4 ms·

Bear in mind that this is just something casting a wide net by using the android marketplace. There's enough bugs and 0day floating around in webkit as well as

by iuguy 16y ago

Bear in mind that this is just something casting a wide net by using the android marketplace. There's enough bugs and 0day floating around in webkit as well as unpatched exploit code to take on Safari, the Android browser and Chrome at the moment. From a mail over the weekend about a pentesting exploit kit we subscribe to: This release introduces two new exploits for the webkit CSS rule deletion vulnerability. Use safari_parentstylesheet to exploit all those pesky OSX machines (fully up to date and patched) and android_parentstylesheet for anything running android 2.2 and below. Moreover, using android_hotplug you can further escalate your privileges to root. Being offsensive has never been so good! ==New Modules== o safari_parentstylesheet (Safari <= 5.0.3 64bit webkit css rule deletion vulnerability) o android_parentstylesheet (Android <= 2.2 webkit css rule deletion vulnerability) o android_hotplug (Android privilege escalation vulnerability) That's just one pentesting tool we use and that's a legitimate toolkit. Malware targeting webkit in general is on the increase, with various payloads for safari, chrome, osx, ios and android. It's still the minority by far, but it is growing. Heck, even Metasploit's getting in on the game (http://blog.metasploit.com/2011/01/mobile-device-security-and-android-file.html http://blog.metasploit.com/2011/01/mobile-device-security-an...). Incidentally if you want to see a video of the safari bug in action, you can download one from http://partners.immunityinc.com/movies/Lightning_Demo_Safari01.zip http://partners.immunityinc.com/movies/Lightning_Demo_Safari... There's also one on owning android at http://partners.immunityinc.com/movies/Lightning_Demo_Android.zip http://partners.immunityinc.com/movies/Lightning_Demo_Androi...

mrcharles 16y ago
I'm not sure after your paranoia inducing post anyone is going to download zip files from links you provide. Are these videos somewhere on the web in viewable form?
- iuguy 16y ago
  If you watch the android video you'll see that a link will do the trick, not even a download. So it makes no difference really - either you trust the link or you don't. Scary, huh? I'm not aware of these vids being anywhere else but they are from the guys who make the aforementioned framework.
butterfi 16y ago
Browsers on my desktop won't be running up phone charges, which I think is an important distinction. Malware can now rip me off directly.
- iuguy 16y ago
  Malware has been able to do this for some time. Back in 2004 I (and many others, all independently) identified that some mobile phones (for me, most notably my beloved Nokia 6310) had a hidden bluetooth AT profile that supported unauthenticated connections. It was quite simple to connect to and gave you effective access to a modem Hayes AT-style interface with mobile phone extensions, allowing you to download or modify address books, connect to the internet using their phone or even make phone calls. The key thing is the monetisation. Just as with all the startups on HN, without monetisation you're effectively dealing in experimentation. With a monetisation route it all becomes worthwhile. Presumably the people who did this have some form of perceived monetisation route for the data they stole, otherwise they wouldn't have done it on quite that scale.
  - butterfi 16y ago
    I wasn't trying to say phone malware didn't exist, my point was more that comparing the latest trends in Android exploits to browser exploits didn't really match up. I could have done a better job of saying that.
    - iuguy 16y ago
      No worries, it's always easy to misinterpret text. Until recently there's not been a large amount of malware seen in the wild. A lot of the growth in mobile malware seems to be down to the following factors: 1) Increase in adoption of smartphones, most notably Android and iPhone 2) The general lack of, or poor abilities of software to detect intrusions on said devices 3) The lack of regular updates while relying upon skimmed down versions of major desktop apps and OSes (most notably that you can target android and iphone with the same bug, as shown earlier followed by a clear kernel bug escalation path) 4) The introduction of mobile malware into open source, commercial and blackhat exploit packs. 5) The transferability of monetisation strategies for malicious desktop compromise to the mobile market. I'm sure I've missed more, but they're the main ones. 5 is the motivating factor, 4,3 and 2 make it easier and 1 unfortunately believe that we're approaching an unexpected variant in Dan Geer's monopoly hypothesis (see http://cryptome.info/0001/cyberinsecurity.htm http://cryptome.info/0001/cyberinsecurity.htm for details) - and that a duopoly with shared (flawed) code doesn't appear to be much better than a monopoly. Incidentally that stylesheet bug affects browsers across all main platforms and architectures, across pretty much every class of device (phone, netbook, laptop, desktop, workstation, server on windows, linux, osx, *bsd, Solaris, iOS, Android running on x86, x86_64, ARM and SPARC). If that's not a sign of bad things to come, then I'm not quite sure what is.
nl 16y ago
The Chrome sandbox protects pretty well against that kind of exploit. I bet $20K [1] that won't own Chrome. Also, I think Android 2.3.3 patches the webkit bug - there was a similar problem that held up the release somewhat. (Obviously that shouldn't understate the danger of that exploit against Safari or the Android browser) [1] of Google's money: http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011 http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
- iuguy 16y ago
  The Sandbox makes things harder, but it's not infallible and has been bypassed before. For a pretty good walkthrough of the source (with links to even better more in-depth walkthroughs) have a look here: http://www.breakingpointsystems.com/community/blog/chrome-sandbox/ http://www.breakingpointsystems.com/community/blog/chrome-sa...
  - nl 16y ago
    Of course the sandbox isn't failsafe, but it's pretty decent. I don't think there have been any remotely exploitable holes found in it yet, have they? (Thats a good link, and links to some security bugs found in the sandbox. But I don't think any of those have ever had a live remote exploit)

