13 ms·

An Android 8.0-9.0 Bluetooth Zero-Click RCE

139 points by faebi 6y ago

baybal2 6y ago
A do remember an "SMS storm" for Sony ericsson A200 from 15 years ago. You get a garbled binary SMS, and then the virus resends itself to every number in your phonebook.
- technoplato 6y ago
  What was the end goal of the virus?
  - CraneWorm 6y ago
    To flatten its curve.
  - baybal2 6y ago
    It got filtered by cellphone companies
  - kalleboo 6y ago
    Before monetization through bitcoin was easy, viruses were usually made and released just because you could. To experiment and see how far it could spread. And maybe just to wreak havoc and troll people. https://techgaming.pk/2015/09/07/the-most-dangerous-mac-viruses/ https://techgaming.pk/2015/09/07/the-most-dangerous-mac-viru... > This virus first appeared in 1988 on earlier versions of Mac OS. Initially, the program displayed a message about Michael Dukakis (Democratic presidential candidate): > I was created by mischievous 14 year old, and am completely harmless. Dukakis for president in ’88.
    - technoplato 6y ago
      That’s awesome, thanks for sharing. I assume via BTC or any crypto, it’s just a matter of running a “miniminer” of some sort across all effected machines?
NotSammyHagar 6y ago
I really hate this software world where my phone stack is generally hidden away from my ability to fix it or change it. It's true for both apple and android generally, even if I can see some pieces of android in the public sources it's basically impossible to change out alot of the inner stack. I know there are endless attempts to let us have control over our phones. But we programmers are never the customers. And the vendors never open source their drivers. The various open software/hardware schemes never seem to reach maturity. Is there any hope here?
- the_pwner224 6y ago
  The two big projects working on this are the Purism Librem 5 and the PinePhone, both run stock Linux with no binary blobs aside from an isolated cellular modem. The Librem 5 has been delayed for years and the behaviour of the company is kind of sketchy, however going by Purism's videos the software is pretty good and getting better rapidly (and they upstream their changes back to Gnome). The PinePhone has shipped to some developers and the company has a history of actually making functional products, but the software is still a WIP, and Pine64's products are cheap (which is great for many people, but I would rather have a $400 phone than a <$150 phone, especially given that these ones won't suffer from software obsolescence). I can't wait for these things to become at least somewhat functional - I personally will be buying one as soon as they get phone calling, SMS, and a web browser (the Librem has them, and other Gnome applications, but it's still in preorder). Pinephone: https://www.pine64.org/pinephone/ https://www.pine64.org/pinephone/ - https://news.ycombinator.com/item?id=21824962 https://news.ycombinator.com/item?id=21824962 Librem 5: https://puri.sm/products/librem-5/ https://puri.sm/products/librem-5/ - https://news.ycombinator.com/item?id=21369733 https://news.ycombinator.com/item?id=21369733 - https://news.ycombinator.com/item?id=21303770 https://news.ycombinator.com/item?id=21303770 - https://puri.sm/posts/librem-5-vs-android-which-boots-faster/ https://puri.sm/posts/librem-5-vs-android-which-boots-faster... (stupid comparison vs a 6 year old Android phone - how out of touch is their marketing team and CEO to allow this to happen???)
  - hellcow 6y ago
    That "stupid comparison" shows their phone booting in 13s. I just timed my Pixel 3 and it boots in the same time. That's really impressive any way you slice it.
morsch 6y ago
Fixed in https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf https://android.googlesource.com/platform/system/bt/+/3cb714... of https://source.android.com/security/bulletin/2020-02-01 https://source.android.com/security/bulletin/2020-02-01: - packet->len = partial_packet->len - partial_packet->offset; + packet->len = + (partial_packet->len - partial_packet->offset) + packet->offset; I wonder how many devices are running that patch level.
- GekkePrutser 6y ago
  Strange that the commit is from 2018 but it was only included in the patch level of February 5? At least Samsung is pretty good about updating patches. Not android versions, no, but at least I still get monthly patches. My S8 already has this one.
  - morsch 6y ago
    It's not from 2018 -- Thu Apr 18 17:13:49 2019 -- the 18 may have tripped you up, it's the day of month. It's still a year old, though. It's a cherry-pick (a copy of a commit from related code base, essentially) of this commit, https://android.googlesource.com/platform/system/bt/+/337bd4579453bd6bf98ff519de3ac1019cd30d28%5E%21/ https://android.googlesource.com/platform/system/bt/+/337bd4.... The bug has a different impact in Android 10 (DOS instead of RCE), which was relased in Septemer 2019. So maybe they sort of fixed it in Android 10 and somehow forgot the backport? I'm speculating.
  - realusername 6y ago
    Depends which Samsung you have, my last Samsung update was on the 4th of January. Support for their non-flagship devices isn't great.
- kuschku 6y ago
  My Google Pixel 1 isn’t running this patch level, because Google dropped support for it entirely. Which just sucks, because there’s no reason not to support it anymore, it’s just planned obsolescence.
xkapastel 6y ago
So uh, as someone stuck on Android 8 forever, what am I supposed to do? Just get a new phone?
- robocat 6y ago
  Disable Bluetooth. Use a cabled connection if you need headphones/mic. If you need Bluetooth then check whether your phone has the same Broadcom driver - you might be fine depending on hardware. Or check if you can install open source firmware that includes a fixed driver. There are other things you can do depending on device.
  - numpad0 6y ago
    How would one disable Bluetooth?
    - samoa42 6y ago
      apple makes it kind of hard; three taps vs. android one swipe and one tap or are you implying it cannot be disabled b/c it is needed?
      - danieldk 6y ago
        I am not sure how that is relevant, since this is about a current Android vulnerability. But it's less of a problem in iOS anyway, because Apple provides updates for iPhones much longer. They are still releasing security updates for the iPhone 5s and 6, which are from 2013 and 2014 respectively. https://en.wikipedia.org/wiki/IOS_12#12.4.6 https://en.wikipedia.org/wiki/IOS_12#12.4.6
      - numpad0 6y ago
        I heard it’s equally hard on Android
iszomer 6y ago
Seems like every time there's a new mobile RCE they compel us to buy new phones. And for average person who don't, they'll compound the problem with system level contact tracing. I give up on technology.
- jokowueu 6y ago
  Just give up on smart phones . iPhones though on the other hand will get updates for about 5 years which is decent
  - pjmlp 6y ago
    A security crazy person also cannot make use of feature phones as they are already smart enough with networking capabilities. So it is back to rotary phones and public booth.
- lucb1e 6y ago
  COVID-19 tracing is an entirely different problem from buying a new phone because you don't get updates. And if you want control over what your phone sends to the mothership, you need to actually take control and either install a different OS or root it, that is not new with COVID-19 and also not a planned obsolesce / buy new phone thing.
pjmlp 6y ago
Yet another typical C exploit. No wonder that Android 11 will require hardware memory tagging and is now introducing GWP-ASan for the devices without it.

