3 ms·

Cellebrite zero-day exploit targeting Android USB kernel drivers identified

• ChrisArchitect 2y ago
  Title is: Cellebrite zero-day exploit used to target phone of Serbian student activist
  • walterbell 2y ago
    Instead of clickbait (which phone? iOS? Android?) title cited, HN submission used more informative text from the article: Zero-day exploit targeting Android USB kernel drivers identified in-the-wild
• magicalhippo 2y ago
  The attack involves the connection of various USB peripherals. [...] The quirk, or non-standard coded path to handle this USB device was introduced in 2010, almost 15 years ago. [...] The code for this device was introduced 11 years ago. [...] The relevant quirk code for this device was introduced into the Linux kernel almost 14 years ago. [...] This USB exploit chain shows the long-tail risk of non-memory-safe Linux kernel code, particular the large amount of device driver code introduced to handle a range of non-standards compliant USB devices. Recent efforts to introduce memory-safe languages such as Rust in the Linux kernel provide a promising option to reduce such security issues in newly written device drivers. Thought this was particularly relevant given the recent Rust for Linux drama[1][2]. [1]: https://news.ycombinator.com/item?id=42972062 https://news.ycombinator.com/item?id=42972062 [2]: https://news.ycombinator.com/item?id=43138830 https://news.ycombinator.com/item?id=43138830