article suggested to me that a vulnerability in the system code used for installing from an untrusted source may be used by the exploit.
  - tmd83 7y ago
    What wasn't clear was that is there a known browser sandboxing vulnerability at this point that can be used to get root or the idea is that if someone has one they could use this one to get root. Can I use Chrome in my Android phone now or cannot?
    - Thorrez 7y ago
      Generally to exploit an OS from within Chrome you need 2 vulnerabilities: (1) to break out from javascript into machine code execution within the sandbox, (2) to break out of the sandbox into the general OS (and maybe (3) to then get root on the OS). From my reading of this comment[1], it sounds like this vulnerability is such that if an attacker has vulnerability (1), this vulnerability can be used as vulnerability (2) and (3). It sounds like NSO group either had or has a separate vulnerability (1), possibly something from [2]. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... [2] https://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 https://www.cvedetails.com/product/15031/Google-Chrome.html?...
arusahni 7y ago
After the recent disclosures about Apple vulnerabilities, I've seen a lot of (unwarranted, in my opinion) criticism from HN of Project Zero, specifically the accusation of non-Google bias. For those who hold this position, does this affect your stance?
- GeekyBear 7y ago
  Wasn't this a case where members of the Project Zero team were individually commenting in a Chromium bug thread and not a Project Zero public facing blog post? Was there a Project Zero blog post before those comments went public that I missed?
  - fireattack 7y ago
    It's not a "Chromium" bug, it's project-zero bug [1]. https://bugs.chromium.org/ https://bugs.chromium.org/ is just a bug tracker site to host batch of projects by Google. While most of them are related to Chromium, there are also things like project-zero. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
    - GeekyBear 7y ago
      So where was the Project Zero blog post on the matter? Because if this wasn't announced on their blog I'm going to have to say that this particular case would not be an apples to apples comparison. Here was the Project Zero blog post on Apple's exploit, for comparison. https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
      - Thorrez 7y ago
        Note that that blog post was published in August 2019, while the vulnerabilities mentioned in the blog post were reported in a wide range of dates from October 2017[1] to December 2018[2] (that's the latest one I found in a quick skim, maybe there are later ones). This Android vulnerability was reported September 2019[3], so it may take 8-22 months before the blog post comes out. The reporter does intend to post a blog post about it[3]. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1417 https://bugs.chromium.org/p/project-zero/issues/detail?id=14... [2] https://bugs.chromium.org/p/project-zero/issues/detail?id=1731 https://bugs.chromium.org/p/project-zero/issues/detail?id=17... [3] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
cryptozeus 7y ago
“It’s advisable that you don’t install apps from non-trustworthy sources, ” Unpopular opinion but this is why I prefer walled garden apple for my family then alternative.
- StavrosK 7y ago
  I don't understand people who want to remove choice. Don't want the ability to install apps from untrustworthy sources? Don't enable the option that gives you that ability.
  - dodobirdlord 7y ago
    The position is self-defeating. How can you hold it and at the same time advocate against their choice to use a system that doesn't have the ability to install apps from untrustworthy sources? The availability of such systems is obviously an increase in available choice, not a decrease.
    - CamperBob2 7y ago
      Unless I'm misunderstanding your point, haven't you just rephrased Karl Popper's "paradox of tolerance?" Advocating freedom to create walled gardens in mainstream computing is what's self-defeating.
      - dodobirdlord 7y ago
        I disagree. The existence of a walled garden to opt into is a meaningful choice. As long as other choices exist, the existence of a walled garden limits nobodies choice. Based on some other comments in the thread I'll add that it would be even better from a choice perspective if Apple offered two configurations of iPhone, one where sideloading was available via a software toggle and one with hardware that cannot run unsigned code. Ultimately though, an approximation of this choice is available by substituting some Android device for the first option.
    - AnthonyMouse 7y ago
KibbutzDalia 7y ago
This is why we need the kernel to be re-written in Rust ASAP -- to make these flaws a thing of the past.
- techntoke 7y ago
  Too much effort for something that is only theoretical. Better to start new and see how it goes.
typical182 7y ago