139 points by faebi 6y ago

A do remember an "SMS storm" for Sony ericsson A200 from 15 years ago. You get a garbled binary SMS, and then the virus resends itself to every number in your phonebook.

technoplato 6y ago
What was the end goal of the virus?
- CraneWorm 6y ago
  To flatten its curve.
- baybal2 6y ago
  It got filtered by cellphone companies
- kalleboo 6y ago
  Before monetization through bitcoin was easy, viruses were usually made and released just because you could. To experiment and see how far it could spread. And maybe just to wreak havoc and troll people. https://techgaming.pk/2015/09/07/the-most-dangerous-mac-viruses/ https://techgaming.pk/2015/09/07/the-most-dangerous-mac-viru... > This virus first appeared in 1988 on earlier versions of Mac OS. Initially, the program displayed a message about Michael Dukakis (Democratic presidential candidate): > I was created by mischievous 14 year old, and am completely harmless. Dukakis for president in ’88.
  - technoplato 6y ago
    That’s awesome, thanks for sharing. I assume via BTC or any crypto, it’s just a matter of running a “miniminer” of some sort across all effected machines?

NotSammyHagar 6y ago

I really hate this software world where my phone stack is generally hidden away from my ability to fix it or change it. It's true for both apple and android generally, even if I can see some pieces of android in the public sources it's basically impossible to change out alot of the inner stack. I know there are endless attempts to let us have control over our phones. But we programmers are never the customers. And the vendors never open source their drivers. The various open software/hardware schemes never seem to reach maturity. Is there any hope here?

