4 ms·

> The researchers speculate the bug is being used by NSO, an Isreal-based group known to sell tools to authorities to exploit iOS and Android. > Due to evidenc

> The researchers speculate the bug is being used by NSO, an Isreal-based group known to sell tools to authorities to exploit iOS and Android. > Due to evidence of in the wild exploit, we are now de-restricting this bug 7 days after reporting to Android. Why is this a good idea?

beojan 7y ago
Well, Google are themselves the vendor here. Also seems it's fixed and this might encourage manufacturers to push out an update.
- mehrdadn 7y ago
  Right, I realize they're the vendors, but isn't this just going to make even more people exploit the vulnerability before consumers get patches? Like actual hackers targeting random people in the wild, not merely law enforcement?
  - simion314 7y ago
    It may depend who are targeted by this exploits, if the targets are politicians and people with high positions is better to make it public and have this people not use their phones.
- xvector 7y ago
  I feel like this goes against responsible disclosure. Google should give the manufacturers a month to push updates themselves, just like Google would expect a month to fix an issue someone reported to them.
  - jdm2212 7y ago
    It's being actively exploited, which changes the calculus.
    - mehrdadn 7y ago
      "Actively exploited" by... law enforcement? Do all consumers really need to freak out about this the same way they would if hackers had access? Doesn't that detail change the calculus here?
      - infinityplus1 7y ago
        Not all law enforcements are working for the good of their people, probably.
        mehrdadn 7y ago
        That still doesn't counter my point.
      - msbarnett 7y ago
        > "Actively exploited" by... law enforcement "Actively exploited" by at least law enforcement. It’s sheer folly to presume that if one motivated group has already discovered this that nonetheless somehow others won’t have as well.
  - beojan 7y ago
    The manufacturers don't need to fix anything though, they just need to push out the update. The entity that needs to fix (and has fixed) the bug is Google itself.
- eternalny1 7y ago
  I just received an system update notification on my Galaxy S9. I can't help but wonder if it is related to this news.
typical182 7y ago
Well, one thing is it was apparently already publicly reported over 2 years ago by syzkaller: https://twitter.com/dvyukov/status/1180195777680986113 https://twitter.com/dvyukov/status/1180195777680986113
- creato 7y ago
  That was apparently fixed? > No longer occurring on linux-next, probably fixed by the following commit: > #syz fix: ANDROID: binder: remove waitqueue when thread exits. https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUh...
  - sp332 7y ago
    Not sure if it's that exact one, but according to https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... it was fixed in "Dec 2017 in the 4.14 LTS kernel, AOSP android 3.18 kernel, AOSP android 4.4 kernel, and AOSP android 4.9 kernel".
  - typical182 7y ago
    Yes, fixed upstream near start of 2018, but apparently never merged back to various “stable” kernels. See for example: https://mobile.twitter.com/grsecurity/status/1180059539233804288 https://mobile.twitter.com/grsecurity/status/118005953923380...
Felk 7y ago
I don't know the reasons behind that policy, but I'd guess with the exploit already being used, there is less incentive to keep silent about the issue. The opposite is true: putting more pressure on the vendors to provide patches, and disclosing any malicious actions that are already underway as soon as possible
- mehrdadn 7y ago
  They could tell vendors about the issue earlier without telling the rest of the world earlier though, can't they?
  - ebiggers 7y ago
    Well, the longer that vulnerabilities are kept secret, the longer that users are unable to take any action to protect themselves, and the less incentive that vendors have to roll out fixes quickly and to prevent vulnerabilities in the first place. See the Project Zero disclosure FAQ: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl...
ehsankia 7y ago
The general reasoning is that since it's already being exploited, there's more value in warning people so they can decide to not use said affected devices, rather than being in the dark.
PeterisP 7y ago
Because the "bad guys" already know about the vulnerability, so there's no benefit from keeping it secret but a duty to the consumers to inform them as well - especially since the kernel patch already exists.
- mehrdadn 7y ago
  How many consumers across the world would actually be at risk from NSO having details of the exploit vs. all the other "bad guys" though? Isn't there a significant distinction that's being brushed under the rug here?
  - detaro 7y ago
    > How many consumers across the world would actually be at risk… We don't know, because we don't know who bought it and how widespread they deployed it.
    - mehrdadn 7y ago
      Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?
      - sp332 7y ago
        Sure, just model the relative probability that each hacking group will find a vulnerability. For a simple example, let's just say there are 5 organizations in the world that are equally good as NSO. So the odds that NSO were the first to find this one are 20%. In reality I think the odds would be quite a bit worse.
      - detaro 7y ago
        I don't know - I can't, maybe Google/other researchers can. But true, my comment was a bit needlessly glib. It also seems like you could discover the bug from public sources - it had been created and fixed in the kernel. Apparently at the time not registered as a security issue, but review could discover the link and check for Android's not having the fix. In the case of Android, "just tell the vendor" is also kind of awkward: There's dozens, if not hundreds of those. If there's an active threat, it's kind of hard to justify not to inform all of them, but could you trust an embargo over so many parties?
mathisonturing 7y ago
You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content." I guess it informs us what not to do at the very least. Given the track record, I'm not very optimistic of the vendors pushing a patch very soon (if ever). This keeps us informed at least.
- mehrdadn 7y ago
  > You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content." They can easily give that^ information without exposing details of the bug though?
- asdfasgasdgasdg 7y ago
  Or the attacked surface has to be exposed to the browser sandbox, which apparently this one is, per: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

beojan 7y ago

Well, Google are themselves the vendor here. Also seems it's fixed and this might encourage manufacturers to push out an update.