To me, the biggest part of this story is: 1. Over two years ago, this was apparently detected automatically by the syzkaller kernel fuzzer, and automatically reported on its public mailing list. [1] 2. Over a year and a half ago, it was apparently fixed in the upstream kernel. [2] 3. It was apparently never merged back to various "stable" kernels, leading to the recent CVE. [3] So you might read that and think "Ok, probably a rare mistake"... ...but instead: 4. This is apparently a _super_ common sequence of events, with kernel vulnerabilities getting lost in the shuffle, or otherwise not backported to "stable" kernels for a variety of reasons like the patch no cleanly longer applies. Dmitry Vyukov (original author of syzkaller fuzzer that found this 2 years ago) gave a very interesting talk on how frequently this happens a couple weeks ago at the Linux Maintainer's Summit, along with some discussion of how to change kernel dev processes to try to dramatically improve things: slides: https://linuxplumbersconf.org/event/4/contributions/554/attachments/353/584/Reflections__Kernel_Summit_2019.pdf https://linuxplumbersconf.org/event/4/contributions/554/atta... video: https://youtu.be/a2Nv-KJyqPk?t=5239 https://youtu.be/a2Nv-KJyqPk?t=5239 --- [1] https://twitter.com/dvyukov/status/1180195777680986113 https://twitter.com/dvyukov/status/1180195777680986113 [2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/android/binder.c?h=linux-4.14.y&id=7a3cee43e935b9d526ad07f20bf005ba7e74d05b https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux... [3] https://mobile.twitter.com/grsecurity/status/1180059539233804288 https://mobile.twitter.com/grsecurity/status/118005953923380...
- yjftsjthsd-h 7y ago
  So should we be fuzzing the stable branches separately?
  - ebiggers 7y ago
    syzbot is already fuzzing the latest two stable kernels and has found hundreds of bugs, including lots of use-after-frees. All these bugs are listed here: - https://syzkaller.appspot.com/linux-4.14 https://syzkaller.appspot.com/linux-4.14 - https://syzkaller.appspot.com/linux-4.19 https://syzkaller.appspot.com/linux-4.19 As far as I know, no one is doing anything with the syzbot bugs against stable kernels directly, since no company using Linux is paying anyone to do it as their job. But some are getting fixed; e.g., some get reported against mainline too, then fixed and backported.
z3t4 7y ago
Mobile phones, especially Android ones are very vulnerable as they rarely get updates, or if they get updates at all. And these devices are used for second factor security. And sometimes they are the only thing needed to get access to your entire life.
jdc 7y ago
Proof on concept: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
OrgNet 7y ago
this is a feature and not a bug
- 2OEH8eoCRo0 7y ago
  Do you have a source for that?
  - OrgNet 7y ago
    the source is me, and the reason why I said that is because they usually block you from being root on your own devices... sometime, bugs like these are the only way to really own your device.
ec109685 7y ago
> It’s advisable that you don’t install apps from non-trustworthy sources, and use an alternate browser such as Firefox or Brave till the issue is fixed. We’ll keep you posted on any updates issued by phone makers. The recommendation that other browsers are inherently protected doesn’t make sense. Any app with an rce bug could be a vehicle to exploit this Android bug.
walrus01 7y ago
Oppo A3, but not OnePlus 7 pro?
kccqzy 7y ago
The bug is scaringly easy to trigger. It just takes four system calls, none of which are niche or take unusual arguments. int fd, epfd; struct epoll_event event = { .events = EPOLLIN }; fd = open("/dev/binder0", O_RDONLY); epfd = epoll_create(1000); epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event); ioctl(fd, BINDER_THREAD_EXIT, NULL);
- catern 7y ago
  It's interesting that even such basic usage of binder is buggy. It's long been known that binder is horrible code, but I didn't know it was quite this bad. It's unfortunate that Google chose to use a custom IPC system, binder, for Android, instead of changing Android's design to better fit Linux. If binder was in use outside Android, I expect this bug would have been caught long ago and certainly would have been backported to stable.
  - blub 7y ago
    Judging by how much Binder's "elegant design" of BeOS pedigree was praised, I was expecting it to be quite good. I just had a look at binder.c and the ref counting and locking in general looks like a nightmare to maintain. This reminds me of how much I hate resource management in C.
    - jumpingmice 7y ago
      Most of the BeOS was written in C++. Nobody at Be would have tolerated the code quality you find in Linux binder.
- jsjohnst 7y ago
  Compare that to the level of sophistication required to do exploits in the recent iOS deep dive blog post and the commentary about “bad programming” in regards to it.
huxflux 7y ago
Linux Linux Linux.
arpa 7y ago
I see that samsung s series is also affected. The thing about the samsung phones is that you can root them, but that basically breaks the KNOX (secure folder) functionality forever (efuse AFAIR). Couldn't this exploit be used to root the phones while preserving knox by not tripping the efuse?
bloudermilk 7y ago
The macro-level progression of digital security really worries me. Each day the attack surface grows, the number of bad actors grows, the number of internet-connected individuals grows, and the quantity and sensitivity of data per-capita grows. Is there a well-researched theory that considers a "breaking point" in this pattern? Where we either a) accept that all data is at risk of being exposed or b) develop fundamental security patterns to privatize our data or c) something else?
app4soft 7y ago
AWESOME! Please, give me instruction to root my Xiaomi Ido until they fixed it! (updates on my phone disabled for a while)

