7 ms·

Remote code execution on Android devices

107 points by ghosh 12y ago

chatman 12y ago
Richard Stallman has been saying this all along. These non-free operating systems are used for surveillance.
- allegory 12y ago
  Richard Stallman has said a lot of things but as per any extremist you need to take all opinions in context to reality. I used to agree with him but the thousands of hours of arguing with free software make me disinterested in the proposition. I'm willing to trade some of the perceived freedom advantages for practicality and gain more time to so what I want to do, which isn't incidentally wondering why the 50th autoconf run didn't work building gnumeric with a patch because it had a bug. Google sheets it is...
  - icebraining 12y ago
    The problem is that most people aren't even aware they're trading anything. That you consciously made that decision means the movement has already accomplished an important step. Besides, gnumeric bugs will sound great when Google bans your account for deity knows why :)
    - allegory 12y ago
      Most people aren't interested in the mechanism of anything, just the results. They don't make the concious decision not through education but through apathy and the desire to get from A to B via the shortest path. As for Google; backups. If my account gets toasted it's a couple of hours inconvenience to set everything up and little else.
    - rimantas 12y ago
      What if I told you, that most people do not trade anything? I may have a theory that each time you use GPL you are trading away 17 karma points, but that does not it true.
- DCKing 12y ago
  Trying to spread Stallman's ideas by FUD does not help spreading Stallman's ideas. Stop doing that. I don't get why free software zealots hate Android so much. It is by far the most "free" popular operating system ever made. Never has there been a user facing operating system in the possession of 100s of millions of people, for which you can readily download and study the large majority of code running the system on these devices. It is even possible to purge some devices of non-free code (including blobs) completely, if you so desire [1]. [1]: http://www.replicant.us/ http://www.replicant.us/
  - icebraining 12y ago
    I'm sure you know, but rms agrees with you. "Android is a major step towards an ethical, user-controlled, free software portable phone". It's nonfree, but better than anything we've ever had, with the possible exception of the couple of GNU/Linux Nokia phones. https://www.gnu.org/philosophy/android-and-users-freedom.html https://www.gnu.org/philosophy/android-and-users-freedom.htm...
  - drdaeman 12y ago
    > Never has there been a user facing operating system in the possession of 100s of millions of people, for which you can readily download and study the large majority of code running the system on these devices. This is going to be completely off-topic, but most Android installations don't really qualify as "free" as they lack essential freedom to tinker with the code and put it back on the device. Vast majority of Android-based phones are purportedly severely tivoized, and many vendors actively fight any attempts to work around those limitations. That is, having an ability to read the source code doesn't make the software free. So, on the contrary Android family of OSes (with the exception of AOSP and Replicant) is one of the mostly tightly locked-down computing platforms that has one of the core practices of not letting users accessing anything more than device vendor had allowed. Unsurprisingly, this is frowned upon from many zealots.
    - DCKing 12y ago
      That is why I put "free" in quotations. Furthermore, many devices sold do allow you to at least put open source equivalents on them on these devices; many flagship phones allow this with some know-how. On the scale of freedom from 0 to 10 (0 being a Lumia, 10 being the computer that RMS uses), I'd say most Android devices are a 3, with many devices being able to go up to a 6 and some devices going up to an 8 with Replicant. Nonetheless, people fail to recognize the freedoms that Android does give you, and only criticize the freedoms that it doesn't give - the reasons why it's not a 10. If not for Android, I'd wager we would not be able to go beyond 2 (≈ iOS) on the freedom scale when buying mobile phones. That would be bad, and it seems zealots fail to recognize this (that's probably why they are zealots in the first place).
donniezazen 12y ago
Remote code execution is least of the worries on Android. Today I downloaded an app and I read their privacy policy. They will read my browser , all the packages installed on my phone and my precise geolocation. Why did they need those permission just to show you ads. People don't really read terms and conditions. You can get pretty much any information from users because they reading is inconvenient.
- hrjet 12y ago
  Leave aside, terms and conditions. These days, the Play-Store doesn't even show all the permissions requested by an app! The Internet permission, arguably one of the critical ones, doesn't even register!
  - allegory 12y ago
    I am prompted to review the permissions when I install an app and when it is upgraded if anything changes. I don't expect it to show me in tje store itself as I understand that it is defined by a manifest in the APK.
    - scintill76 12y ago
      Why is the technical manifest APK implementation relevant to why you don't expect to see it in the store? Google have the APK, it's not like they can't look and tell you what it says.
      - allegory 12y ago
        Because its a shit ton of metadata and it only makes sense to compare permissions when they know what version you already have which the device is better at doing.
    - hrjet 12y ago
      I was talking about the prompt itself. It now doesn't show all the permissions [1]. Quoting: "These days, apps typically access the Internet, so network communication permissions including the “full Internet access” permission have been moved out of the primary permissions screen." [1]: https://support.google.com/googleplay/answer/6014972?p=app_permissions&rd=1 https://support.google.com/googleplay/answer/6014972?p=app_p...
ars 12y ago
If your machine is rooted then you can install aftermarket apps that let you block things. If all you need is internet blocking then: https://play.google.com/store/apps/details?id=com.googlecode.droidwall.free&hl=en https://play.google.com/store/apps/details?id=com.googlecode... It works great and very easy to use. For more comprehensive blocking: https://play.google.com/store/apps/details?id=biz.bokhorst.xprivacy.installer&hl=en https://play.google.com/store/apps/details?id=biz.bokhorst.x... It's more difficult to use but you can control everything.
- aw3c2 12y ago
  If my device was rooted, wouldn't the attacker be smart enough to circumvent this?
  - AgentME 12y ago
    The vulnerability is the attacker's way into your system. If you've rooted and blocked that vulnerability, then the attacker can't use that way into your system.
- pserwylo 12y ago
  For internet blocking, AFWall+[0] is a fork of DroidWall which seems to be under active development. Unfortunately, XPrivacy is not available on F-Droid, but anyone who is able to get it building and submitted to F-Droid would have my gratitude. [0] - https://f-droid.org/repository/browse/?fdfilter=droidwall&fdid=dev.ukanth.ufirewall https://f-droid.org/repository/browse/?fdfilter=droidwall&fd...
- e40 12y ago
  For XPrivacy, it's a little scary to install. The warnings about making your phone unbootable, for example. EDIT: I went ahead and installed it. No problems. I must say, though, I wouldn't call it easy to use. There are a lot of options.
DCKing 12y ago
This is very problematic for Android. It was a question of time before such an issue crept up that left a large amount of legacy devices fully compromisable remotely. This is the biggest problem of relegating software updates to a complex and unwilling group of people, instead of a single party. The biggest problem in solving this issue is: "who is going to solve it?". The software fix should surely be made by Google's Android team, but a software fix is not a solution. It needs to be distributed as well. And you can count on that not going well at all.
userbinator 12y ago
It appears that the equivalent of NoScript for Android WebViews could be quite useful in protecting against this sort of thing, although no doubt there would be a massive backlash against it since I'd bet most of the time this is being used for showing ads...
ID_USER_TOKEN 12y ago
Android is a clusterfuck of various platforms for supporting remote code execution.
mavdi 12y ago
Security through obscurity. Don't worry the development tools for Android are so shit I don't think hackers will bother with it.

