6 ms·

Samsung Phones: Every app has full memory access

87 points by itry 14y ago

Any app has full memory access via /dev/exynos-mem Largest security hole ever?

drivebyacct2 14y ago
How was this even posted? It's the exact same link as yesterday in addition to the other link about this yesterday. Ah, I see the original has an anchor in the URL: http://news.ycombinator.com/item?id=4928277 http://news.ycombinator.com/item?id=4928277
- japaget 14y ago
  The title on this post is clearer. I have heard of Samsung phones (and Android), but I didn't know what Exynos was so I skipped over the initial link.
JimmaDaRustla 14y ago
Now all I can think of is #droidrage
- mtgx 14y ago
  Oh yeah, Microsoft's vitriolic campaign against Android. But this is not about Android per se, but about Samsung's drivers for the camera, and giving camera full access to root, because they were lazy.
  - mikeash 14y ago
    I'm conflicted. On one hand, this is definitely Samsung's fault, not Android in general. On the other hand, an OS with more rigorous requirements for OEMs could have prevented this.
    - mdwrigh2 14y ago
      I'm curious what requirement you think would prevent this.
      - cube13 14y ago
        Apple's approach(no OEMs at all, known hardware) would mitigate the problem somewhat. But that doesn't stop lazy idiots from screwing up at Apple, and it doesn't work for anyone that's providing a general-purpose OS. That's really about it. This is a kernel-level driver issue, caused by a lazy Samsung coder. Unfortunately, the drivers need that level of access, since they're used by Android to actually work. I'd say normal *nix kernel security practices should apply here, but that still doesn't stop lazy idiots...
        mdwrigh2 14y ago
        So the "more rigorous requirements for OEMs" is "no OEMs at all"? Seems a little like throwing the baby out with the bathwater. Besides, part of the point of Android is having an OS which allows for companies like Samsung to build their own variants. Also, the problem isn't unknown hardware (as you would suggest by saying they should use "known hardware"). If it was an issue where they unknowingly left the hardware in some strange debugging state so that userland could query the it for restricted information, then it would be an issue with unknown hardware. In this case they directly and intentionally provided unprotected access to all of memory. That's just bad engineering.
        cube13 14y ago
        >Also, the problem isn't unknown hardware (as you would suggest by saying they should use "known hardware"). No, the failure point here is, essentially, unknown hardware from Google's perspective. Android is not coded to work specifically with Samsung's configurations or hardware, so Samsung needs to provide drivers. As for "more rigorous" requirements, I don't think it's too hard to have the requirement that all drivers follow standard *nix security practices. That would have stopped this completely. So the solution is to either not allow custom OEM builds(which, as I noted, isn't possible for Android).
    - JimmaDaRustla 14y ago
      Don't operating systems, like windows, have a secure memory space that only the core OS can access? Memory access violation? Edit: I don't understand the complete issue, I just know there was something about accessing all the memory.
berntb 14y ago
As an Android newbie -- how easy is it to get out kernel patches to [all these millions of users'] phones? (No, I'm not a black hat -- I don't have a hat of any colour.)
- engtech 14y ago
  My carrier phone in Canada finally updated to Jelly Bean 4.1 last night. My dad has the same phone bought the same day and he's still on the pending list to get the update... so, not fast?
- ricardobeat 14y ago
  Not easy. Most carriers delay updates, sometimes by years, because of all the custom crap they layer on top, or for no reason at all.
itry 14y ago
Looks like on Samsung devices, every app has full r/w memory acess via /dev/exynos-mem I wonder two things: 1) if this is Samsung only or if its an Android issue. 2) If and how this can bee used to become root. TFA says "The good news is we can easily obtain root on these devices" but doesnt say how.
deleted 14y ago
[deleted]
thefreeman 14y ago
http://news.ycombinator.com/item?id=4928277 http://news.ycombinator.com/item?id=4928277
deleted 14y ago
[deleted]
stusmall 14y ago
I currently have an S3 and this isn't the first serious exploit I've come across for it. Does anyone have any suggestions for a serious secure phone? I don't need all the bells and whistles and don't install many apps. Mostly just email, text, and web browsing.
- alexmunroe 14y ago
  As unpopular a suggestion as this may be, Blackberry's are very secure particularly if you enable some of the more advanced security features such as secure memory and full device encryption. A lot of research has been undertaken at my University into this recently and very little progress has been made. The obvious downside is that the App eco system is still very poor compared to both iOS and Android and the UI leaves a lot to be desired. It depends really on whether you favour security over usability.
- driverdan 14y ago
  This is only a serious exploit if you install an app that exploits it. If you only use email, SMS/text and web browsing and don't install any apps you should be fine. If you want a more secure Android phone get Google's (currently Nexus 4). It won't have all the BS that 3rd parties add, like this.
  - fulafel 14y ago
    It's a break from the sandbox so any vulnerability in an app (eg outdated WebKit, the norm on non-google devices) now compromised your whole device.
  - stusmall 14y ago
    This is just one on the list of a few I've seen. There was also the infamous remote execution of USSD codes and another major exploit via the document reader(If I remember correctly some people where hyping that as an NFC attck). I understand bugs and exploits happen, but this proc interface and the USSD attack were just silly. I'd just like something designed inside a culture of security.
- ricardobeat 14y ago
chenster 14y ago
With so many Samsung Android phones (http://en.wikipedia.org/wiki/Comparison_of_Android_devices#Samsung http://en.wikipedia.org/wiki/Comparison_of_Android_devices#S...) flooding out to stay competitive and get a quick win over the iOS as well as other manufacturer's Android devices, it's obvious that some of their stuffs will eventually fall through the crack as result of poor QA. I will not be too surprised to see other brand Android phones have similar security issues. I can almost see that Android is quickly becoming the next Windows 95.
lostlogin 14y ago
Is anyone else finding that thread full of Google adverts for Samsung phones? It's rather funny.

