8 ms·
Maybe I'm missing something, but I don't see this security bug could be used against a majority of people. Can someone explain to me how this exploit could be
by kyrra 13y ago
Maybe I'm missing something, but I don't see this security bug could be used against a majority of people. Can someone explain to me how this exploit could be used against people?
To me, it seems like someone would have to side-load an application. Anything coming from the Play store should be safe?
- donutdan4114 13y agoSit on an open wi-fi network that you're connected to and intercept Play Store traffic and spoof an app update, like Gmail, inject my malicious app download URL which might look exactly like the Gmail app, except my malicious version of Gmail also sends your emails to me. Then I go to paypal, forgot password, get email, gain account access, ruin your life. Not sure how plausible any of this is, I'd have to be a really dedicated hacker to set all that up. But it's all possible. Also, never ever ever EVER connect to open wi-fi.
- anigbrowl 13y agoAlso, never ever ever EVER connect to open wi-fi. Pfff. I could get mugged walking down the street too, but I still carry my wallet and keys around. And yes, I have been the target of some robbery attempts in the past.
- donutdan4114 13y agoI don't know about you, but I have a lot more sensitive information on the interwebs than what I carry on my person. Protip: I've had my paypal account hijacked before, that isn't very fun to deal with
- bigiain 13y agoI own a lot more valuable possessions than I'd walk through a sketchy area of a city late at night carrying - but that doesn't mean I wont carry my wallet/phone with me all the time. I'm happy enough using open wifi to read the news or check train times. I kinda rely on gmail "getting SSL right" so that if my mail checks while I'm doing that I'm still OK. I wouldn't log in to my internet banking or PayPal on open wifi. I know I'm leaving myself open to "forgetting" and accidentally using and open wifi connection for a sensitive transaction/login, but for me the probability of me forgetting multiplied by the probability of any particular open wifi being malicious is "low enough" that I'm happy to accept the consequences. Be aware the open wifi has risks. Take suitable precautions. Use them if it's useful - but modify your behaviour to minimise the risks. But if you just want to check the news or the weather or the bus schedule, someone saying "never connect to open wifi" is probably not giving or taking into account appropriate context.
- ordinary 13y agoMy person is sensitive.
- tripzilch 13y agodifference is, you know if you got mugged.
- anigbrowl 13y agoMaybe a better comparison would be with having my pocket picked. And yes, I do know if the digital equivalent takes place, unless the attacker has been so thorough as to also subvert my router and modem admin consoles, in which case they probably didn't need to wait for me to wander through an open wi-fi network.
- atesti 13y agoWhy wouldn't the traffic of the Play Store not be going over SSL? I never looked myself, but I'd expect it to be encrypted.
- jcl 13y agoFWIW, the Play Store web site forces you to https. I'd expect the app would as well.
- donutdan4114 13y agoI'd be curious to see what information is transferred by Android phones that is not through SSL. Given all the apps out there that have access to your personal data and could be transmitting whoknowswhat through non-ssl requests, probably enough ways to mess with someone.
- Everlag 13y agoImagine using a pineapple http://wifipineapple.com/ http://wifipineapple.com/ and sitting in a coffee shop with your laptop out messing with people's insecure traffic! The ramifications of such could be quite potent given any chance that an insecure app could allow insertion of basically any content into a http request. This is why you secure your damn wifi. Even if the password and user are on the wall, the traffic is still encrypted!
- antocv 13y agoIf you are in a coffeshop you too will likely have the passphrase to the WiFi, then you can still intercept traffic of your unsuspecting users, ARP poisoning and whatnot. So just because its WPA2 doesnt make it magically safe from tampering. And usually a coffeshop that has WPA2 will still have admin/admin as their router credentials, if you are lucky they have Linux and from there you have # and can use iptables to divert traffic to your device as you wish.
- 13y ago
- winter_blue 13y ago> Also, never ever ever EVER connect to open wi-fi. I'm kind-of forced to use a WEP connection right now, which is pretty much equivalent to open wi-fi since is can be cracked in a matter of minutes. However I use HTTPS-Everywhere, and GMail & other websites run on https by default. So my question is: is HTTPS over open wi-fi trustworthy?
- coderzach 13y agoHTTPS over open wi-fi is trustworthy.