107 points by ghosh 12y ago

chatman 12y ago

Richard Stallman has been saying this all along. These non-free operating systems are used for surveillance.

allegory 12y ago
Richard Stallman has said a lot of things but as per any extremist you need to take all opinions in context to reality. I used to agree with him but the thousands of hours of arguing with free software make me disinterested in the proposition. I'm willing to trade some of the perceived freedom advantages for practicality and gain more time to so what I want to do, which isn't incidentally wondering why the 50th autoconf run didn't work building gnumeric with a patch because it had a bug. Google sheets it is...
- icebraining 12y ago
  The problem is that most people aren't even aware they're trading anything. That you consciously made that decision means the movement has already accomplished an important step. Besides, gnumeric bugs will sound great when Google bans your account for deity knows why :)
  - allegory 12y ago
    Most people aren't interested in the mechanism of anything, just the results. They don't make the concious decision not through education but through apathy and the desire to get from A to B via the shortest path. As for Google; backups. If my account gets toasted it's a couple of hours inconvenience to set everything up and little else.
  - rimantas 12y ago
    What if I told you, that most people do not trade anything? I may have a theory that each time you use GPL you are trading away 17 karma points, but that does not it true.
DCKing 12y ago
Trying to spread Stallman's ideas by FUD does not help spreading Stallman's ideas. Stop doing that. I don't get why free software zealots hate Android so much. It is by far the most "free" popular operating system ever made. Never has there been a user facing operating system in the possession of 100s of millions of people, for which you can readily download and study the large majority of code running the system on these devices. It is even possible to purge some devices of non-free code (including blobs) completely, if you so desire [1]. [1]: http://www.replicant.us/ http://www.replicant.us/
- icebraining 12y ago
  I'm sure you know, but rms agrees with you. "Android is a major step towards an ethical, user-controlled, free software portable phone". It's nonfree, but better than anything we've ever had, with the possible exception of the couple of GNU/Linux Nokia phones. https://www.gnu.org/philosophy/android-and-users-freedom.html https://www.gnu.org/philosophy/android-and-users-freedom.htm...
- drdaeman 12y ago
  > Never has there been a user facing operating system in the possession of 100s of millions of people, for which you can readily download and study the large majority of code running the system on these devices. This is going to be completely off-topic, but most Android installations don't really qualify as "free" as they lack essential freedom to tinker with the code and put it back on the device. Vast majority of Android-based phones are purportedly severely tivoized, and many vendors actively fight any attempts to work around those limitations. That is, having an ability to read the source code doesn't make the software free. So, on the contrary Android family of OSes (with the exception of AOSP and Replicant) is one of the mostly tightly locked-down computing platforms that has one of the core practices of not letting users accessing anything more than device vendor had allowed. Unsurprisingly, this is frowned upon from many zealots.
  - DCKing 12y ago
    That is why I put "free" in quotations. Furthermore, many devices sold do allow you to at least put open source equivalents on them on these devices; many flagship phones allow this with some know-how. On the scale of freedom from 0 to 10 (0 being a Lumia, 10 being the computer that RMS uses), I'd say most Android devices are a 3, with many devices being able to go up to a 6 and some devices going up to an 8 with Replicant. Nonetheless, people fail to recognize the freedoms that Android does give you, and only criticize the freedoms that it doesn't give - the reasons why it's not a 10. If not for Android, I'd wager we would not be able to go beyond 2 (≈ iOS) on the freedom scale when buying mobile phones. That would be bad, and it seems zealots fail to recognize this (that's probably why they are zealots in the first place).