mehrdadn 7y ago
Right, I realize they're the vendors, but isn't this just going to make even more people exploit the vulnerability before consumers get patches? Like actual hackers targeting random people in the wild, not merely law enforcement?
- simion314 7y ago
  It may depend who are targeted by this exploits, if the targets are politicians and people with high positions is better to make it public and have this people not use their phones.
xvector 7y ago
I feel like this goes against responsible disclosure. Google should give the manufacturers a month to push updates themselves, just like Google would expect a month to fix an issue someone reported to them.
- jdm2212 7y ago
  It's being actively exploited, which changes the calculus.
  - mehrdadn 7y ago
    "Actively exploited" by... law enforcement? Do all consumers really need to freak out about this the same way they would if hackers had access? Doesn't that detail change the calculus here?
    - infinityplus1 7y ago
      Not all law enforcements are working for the good of their people, probably.
      - mehrdadn 7y ago
        That still doesn't counter my point.
    - msbarnett 7y ago
      > "Actively exploited" by... law enforcement "Actively exploited" by at least law enforcement. It’s sheer folly to presume that if one motivated group has already discovered this that nonetheless somehow others won’t have as well.
- beojan 7y ago
  The manufacturers don't need to fix anything though, they just need to push out the update. The entity that needs to fix (and has fixed) the bug is Google itself.
eternalny1 7y ago
I just received an system update notification on my Galaxy S9. I can't help but wonder if it is related to this news.

typical182 7y ago

Well, one thing is it was apparently already publicly reported over 2 years ago by syzkaller: https://twitter.com/dvyukov/status/1180195777680986113 https://twitter.com/dvyukov/status/1180195777680986113

creato 7y ago
That was apparently fixed? > No longer occurring on linux-next, probably fixed by the following commit: > #syz fix: ANDROID: binder: remove waitqueue when thread exits. https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUh...
- sp332 7y ago
  Not sure if it's that exact one, but according to https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... it was fixed in "Dec 2017 in the 4.14 LTS kernel, AOSP android 3.18 kernel, AOSP android 4.4 kernel, and AOSP android 4.9 kernel".
- typical182 7y ago
  Yes, fixed upstream near start of 2018, but apparently never merged back to various “stable” kernels. See for example: https://mobile.twitter.com/grsecurity/status/1180059539233804288 https://mobile.twitter.com/grsecurity/status/118005953923380...

Felk 7y ago

I don't know the reasons behind that policy, but I'd guess with the exploit already being used, there is less incentive to keep silent about the issue. The opposite is true: putting more pressure on the vendors to provide patches, and disclosing any malicious actions that are already underway as soon as possible

mehrdadn 7y ago
They could tell vendors about the issue earlier without telling the rest of the world earlier though, can't they?
- ebiggers 7y ago
  Well, the longer that vulnerabilities are kept secret, the longer that users are unable to take any action to protect themselves, and the less incentive that vendors have to roll out fixes quickly and to prevent vulnerabilities in the first place. See the Project Zero disclosure FAQ: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html https://googleprojectzero.blogspot.com/p/vulnerability-discl...

ehsankia 7y ago

The general reasoning is that since it's already being exploited, there's more value in warning people so they can decide to not use said affected devices, rather than being in the dark.

PeterisP 7y ago

Because the "bad guys" already know about the vulnerability, so there's no benefit from keeping it secret but a duty to the consumers to inform them as well - especially since the kernel patch already exists.

mehrdadn 7y ago
How many consumers across the world would actually be at risk from NSO having details of the exploit vs. all the other "bad guys" though? Isn't there a significant distinction that's being brushed under the rug here?
- detaro 7y ago
  > How many consumers across the world would actually be at risk… We don't know, because we don't know who bought it and how widespread they deployed it.
  - mehrdadn 7y ago
    Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?
    - sp332 7y ago
      Sure, just model the relative probability that each hacking group will find a vulnerability. For a simple example, let's just say there are 5 organizations in the world that are equally good as NSO. So the odds that NSO were the first to find this one are 20%. In reality I think the odds would be quite a bit worse.
    - detaro 7y ago
      I don't know - I can't, maybe Google/other researchers can. But true, my comment was a bit needlessly glib. It also seems like you could discover the bug from public sources - it had been created and fixed in the kernel. Apparently at the time not registered as a security issue, but review could discover the link and check for Android's not having the fix. In the case of Android, "just tell the vendor" is also kind of awkward: There's dozens, if not hundreds of those. If there's an active threat, it's kind of hard to justify not to inform all of them, but could you trust an embargo over so many parties?

mathisonturing 7y ago

You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content." I guess it informs us what not to do at the very least. Given the track record, I'm not very optimistic of the vendors pushing a patch very soon (if ever). This keeps us informed at least.

mehrdadn 7y ago
> You have to "install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content." They can easily give that^ information without exposing details of the bug though?
asdfasgasdgasdg 7y ago
Or the attacked surface has to be exposed to the browser sandbox, which apparently this one is, per: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19...