- thirsteh 13y agoWell, only to the extent that the PKI model is trustworthy. If somebody can perform a MITM attack against you, you are wholly reliant on them not being able to generate a certificate for the domain you're looking at. It's better, but there are 650+ different companies who can sign certificates for all domains worldwide.
- tonfa 13y agoIf someone is able to do a MitM attack with a valid cert, I'd guess they have the capabilities of doing the attack upstream of the wifi. So having the wifi open or not won't matter much.
- thirsteh 13y agoI think that's an unreasonable assumption. It's far more likely that a CA is compromised than an ISP. Also, don't underestimate the power of e.g. sslstrip. Most users enter "google.com", not "https://google.com" https://google.com". If you're not careful, somebody will just remove all the SSL links on your pages, or lead you to another domain with a valid one, via DNS or HTTP redirects.
- bigiain 13y ago"It's far more likely that a CA is compromised than an ISP." I wonder if that's true? At a high enough stakes game - one would have to assume that state level actors have already trivially compromised both - the NSA clearly has pretty much 100% compliance from Verizon, and I don't think its going out on a limb to assume they've got similar compliance from at least one of (and possibly all of) the US based CAs. Egypt at a state level have been seen using fraudulent SSL certs - and you'd be foolish to assume there isn't equivalent CA access available to any government who has a root CA authority under their jurisdiction. But that's kind of a moot point - if the NSA is targeting me individually, I have to assume they'll gain access to pretty much everything - even if I strongly encrypt everything (and don't ever make a mistake doing so), many of the intended recipients of my communication are in jurisdictions where they've got enough power that wouldn't be able to resist the NSA's demands to reveal the unencrypted contents. (If they can ground head-of-states private planes in various European countries, there are probably very few places they cant "lean on" someone strongly enough to make it a not-very-difficult question about whether to give up my personal data.) "Lesser" state level actors - GCHQ, or ASIO here in .au for example - might not have quite such god-like global power, but I'm under no delusion about the privacy protection I've got against the "feeble compared to the NSA" local government intelligence organisation of whatever country I happen to be in, if it takes a personal interest in me. At the attack levels lower down though - carders, identity thieves, the generic "internet fraud" level attacker - I suspect ISPs are significantly more likely to be compromised than CAs - or at least the important part of the CA infrastructure that holds the root signing keys. I'd guess typical ISP infrastructure is not as well secured as typical CA root keys - and that zerodays, unpatched known vulnerabilities, and rogue/disgruntled/underpaid sysadmins in small (and perhaps even large) ISPs represent a much higher risk than non-state-level attacks via stolen CA keys.
- deleted 13y ago[deleted]
- SCdF 13y agoThat implies that the play store isn't connecting over a secure connection and is actually spoofable right? Which would be a security blog post in itself.
- bestdayever 13y agoI think hes trivializing an enormous task to make this seem like a bigger deal than it is.
- corresation 13y agoYour scenario doesn't work at all given that such traffic is encrypted -- you can't simply inject into it. If someone breaks that, we have much bigger problems. However, to your ending comment, some time back I asked whether passwords actually gave you security from other people who know the same password (e.g. a coffee shop that has a big sign telling you the WPA password). While I have zero knowledge to confirm or deny this, someone in the know claimed that no, given that the wifi password is used for the initial key exchange, it offers superficial interception/monitoring protection against someone malicious who knows the same password. Take that with a grain of salt, but I never could find other resources on that.
- donutdan4114 13y agoTrue, 'tis only an example. Some rooted phonesmight be using 3rd party apps not on the Play Store that doesn't go through SSL. Not really sure how that works, I haven't rooted my phone. Also, I am assuming apps can make standard HTTP requests if they want to other external services, so an app that has access to your sensitive data might transmit it to home base non-securely. Hopefully this never actually happens, but given all the junior-made apps out there, some security holes like that probably exist.
- gohrt 13y agoWith a solution like TLS, your private keys and the server's private keys protect you. The password is your access to the network, not the encryption key for your messages.
- corresation 13y agoIndeed. That was the first paragraph of my comment. The second responded to the comment about never using open wifi networks, where I took open to mean unencrypted. My comment is that open and encrypted networks are synonymous (or so I have been told) if the person who wants to capture your traffic knows the network password. Which loops back to the first point, that you should only use encrypted services on networks you don't have full faith in.