donniezazen 12y ago

Remote code execution is least of the worries on Android. Today I downloaded an app and I read their privacy policy. They will read my browser , all the packages installed on my phone and my precise geolocation. Why did they need those permission just to show you ads. People don't really read terms and conditions. You can get pretty much any information from users because they reading is inconvenient.

hrjet 12y ago
Leave aside, terms and conditions. These days, the Play-Store doesn't even show all the permissions requested by an app! The Internet permission, arguably one of the critical ones, doesn't even register!
- allegory 12y ago
  I am prompted to review the permissions when I install an app and when it is upgraded if anything changes. I don't expect it to show me in tje store itself as I understand that it is defined by a manifest in the APK.
  - scintill76 12y ago
    Why is the technical manifest APK implementation relevant to why you don't expect to see it in the store? Google have the APK, it's not like they can't look and tell you what it says.
    - allegory 12y ago
      Because its a shit ton of metadata and it only makes sense to compare permissions when they know what version you already have which the device is better at doing.
  - hrjet 12y ago
    I was talking about the prompt itself. It now doesn't show all the permissions [1]. Quoting: "These days, apps typically access the Internet, so network communication permissions including the “full Internet access” permission have been moved out of the primary permissions screen." [1]: https://support.google.com/googleplay/answer/6014972?p=app_permissions&rd=1 https://support.google.com/googleplay/answer/6014972?p=app_p...

ars 12y ago

If your machine is rooted then you can install aftermarket apps that let you block things. If all you need is internet blocking then: https://play.google.com/store/apps/details?id=com.googlecode.droidwall.free&hl=en https://play.google.com/store/apps/details?id=com.googlecode... It works great and very easy to use. For more comprehensive blocking: https://play.google.com/store/apps/details?id=biz.bokhorst.xprivacy.installer&hl=en https://play.google.com/store/apps/details?id=biz.bokhorst.x... It's more difficult to use but you can control everything.

aw3c2 12y ago
If my device was rooted, wouldn't the attacker be smart enough to circumvent this?
- AgentME 12y ago
  The vulnerability is the attacker's way into your system. If you've rooted and blocked that vulnerability, then the attacker can't use that way into your system.
pserwylo 12y ago
For internet blocking, AFWall+[0] is a fork of DroidWall which seems to be under active development. Unfortunately, XPrivacy is not available on F-Droid, but anyone who is able to get it building and submitted to F-Droid would have my gratitude. [0] - https://f-droid.org/repository/browse/?fdfilter=droidwall&fdid=dev.ukanth.ufirewall https://f-droid.org/repository/browse/?fdfilter=droidwall&fd...
e40 12y ago
For XPrivacy, it's a little scary to install. The warnings about making your phone unbootable, for example. EDIT: I went ahead and installed it. No problems. I must say, though, I wouldn't call it easy to use. There are a lot of options.

DCKing 12y ago

This is very problematic for Android. It was a question of time before such an issue crept up that left a large amount of legacy devices fully compromisable remotely. This is the biggest problem of relegating software updates to a complex and unwilling group of people, instead of a single party. The biggest problem in solving this issue is: "who is going to solve it?". The software fix should surely be made by Google's Android team, but a software fix is not a solution. It needs to be distributed as well. And you can count on that not going well at all.

userbinator 12y ago

It appears that the equivalent of NoScript for Android WebViews could be quite useful in protecting against this sort of thing, although no doubt there would be a massive backlash against it since I'd bet most of the time this is being used for showing ads...

ID_USER_TOKEN 12y ago

Android is a clusterfuck of various platforms for supporting remote code execution.

mavdi 12y ago

Security through obscurity. Don't worry the development tools for Android are so shit I don't think hackers will bother with it.