the_pwner224 6y ago
The two big projects working on this are the Purism Librem 5 and the PinePhone, both run stock Linux with no binary blobs aside from an isolated cellular modem. The Librem 5 has been delayed for years and the behaviour of the company is kind of sketchy, however going by Purism's videos the software is pretty good and getting better rapidly (and they upstream their changes back to Gnome). The PinePhone has shipped to some developers and the company has a history of actually making functional products, but the software is still a WIP, and Pine64's products are cheap (which is great for many people, but I would rather have a $400 phone than a <$150 phone, especially given that these ones won't suffer from software obsolescence). I can't wait for these things to become at least somewhat functional - I personally will be buying one as soon as they get phone calling, SMS, and a web browser (the Librem has them, and other Gnome applications, but it's still in preorder). Pinephone: https://www.pine64.org/pinephone/ https://www.pine64.org/pinephone/ - https://news.ycombinator.com/item?id=21824962 https://news.ycombinator.com/item?id=21824962 Librem 5: https://puri.sm/products/librem-5/ https://puri.sm/products/librem-5/ - https://news.ycombinator.com/item?id=21369733 https://news.ycombinator.com/item?id=21369733 - https://news.ycombinator.com/item?id=21303770 https://news.ycombinator.com/item?id=21303770 - https://puri.sm/posts/librem-5-vs-android-which-boots-faster/ https://puri.sm/posts/librem-5-vs-android-which-boots-faster... (stupid comparison vs a 6 year old Android phone - how out of touch is their marketing team and CEO to allow this to happen???)
- hellcow 6y ago
  That "stupid comparison" shows their phone booting in 13s. I just timed my Pixel 3 and it boots in the same time. That's really impressive any way you slice it.

morsch 6y ago

Fixed in https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf https://android.googlesource.com/platform/system/bt/+/3cb714... of https://source.android.com/security/bulletin/2020-02-01 https://source.android.com/security/bulletin/2020-02-01: - packet->len = partial_packet->len - partial_packet->offset; + packet->len = + (partial_packet->len - partial_packet->offset) + packet->offset; I wonder how many devices are running that patch level.

GekkePrutser 6y ago
Strange that the commit is from 2018 but it was only included in the patch level of February 5? At least Samsung is pretty good about updating patches. Not android versions, no, but at least I still get monthly patches. My S8 already has this one.
- morsch 6y ago
  It's not from 2018 -- Thu Apr 18 17:13:49 2019 -- the 18 may have tripped you up, it's the day of month. It's still a year old, though. It's a cherry-pick (a copy of a commit from related code base, essentially) of this commit, https://android.googlesource.com/platform/system/bt/+/337bd4579453bd6bf98ff519de3ac1019cd30d28%5E%21/ https://android.googlesource.com/platform/system/bt/+/337bd4.... The bug has a different impact in Android 10 (DOS instead of RCE), which was relased in Septemer 2019. So maybe they sort of fixed it in Android 10 and somehow forgot the backport? I'm speculating.
- realusername 6y ago
  Depends which Samsung you have, my last Samsung update was on the 4th of January. Support for their non-flagship devices isn't great.
kuschku 6y ago
My Google Pixel 1 isn’t running this patch level, because Google dropped support for it entirely. Which just sucks, because there’s no reason not to support it anymore, it’s just planned obsolescence.

xkapastel 6y ago

So uh, as someone stuck on Android 8 forever, what am I supposed to do? Just get a new phone?

robocat 6y ago
Disable Bluetooth. Use a cabled connection if you need headphones/mic. If you need Bluetooth then check whether your phone has the same Broadcom driver - you might be fine depending on hardware. Or check if you can install open source firmware that includes a fixed driver. There are other things you can do depending on device.
- numpad0 6y ago
  How would one disable Bluetooth?
  - samoa42 6y ago
    apple makes it kind of hard; three taps vs. android one swipe and one tap or are you implying it cannot be disabled b/c it is needed?
    - danieldk 6y ago
      I am not sure how that is relevant, since this is about a current Android vulnerability. But it's less of a problem in iOS anyway, because Apple provides updates for iPhones much longer. They are still releasing security updates for the iPhone 5s and 6, which are from 2013 and 2014 respectively. https://en.wikipedia.org/wiki/IOS_12#12.4.6 https://en.wikipedia.org/wiki/IOS_12#12.4.6
    - numpad0 6y ago
      I heard it’s equally hard on Android

iszomer 6y ago

Seems like every time there's a new mobile RCE they compel us to buy new phones. And for average person who don't, they'll compound the problem with system level contact tracing. I give up on technology.

jokowueu 6y ago
Just give up on smart phones . iPhones though on the other hand will get updates for about 5 years which is decent
- pjmlp 6y ago
  A security crazy person also cannot make use of feature phones as they are already smart enough with networking capabilities. So it is back to rotary phones and public booth.
lucb1e 6y ago
COVID-19 tracing is an entirely different problem from buying a new phone because you don't get updates. And if you want control over what your phone sends to the mothership, you need to actually take control and either install a different OS or root it, that is not new with COVID-19 and also not a planned obsolesce / buy new phone thing.

pjmlp 6y ago

Yet another typical C exploit. No wonder that Android 11 will require hardware memory tagging and is now introducing GWP-ASan for the devices without it.