- dsl 13y ago
- greenlakejake 13y agoIf you can control any app you could do things like send texts to paid services, harvest bank passwords, send email death threats against the president...
- atesti 13y agoHow can you control any app? By replacing an trusted app with a malicious app with a forged signature? How would you do this replacing?
- randallu 13y agoAndroid allows apps to install apps (how the amazon store works) and if the new app appears signed with the device vendor's key then I'm guessing it wouldn't be an "untrusted source". Apparently the Play store has hosted malware apps in the past...
- atesti 13y agoWhich apps can do this? Is this a special right (installing apps)? Or is it always granted? Does this mean that if I don't install any rogue app store, that I'm safe against the attack which allows forging signatures?
- gohrt 13y agoandroid.permission.INSTALL_PACKAGES
- andrewaylett 13y agoMy understanding is that only apps that are present in some form in flash (even if subsequently updated) are allowed to install without the device asking the user explicitly for confirmation. Compare the process with the Play store (store app prompts before download, can install from the web without prompt) with that of the Amazon store on non-Amazon devices (device prompts after download). android.permission.INSTALL_PACKAGES controls which of the in-flash applications may install stuff: it's not available to non-built-in applications at all, and the Amazon store doesn't have (or need) it.
- jcl 13y agoThat would be my assumption as well, but there are third-party application stores, like Amazon or the custom application repositories of carriers/manufacturers. Presumably it is easy for any individual app store to filter for apps with duplicate cryptographic signatures but different content. But if someone could find an app and a spoofable signer that is present on one store but not another, they could submit an altered app under a spoofed name on the store that lacks the app. Spoofing privileged signers would hopefully be difficult on the Play store, but might be possible elsewhere.
- hughes 13y agoThe high availability of pirated APKs could make it easy to sneak something in to a relatively popular app. This is one reason why you'd have to be crazy to pirate a keyboard app for instance.
- mseebach 13y agoIf your targets are loading pirated APKs onto their phones, you don't need any other security vulnerabilities...
- mikeevans 13y agoOften I see people installing leaked updates for apps like Gmail which are shared through Dropbox, etc. These would normally not install because they don't have matched signatures, unless something like this vulnerability was used.
- gohrt 13y agopirated apps are still subject to Permissions; they aren't less secure than non-pirated apps like, say, Path.
- mc3ander 13y agoIf you can get a user to download an apk from a non-market source (like your website), this should let you install as an update to an existing app. The user wouldn't even see the permissions page.
- lawnchair_larry 13y agoMake no mistake, the article is dripping in FUD. It's a real flaw, and it's interesting, but I'm surprised blackhat was convinced to let it be the subject of a talk. The blog post contains no useful information and is entirely self-serving to shamelessly build hype.
- joeysinatra 13y agoRight. Maybe this is also FUD? "99.9% Of New Mobile Malware Targets Android Phones" http://mashable.com/2013/05/22/new-mobile-malware-targets-android-phones/ http://mashable.com/2013/05/22/new-mobile-malware-targets-an... Or how about this? "Android super-malware discovered" http://www.extremetech.com/mobile/157657-android-super-malware-discovered http://www.extremetech.com/mobile/157657-android-super-malwa... Or this... "Android Home to 92% of Mobile Market's Malware" "http://hothardware.com/News/Android-Home-to-92-of-Mobile-Markets-Malware/" http://hothardware.com/News/Android-Home-to-92-of-Mobile-Mar...
- TwoBit 13y agoIt seems pretty significant to me.
- inoop 13y agoIt allows for a man-in-the-middle attack when downloading new- or updating existing applications, for example using a Wi-Fi honeypot or compromised public access point.
- kimlelly 13y agoIs there a reason why this bug could _not_ be used as a feature by Google to work more effectively with the NSA? (It doesn't sound too far fetched to me, since we know that the NSA has even installed hardware at companies like Google.)
- muro 13y ago> we know that the NSA has even installed hardware at companies like Google where did you find that? I thought all the big companies say they don't have anything installed by NSA, but that NSA can ask for data
- kimlelly 13y agoThey were lying, just like everybody else... http://gigaom.com/2013/06/29/new-prism-slides-say-the-program-allows-nsa-to-eavesdrop-on-live-conversations/ http://gigaom.com/2013/06/29/new-prism-slides-say-the-progra...