87 points by itry 14y ago

Any app has full memory access via /dev/exynos-mem Largest security hole ever?

How was this even posted? It's the exact same link as yesterday in addition to the other link about this yesterday. Ah, I see the original has an anchor in the URL: http://news.ycombinator.com/item?id=4928277 http://news.ycombinator.com/item?id=4928277

japaget 14y ago
The title on this post is clearer. I have heard of Samsung phones (and Android), but I didn't know what Exynos was so I skipped over the initial link.

JimmaDaRustla 14y ago

Now all I can think of is #droidrage

mtgx 14y ago
Oh yeah, Microsoft's vitriolic campaign against Android. But this is not about Android per se, but about Samsung's drivers for the camera, and giving camera full access to root, because they were lazy.
- mikeash 14y ago
  I'm conflicted. On one hand, this is definitely Samsung's fault, not Android in general. On the other hand, an OS with more rigorous requirements for OEMs could have prevented this.
  - mdwrigh2 14y ago
    I'm curious what requirement you think would prevent this.
    - cube13 14y ago
      Apple's approach(no OEMs at all, known hardware) would mitigate the problem somewhat. But that doesn't stop lazy idiots from screwing up at Apple, and it doesn't work for anyone that's providing a general-purpose OS. That's really about it. This is a kernel-level driver issue, caused by a lazy Samsung coder. Unfortunately, the drivers need that level of access, since they're used by Android to actually work. I'd say normal *nix kernel security practices should apply here, but that still doesn't stop lazy idiots...
      - mdwrigh2 14y ago
        So the "more rigorous requirements for OEMs" is "no OEMs at all"? Seems a little like throwing the baby out with the bathwater. Besides, part of the point of Android is having an OS which allows for companies like Samsung to build their own variants. Also, the problem isn't unknown hardware (as you would suggest by saying they should use "known hardware"). If it was an issue where they unknowingly left the hardware in some strange debugging state so that userland could query the it for restricted information, then it would be an issue with unknown hardware. In this case they directly and intentionally provided unprotected access to all of memory. That's just bad engineering.
        cube13 14y ago
        >Also, the problem isn't unknown hardware (as you would suggest by saying they should use "known hardware"). No, the failure point here is, essentially, unknown hardware from Google's perspective. Android is not coded to work specifically with Samsung's configurations or hardware, so Samsung needs to provide drivers. As for "more rigorous" requirements, I don't think it's too hard to have the requirement that all drivers follow standard *nix security practices. That would have stopped this completely. So the solution is to either not allow custom OEM builds(which, as I noted, isn't possible for Android).
  - JimmaDaRustla 14y ago
    Don't operating systems, like windows, have a secure memory space that only the core OS can access? Memory access violation? Edit: I don't understand the complete issue, I just know there was something about accessing all the memory.

