7 ms·

> However, if you install an application from an untrusted source, attackers can take advantage of that. I'm slightly confused: Do they mean any app or a compr

> However, if you install an application from an untrusted source, attackers can take advantage of that. I'm slightly confused: Do they mean any app or a compromised app?

sp332 7y ago
A compromised app. The vulnerability requires local code execution, so either an app you install and run, or a malicious webpage that somehow breaks out of the browser sandbox, or... loading a specially constructed video file in a vulnerable version of VLC, or something. Basically you need to combine this with some other vulnerability or convince the user to just straight up run the code.
- klingonopera 7y ago
  Thanks, the ambiguous wording from the article suggested to me that a vulnerability in the system code used for installing from an untrusted source may be used by the exploit.
- tmd83 7y ago
  What wasn't clear was that is there a known browser sandboxing vulnerability at this point that can be used to get root or the idea is that if someone has one they could use this one to get root. Can I use Chrome in my Android phone now or cannot?
  - Thorrez 7y ago
    Generally to exploit an OS from within Chrome you need 2 vulnerabilities: (1) to break out from javascript into machine code execution within the sandbox, (2) to break out of the sandbox into the general OS (and maybe (3) to then get root on the OS). From my reading of this comment[1], it sounds like this vulnerability is such that if an attacker has vulnerability (1), this vulnerability can be used as vulnerability (2) and (3). It sounds like NSO group either had or has a separate vulnerability (1), possibly something from [2]. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... [2] https://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 https://www.cvedetails.com/product/15031/Google-Chrome.html?...
zmmmmm 7y ago
Yes, it's frustrating when people casually conflate using any alternative source of apps than official app stores with actual malicious application sources. The reality is, you don't need to "trust" the source in general, you just need to trust that the source is not malicious. If the source is untrusted but you have faith it is not malicious then you can rely on Android's built in permissions system to protect you from it exceeding the bounds of what you would like it to do. This may sound very pedantic, but the whole existence of an app ecosystem that isn't controlled by the hegemony of the 2 or 3 big app stores depends on this nuance.
- scarface74 7y ago
  Android’s built in permission system didn’t work too well with the Fortnite installer https://www.pcmag.com/news/363357/google-irks-epic-games-by-revealing-fortnite-android-flaw https://www.pcmag.com/news/363357/google-irks-epic-games-by-...
  - mercora 7y ago
    this has nothing to do with androids permission system at all... epic made the decision to distribute Fortnite themselves while bypassing the Play Store in order to save on the 30% cut google would otherwise get from game sales. This worked by installing an app manually that did download the game and installs or updates it afterwards. This installer had a serious flaw allowing malicious apps to install other software by abusing rights the installer had gained to install or update the game. You could claim google has been irresponsible for publishing technical details about this flaw in epics installer too early but it still has nothing to do with Androids permission system.
    - scarface74 7y ago
      From the article “However, on Aug. 15, a Google researcher discovered a flaw with the installer, which can let a separate app on your phone hijack what the software actually downloads.” So a separate app can hijack what another app does. That means the sandbox is broken.

> However, if you install an application from an untrusted source, attackers can take advantage of that. I'm slightly confused: Do they mean any app or a compromised app?

sp332 7y ago

A compromised app. The vulnerability requires local code execution, so either an app you install and run, or a malicious webpage that somehow breaks out of the browser sandbox, or... loading a specially constructed video file in a vulnerable version of VLC, or something. Basically you need to combine this with some other vulnerability or convince the user to just straight up run the code.

klingonopera 7y ago
Thanks, the ambiguous wording from the article suggested to me that a vulnerability in the system code used for installing from an untrusted source may be used by the exploit.
tmd83 7y ago
What wasn't clear was that is there a known browser sandboxing vulnerability at this point that can be used to get root or the idea is that if someone has one they could use this one to get root. Can I use Chrome in my Android phone now or cannot?
- Thorrez 7y ago
  Generally to exploit an OS from within Chrome you need 2 vulnerabilities: (1) to break out from javascript into machine code execution within the sandbox, (2) to break out of the sandbox into the general OS (and maybe (3) to then get root on the OS). From my reading of this comment[1], it sounds like this vulnerability is such that if an attacker has vulnerability (1), this vulnerability can be used as vulnerability (2) and (3). It sounds like NSO group either had or has a separate vulnerability (1), possibly something from [2]. [1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1942#c7 https://bugs.chromium.org/p/project-zero/issues/detail?id=19... [2] https://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 https://www.cvedetails.com/product/15031/Google-Chrome.html?...

zmmmmm 7y ago

Yes, it's frustrating when people casually conflate using any alternative source of apps than official app stores with actual malicious application sources. The reality is, you don't need to "trust" the source in general, you just need to trust that the source is not malicious. If the source is untrusted but you have faith it is not malicious then you can rely on Android's built in permissions system to protect you from it exceeding the bounds of what you would like it to do. This may sound very pedantic, but the whole existence of an app ecosystem that isn't controlled by the hegemony of the 2 or 3 big app stores depends on this nuance.

scarface74 7y ago
Android’s built in permission system didn’t work too well with the Fortnite installer https://www.pcmag.com/news/363357/google-irks-epic-games-by-revealing-fortnite-android-flaw https://www.pcmag.com/news/363357/google-irks-epic-games-by-...
- mercora 7y ago
  this has nothing to do with androids permission system at all... epic made the decision to distribute Fortnite themselves while bypassing the Play Store in order to save on the 30% cut google would otherwise get from game sales. This worked by installing an app manually that did download the game and installs or updates it afterwards. This installer had a serious flaw allowing malicious apps to install other software by abusing rights the installer had gained to install or update the game. You could claim google has been irresponsible for publishing technical details about this flaw in epics installer too early but it still has nothing to do with Androids permission system.
  - scarface74 7y ago
    From the article “However, on Aug. 15, a Google researcher discovered a flaw with the installer, which can let a separate app on your phone hijack what the software actually downloads.” So a separate app can hijack what another app does. That means the sandbox is broken.