411 points by lp001 7y ago

> The researchers speculate the bug is being used by NSO, an Isreal-based group known to sell tools to authorities to exploit iOS and Android. > Due to evidence of in the wild exploit, we are now de-restricting this bug 7 days after reporting to Android. Why is this a good idea?

beojan 7y ago
Well, Google are themselves the vendor here. Also seems it's fixed and this might encourage manufacturers to push out an update.
- mehrdadn 7y ago
  Right, I realize they're the vendors, but isn't this just going to make even more people exploit the vulnerability before consumers get patches? Like actual hackers targeting random people in the wild, not merely law enforcement?
  - simion314 7y ago
    It may depend who are targeted by this exploits, if the targets are politicians and people with high positions is better to make it public and have this people not use their phones.
- xvector 7y ago
  I feel like this goes against responsible disclosure. Google should give the manufacturers a month to push updates themselves, just like Google would expect a month to fix an issue someone reported to them.
  - jdm2212 7y ago
    It's being actively exploited, which changes the calculus.
    - mehrdadn 7y ago
      "Actively exploited" by... law enforcement? Do all consumers really need to freak out about this the same way they would if hackers had access? Doesn't that detail change the calculus here?
      - infinityplus1 7y ago
        Not all law enforcements are working for the good of their people, probably.
        mehrdadn 7y ago
        That still doesn't counter my point.
      - msbarnett 7y ago
        > "Actively exploited" by... law enforcement "Actively exploited" by at least law enforcement. It’s sheer folly to presume that if one motivated group has already discovered this that nonetheless somehow others won’t have as well.
  - beojan 7y ago
    The manufacturers don't need to fix anything though, they just need to push out the update. The entity that needs to fix (and has fixed) the bug is Google itself.
- eternalny1 7y ago
  I just received an system update notification on my Galaxy S9. I can't help but wonder if it is related to this news.
typical182 7y ago
Well, one thing is it was apparently already publicly reported over 2 years ago by syzkaller: https://twitter.com/dvyukov/status/1180195777680986113 https://twitter.com/dvyukov/status/1180195777680986113
- creato 7y ago
  That was apparently fixed? > No longer occurring on linux-next, probably fixed by the following commit: > #syz fix: ANDROID: binder: remove waitqueue when thread exits. https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUh...
  - sp332 7y ago
    Not sure if it's that exact one, but according to https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... it was fixed in "Dec 2017 in the 4.14 LTS kernel, AOSP android 3.18 kernel, AOSP android 4.4 kernel, and AOSP android 4.9 kernel".
  - typical182 7y ago
    Yes, fixed upstream near start of 2018, but apparently never merged back to various “stable” kernels. See for example: https://mobile.twitter.com/grsecurity/status/1180059539233804288 https://mobile.twitter.com/grsecurity/status/118005953923380...
Felk 7y ago
I don't know the reasons behind that policy, but I'd guess with the exploit already being used, there is less incentive to keep silent about the issue. The opposite is true: putting more pressure on the vendors to provide patches, and disclosing any malicious actions that are already underway as soon as possible
- mehrdadn 7y ago
  They could tell vendors about the issue earlier without telling the rest of the world earlier though, can't they?