berntb 14y ago

As an Android newbie -- how easy is it to get out kernel patches to [all these millions of users'] phones? (No, I'm not a black hat -- I don't have a hat of any colour.)

engtech 14y ago
My carrier phone in Canada finally updated to Jelly Bean 4.1 last night. My dad has the same phone bought the same day and he's still on the pending list to get the update... so, not fast?
ricardobeat 14y ago
Not easy. Most carriers delay updates, sometimes by years, because of all the custom crap they layer on top, or for no reason at all.

itry 14y ago

Looks like on Samsung devices, every app has full r/w memory acess via /dev/exynos-mem I wonder two things: 1) if this is Samsung only or if its an Android issue. 2) If and how this can bee used to become root. TFA says "The good news is we can easily obtain root on these devices" but doesnt say how.

deleted 14y ago

[deleted]

thefreeman 14y ago

http://news.ycombinator.com/item?id=4928277 http://news.ycombinator.com/item?id=4928277

deleted 14y ago

[deleted]

stusmall 14y ago

I currently have an S3 and this isn't the first serious exploit I've come across for it. Does anyone have any suggestions for a serious secure phone? I don't need all the bells and whistles and don't install many apps. Mostly just email, text, and web browsing.

alexmunroe 14y ago
As unpopular a suggestion as this may be, Blackberry's are very secure particularly if you enable some of the more advanced security features such as secure memory and full device encryption. A lot of research has been undertaken at my University into this recently and very little progress has been made. The obvious downside is that the App eco system is still very poor compared to both iOS and Android and the UI leaves a lot to be desired. It depends really on whether you favour security over usability.
driverdan 14y ago
This is only a serious exploit if you install an app that exploits it. If you only use email, SMS/text and web browsing and don't install any apps you should be fine. If you want a more secure Android phone get Google's (currently Nexus 4). It won't have all the BS that 3rd parties add, like this.
- fulafel 14y ago
  It's a break from the sandbox so any vulnerability in an app (eg outdated WebKit, the norm on non-google devices) now compromised your whole device.
- stusmall 14y ago
  This is just one on the list of a few I've seen. There was also the infamous remote execution of USSD codes and another major exploit via the document reader(If I remember correctly some people where hyping that as an NFC attck). I understand bugs and exploits happen, but this proc interface and the USSD attack were just silly. I'd just like something designed inside a culture of security.
ricardobeat 14y ago

chenster 14y ago

With so many Samsung Android phones (http://en.wikipedia.org/wiki/Comparison_of_Android_devices#Samsung http://en.wikipedia.org/wiki/Comparison_of_Android_devices#S...) flooding out to stay competitive and get a quick win over the iOS as well as other manufacturer's Android devices, it's obvious that some of their stuffs will eventually fall through the crack as result of poor QA. I will not be too surprised to see other brand Android phones have similar security issues. I can almost see that Android is quickly becoming the next Windows 95.

lostlogin 14y ago

Is anyone else finding that thread full of Google adverts for Samsung phones? It's rather funny.