by iuguy 16y ago

mrcharles 16y ago

I'm not sure after your paranoia inducing post anyone is going to download zip files from links you provide. Are these videos somewhere on the web in viewable form?

iuguy 16y ago
If you watch the android video you'll see that a link will do the trick, not even a download. So it makes no difference really - either you trust the link or you don't. Scary, huh? I'm not aware of these vids being anywhere else but they are from the guys who make the aforementioned framework.

butterfi 16y ago

Browsers on my desktop won't be running up phone charges, which I think is an important distinction. Malware can now rip me off directly.

iuguy 16y ago
Malware has been able to do this for some time. Back in 2004 I (and many others, all independently) identified that some mobile phones (for me, most notably my beloved Nokia 6310) had a hidden bluetooth AT profile that supported unauthenticated connections. It was quite simple to connect to and gave you effective access to a modem Hayes AT-style interface with mobile phone extensions, allowing you to download or modify address books, connect to the internet using their phone or even make phone calls. The key thing is the monetisation. Just as with all the startups on HN, without monetisation you're effectively dealing in experimentation. With a monetisation route it all becomes worthwhile. Presumably the people who did this have some form of perceived monetisation route for the data they stole, otherwise they wouldn't have done it on quite that scale.
- butterfi 16y ago
  I wasn't trying to say phone malware didn't exist, my point was more that comparing the latest trends in Android exploits to browser exploits didn't really match up. I could have done a better job of saying that.
  - iuguy 16y ago
    No worries, it's always easy to misinterpret text. Until recently there's not been a large amount of malware seen in the wild. A lot of the growth in mobile malware seems to be down to the following factors: 1) Increase in adoption of smartphones, most notably Android and iPhone 2) The general lack of, or poor abilities of software to detect intrusions on said devices 3) The lack of regular updates while relying upon skimmed down versions of major desktop apps and OSes (most notably that you can target android and iphone with the same bug, as shown earlier followed by a clear kernel bug escalation path) 4) The introduction of mobile malware into open source, commercial and blackhat exploit packs. 5) The transferability of monetisation strategies for malicious desktop compromise to the mobile market. I'm sure I've missed more, but they're the main ones. 5 is the motivating factor, 4,3 and 2 make it easier and 1 unfortunately believe that we're approaching an unexpected variant in Dan Geer's monopoly hypothesis (see http://cryptome.info/0001/cyberinsecurity.htm http://cryptome.info/0001/cyberinsecurity.htm for details) - and that a duopoly with shared (flawed) code doesn't appear to be much better than a monopoly. Incidentally that stylesheet bug affects browsers across all main platforms and architectures, across pretty much every class of device (phone, netbook, laptop, desktop, workstation, server on windows, linux, osx, *bsd, Solaris, iOS, Android running on x86, x86_64, ARM and SPARC). If that's not a sign of bad things to come, then I'm not quite sure what is.

nl 16y ago

The Chrome sandbox protects pretty well against that kind of exploit. I bet $20K [1] that won't own Chrome. Also, I think Android 2.3.3 patches the webkit bug - there was a similar problem that held up the release somewhat. (Obviously that shouldn't understate the danger of that exploit against Safari or the Android browser) [1] of Google's money: http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011 http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011

iuguy 16y ago
The Sandbox makes things harder, but it's not infallible and has been bypassed before. For a pretty good walkthrough of the source (with links to even better more in-depth walkthroughs) have a look here: http://www.breakingpointsystems.com/community/blog/chrome-sandbox/ http://www.breakingpointsystems.com/community/blog/chrome-sa...
- nl 16y ago
  Of course the sandbox isn't failsafe, but it's pretty decent. I don't think there have been any remotely exploitable holes found in it yet, have they? (Thats a good link, and links to some security bugs found in the sandbox. But I don't think any of those have ever had a live remote exploit)