  - ebiggers 7y ago
    Well, the longer that vulnerabilities are kept secret, the longer that users are unable to take any action to protect themselves, and the less incentive that vendors have to roll out fixes quickly and to prevent vulnerabilities in the first place. See the Project Zero disclosure FAQ: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl...
ehsankia 7y ago
The general reasoning is that since it's already being exploited, there's more value in warning people so they can decide to not use said affected devices, rather than being in the dark.
PeterisP 7y ago
Because the "bad guys" already know about the vulnerability, so there's no benefit from keeping it secret but a duty to the consumers to inform them as well - especially since the kernel patch already exists.
- mehrdadn 7y ago
  How many consumers across the world would actually be at risk from NSO having details of the exploit vs. all the other "bad guys" though? Isn't there a significant distinction that's being brushed under the rug here?
  - detaro 7y ago
    > How many consumers across the world would actually be at risk… We don't know, because we don't know who bought it and how widespread they deployed it.
    - mehrdadn 7y ago
      Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?
      - sp332 7y ago
        Sure, just model the relative probability that each hacking group will find a vulnerability. For a simple example, let's just say there are 5 organizations in the world that are equally good as NSO. So the odds that NSO were the first to find this one are 20%. In reality I think the odds would be quite a bit worse.
      - detaro 7y ago
        I don't know - I can't, maybe Google/other researchers can. But true, my comment was a bit needlessly glib. It also seems like you could discover the bug from public sources - it had been created and fixed in the kernel. Apparently at the time not registered as a security issue, but review could discover the link and check for Android's not having the fix. In the case of Android, "just tell the vendor" is also kind of awkward: There's dozens, if not hundreds of those. If there's an active threat, it's kind of hard to justify not to inform all of them, but could you trust an embargo over so many parties?
mathisonturing 7y ago
You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content." I guess it informs us what not to do at the very least. Given the track record, I'm not very optimistic of the vendors pushing a patch very soon (if ever). This keeps us informed at least.
- mehrdadn 7y ago
  > You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content." They can easily give that^ information without exposing details of the bug though?
- asdfasgasdgasdg 7y ago
  Or the attacked surface has to be exposed to the browser sandbox, which apparently this one is, per: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

asdfasgasdgasdg 7y ago

People, many on this very site, often erroneously claim that P0 does not disclose vulnerabilities in Google's own products. Or they claim that Google gets favorable treatment, like the disclosure only of less severe bugs, or longer disclosure deadlines. Here is a countervailing datapoint.

delibes 7y ago

> However, if you install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content. So, you have to sideload an app or from some other source. Is it unreasonable to say don't do that? How common is it anyway? I work with IT folks and only a few ever seem to load outside the Play store. Perhaps in other parts of the world it's more common...?

mehrdadn 7y ago
There are lots of sites out there that host APKs of apps (older versions, etc.)... I'd wager they have more than a few users.
- klingonopera 7y ago
  ...there need to be more developers like these! I'm not sure, but aren't Play Store submittals APKs anyways? Is additionally self-hosting them that much more complicated? I've heard that developers often go Play Store exclusive, for fear that Google might block them. Is that true?
soulofmischief 7y ago
Some of us are just trying to remove ourselves from Google's teat because we don't want to be sucking from Apple's teat instead, but it's getting increasingly harder to do so.
detaro 7y ago
I believe the article is translating that badly from the bug report. An app installed through the Play store is also an "untrusted app code execution" - Play deploys some scanning tools on submitted apps during the review, but do you trust them to catch it always? There's also things like Amazon devices with Amazon app store, ... Similarly, Chrome is only mentioned because it's notable that it can be effective from inside its isolation if combined with a browser exploit. That likely applies to all browsers, but the article recommends to switch browsers.
7y ago

userbinator 7y ago

This is another great chance to root your phone and take complete control of what you should rightly own.

notmokjklhr 7y ago
And your chance to share this complete control with every installed app. Phones should be like desktop computers. You install an app, you give it access to everything your account can touch on the computer.
- zelly 7y ago
  Android has one of the best security models and sandboxing for apps. It's based around SELinux.
  - vengefulduck 7y ago
    Which this vulnerability bypasses, so kinda a moot point.
    - mrb 7y ago
      "Best" security model ≠ "Perfect" model. In fact, no model is perfect.
  - zzzcpan 7y ago
    > Android has one of the best security models and sandboxing for apps. It's based around SELinux. You mean a security model that misses the fact that the kernel cannot be updated and relies on a "sanboxing" solution that doesn't bother limiting kernel attack surface. No, I don't think they even had a security model in mind, a threat model or anything beyond random ad hoc ideas. And if they did some thinking, they would not have chosen SELinux either, as it's not a decent solution to anything, it's more like a solution to "we must to do something, this is something, we must do this".
    - 7y ago

dunkindonuts 7y ago

Any negative development for the most backwards, disgusting nation on earth is a positive development for humanity and civilization

klingonopera 7y ago

> However, if you install an application from an untrusted source, attackers can take advantage of that. I'm slightly confused: Do they mean any app or a compromised app?

sp332 7y ago
A compromised app. The vulnerability requires local code execution, so either an app you install and run, or a malicious webpage that somehow breaks out of the browser sandbox, or... loading a specially constructed video file in a vulnerable version of VLC, or something. Basically you need to combine this with some other vulnerability or convince the user to just straight up run the code.
- klingonopera 7y ago
  Thanks, the ambiguous wording from the article suggested to me that a vulnerability in the system code used for installing from an untrusted source may be used by the exploit.
- tmd83 7y ago
  What wasn't clear was that is there a known browser sandboxing vulnerability at this point that can be used to get root or the idea is that if someone has one they could use this one to get root. Can I use Chrome in my Android phone now or cannot?
  - Thorrez 7y ago
    Generally to exploit an OS from within Chrome you need 2 vulnerabilities: (1) to break out from javascript into machine code execution within the sandbox, (2) to break out of the sandbox into the general OS (and maybe (3) to then get root on the OS). From my reading of this comment[1], it sounds like this vulnerability is such that if an attacker has vulnerability (1), this vulnerability can be used as vulnerability (2) and (3). It sounds like NSO group either had or has a separate vulnerability (1), possibly something from [2]. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... [2] https://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 https://www.cvedetails.com/product/15031/Google-Chrome.html?...

arusahni 7y ago

After the recent disclosures about Apple vulnerabilities, I've seen a lot of (unwarranted, in my opinion) criticism from HN of Project Zero, specifically the accusation of non-Google bias. For those who hold this position, does this affect your stance?

GeekyBear 7y ago
Wasn't this a case where members of the Project Zero team were individually commenting in a Chromium bug thread and not a Project Zero public facing blog post? Was there a Project Zero blog post before those comments went public that I missed?
- fireattack 7y ago
  It's not a "Chromium" bug, it's project-zero bug [1]. https://bugs.chromium.org/ https://bugs.chromium.org/ is just a bug tracker site to host batch of projects by Google. While most of them are related to Chromium, there are also things like project-zero. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...
  - GeekyBear 7y ago
    So where was the Project Zero blog post on the matter? Because if this wasn't announced on their blog I'm going to have to say that this particular case would not be an apples to apples comparison. Here was the Project Zero blog post on Apple's exploit, for comparison. https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
    - Thorrez 7y ago
      Note that that blog post was published in August 2019, while the vulnerabilities mentioned in the blog post were reported in a wide range of dates from October 2017[1] to December 2018[2] (that's the latest one I found in a quick skim, maybe there are later ones). This Android vulnerability was reported September 2019[3], so it may take 8-22 months before the blog post comes out. The reporter does intend to post a blog post about it[3]. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1417 https://bugs.chromium.org/p/project-zero/issues/detail?id=14... [2] https://bugs.chromium.org/p/project-zero/issues/detail?id=1731 https://bugs.chromium.org/p/project-zero/issues/detail?id=17... [3] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

cryptozeus 7y ago

“It’s advisable that you don’t install apps from non-trustworthy sources, ” Unpopular opinion but this is why I prefer walled garden apple for my family then alternative.

StavrosK 7y ago
I don't understand people who want to remove choice. Don't want the ability to install apps from untrustworthy sources? Don't enable the option that gives you that ability.
- dodobirdlord 7y ago
  The position is self-defeating. How can you hold it and at the same time advocate against their choice to use a system that doesn't have the ability to install apps from untrustworthy sources? The availability of such systems is obviously an increase in available choice, not a decrease.
  - CamperBob2 7y ago
    Unless I'm misunderstanding your point, haven't you just rephrased Karl Popper's "paradox of tolerance?" Advocating freedom to create walled gardens in mainstream computing is what's self-defeating.
    - dodobirdlord 7y ago
      I disagree. The existence of a walled garden to opt into is a meaningful choice. As long as other choices exist, the existence of a walled garden limits nobodies choice. Based on some other comments in the thread I'll add that it would be even better from a choice perspective if Apple offered two configurations of iPhone, one where sideloading was available via a software toggle and one with hardware that cannot run unsigned code. Ultimately though, an approximation of this choice is available by substituting some Android device for the first option.
  - AnthonyMouse 7y ago

KibbutzDalia 7y ago

This is why we need the kernel to be re-written in Rust ASAP -- to make these flaws a thing of the past.

techntoke 7y ago
Too much effort for something that is only theoretical. Better to start new and see how it goes.

typical182 7y ago

To me, the biggest part of this story is: 1. Over two years ago, this was apparently detected automatically by the syzkaller kernel fuzzer, and automatically reported on its public mailing list. [1] 2. Over a year and a half ago, it was apparently fixed in the upstream kernel. [2] 3. It was apparently never merged back to various "stable" kernels, leading to the recent CVE. [3] So you might read that and think "Ok, probably a rare mistake"... ...but instead: 4. This is apparently a _super_ common sequence of events, with kernel vulnerabilities getting lost in the shuffle, or otherwise not backported to "stable" kernels for a variety of reasons like the patch no cleanly longer applies. Dmitry Vyukov (original author of syzkaller fuzzer that found this 2 years ago) gave a very interesting talk on how frequently this happens a couple weeks ago at the Linux Maintainer's Summit, along with some discussion of how to change kernel dev processes to try to dramatically improve things: slides: https://linuxplumbersconf.org/event/4/contributions/554/attachments/353/584/Reflections__Kernel_Summit_2019.pdf https://linuxplumbersconf.org/event/4/contributions/554/atta... video: https://youtu.be/a2Nv-KJyqPk?t=5239 https://youtu.be/a2Nv-KJyqPk?t=5239 --- [1] https://twitter.com/dvyukov/status/1180195777680986113 https://twitter.com/dvyukov/status/1180195777680986113 [2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/android/binder.c?h=linux-4.14.y&id=7a3cee43e935b9d526ad07f20bf005ba7e74d05b https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux... [3] https://mobile.twitter.com/grsecurity/status/1180059539233804288 https://mobile.twitter.com/grsecurity/status/118005953923380...

yjftsjthsd-h 7y ago
So should we be fuzzing the stable branches separately?
- ebiggers 7y ago
  syzbot is already fuzzing the latest two stable kernels and has found hundreds of bugs, including lots of use-after-frees. All these bugs are listed here: - https://syzkaller.appspot.com/linux-4.14 https://syzkaller.appspot.com/linux-4.14 - https://syzkaller.appspot.com/linux-4.19 https://syzkaller.appspot.com/linux-4.19 As far as I know, no one is doing anything with the syzbot bugs against stable kernels directly, since no company using Linux is paying anyone to do it as their job. But some are getting fixed; e.g., some get reported against mainline too, then fixed and backported.

z3t4 7y ago

Mobile phones, especially Android ones are very vulnerable as they rarely get updates, or if they get updates at all. And these devices are used for second factor security. And sometimes they are the only thing needed to get access to your entire life.

jdc 7y ago

Proof on concept: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

OrgNet 7y ago

this is a feature and not a bug

2OEH8eoCRo0 7y ago
Do you have a source for that?
- OrgNet 7y ago
  the source is me, and the reason why I said that is because they usually block you from being root on your own devices... sometime, bugs like these are the only way to really own your device.

ec109685 7y ago

> It’s advisable that you don’t install apps from non-trustworthy sources, and use an alternate browser such as Firefox or Brave till the issue is fixed. We’ll keep you posted on any updates issued by phone makers. The recommendation that other browsers are inherently protected doesn’t make sense. Any app with an rce bug could be a vehicle to exploit this Android bug.

walrus01 7y ago

Oppo A3, but not OnePlus 7 pro?

kccqzy 7y ago

The bug is scaringly easy to trigger. It just takes four system calls, none of which are niche or take unusual arguments. int fd, epfd; struct epoll_event event = { .events = EPOLLIN }; fd = open("/dev/binder0", O_RDONLY); epfd = epoll_create(1000); epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &event); ioctl(fd, BINDER_THREAD_EXIT, NULL);

catern 7y ago
It's interesting that even such basic usage of binder is buggy. It's long been known that binder is horrible code, but I didn't know it was quite this bad. It's unfortunate that Google chose to use a custom IPC system, binder, for Android, instead of changing Android's design to better fit Linux. If binder was in use outside Android, I expect this bug would have been caught long ago and certainly would have been backported to stable.
- blub 7y ago
  Judging by how much Binder's "elegant design" of BeOS pedigree was praised, I was expecting it to be quite good. I just had a look at binder.c and the ref counting and locking in general looks like a nightmare to maintain. This reminds me of how much I hate resource management in C.
  - jumpingmice 7y ago
    Most of the BeOS was written in C++. Nobody at Be would have tolerated the code quality you find in Linux binder.
jsjohnst 7y ago
Compare that to the level of sophistication required to do exploits in the recent iOS deep dive blog post and the commentary about “bad programming” in regards to it.

huxflux 7y ago

Linux Linux Linux.

arpa 7y ago

I see that samsung s series is also affected. The thing about the samsung phones is that you can root them, but that basically breaks the KNOX (secure folder) functionality forever (efuse AFAIR). Couldn't this exploit be used to root the phones while preserving knox by not tripping the efuse?

bloudermilk 7y ago

The macro-level progression of digital security really worries me. Each day the attack surface grows, the number of bad actors grows, the number of internet-connected individuals grows, and the quantity and sensitivity of data per-capita grows. Is there a well-researched theory that considers a "breaking point" in this pattern? Where we either a) accept that all data is at risk of being exposed or b) develop fundamental security patterns to privatize our data or c) something else?

app4soft 7y ago

AWESOME! Please, give me instruction to root my Xiaomi Ido until they fixed it! (updates on my phone disabled for a while)