18 ms·

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

543 points by mike-cardwell 12y ago

talos 12y ago
This is nuts. On a sidenote, any suggestions for an equivalently fast, secure browser for Android 4.2 on a relatively old phone? Not gonna use AOSP anymore!
- voidlogic 12y ago
  Firefox mobile works great, give that a look.
- aroch 12y ago
  I use Firefox on my Android phones, it's come a long way since its first release and is pleasantly stable and comparably quick to chrome.
- takeda 12y ago
  You can try Opera Mobile Classic, it's important to use classic version since the new Opera Mobile uses the same engine as chrome so it might have the same vulnerabilities.
  - iancarroll 12y ago
    AOSP != Chrome, right? ...
    - nokcha 12y ago
      Right, the AOSP browser is not Chrome. The AOSP browser is deprecated and is not installed by default on recent versions of Android.
    - dozy 12y ago
      Correct. Chrome is a separate project from the AOSP. That said, Android 4.4 and later use Chromium for their WebViews, the source for which is developed along with Chrome as a part of the Chromium project - it does not live in AOSP. Presumably the stock browser that is in AOSP 4.4+ wraps Chromium, which more or less means the AOSP browser is Chrome...but not the other way around. :)
- deleted 12y ago
  [deleted]
- bhaile 12y ago
  Chrome/Firefox. Not AOSP stock browser.
- untog 12y ago
  Chrome?
- higherpurpose 12y ago
  Opera Classic is great. The new Opera works very much like Chrome, since it's based on Chromium.
- jrapdx3 12y ago
  Just tested all browsers installed on Android 4.2.1 tablet: Opera Classic OK Opera Mini OK Tint Vulnerable Default Vulnerable Opera has usually worked OK, though sometimes rendering is a bit off. Better than the default browser, especially now.
allegory 12y ago
It's this sort of thing that puts me off Android as a platform. Even my mother got sold a 2.2 handset recently (Samsung Galaxy Ace) that hasn't been patched for the best part of 3 years. You never know when you're going to end up with a lemon on your hands. Big jump to this conclusion but I'm more inclined to trust Microsoft at the moment as they have a better reputation for lifetime (unlike Android), have a very public security process and good industry comms and the devices are proven usable if not faster after recent updates (unlike iOS which starts to be terribly limiting performance-wise). Plus they're dirt cheap.
- Zigurd 12y ago
  Android One is meant to make it simple for lo-end OEMs to ship high quality implementations of up-to-date Android and keep up with new releases. It's hard to migrate a huge OEM ecosystem to that kind of program quickly.
  - allegory 12y ago
    I doubt that will happen. At $100 a handset where is the return and motivation for an OEM to bother pushing updates out for firmware/integration testing etc (that the telcos require)? Look at the aforementioned Galaxy Ace in my last comment which is exactly where this will end up, yet again. Also, they say 2 years' support. If you look at the phone recycling business, there is 4-5 years life in a franken-handset shipped abroad.
    - aroch 12y ago
      Google's providing the OS support -- they make money on you using their services. Even if the revenue per user is only ¢10/year, when you get 100's of millions to billions of users that adds up.
  - npizzolato 12y ago
    And Nexus was meant to make it simpler for Google to ship updates directly to users, rather than having to go through OEMs. If Google can't keep their own phones up to date, do you expect Android One to be any different?
kb120 12y ago
So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.
- jamroom 12y ago
  Most "normal" people assume whatever browser comes with Android is "Google's Browser" (right or wrong), so this could be a very big deal to A LOT of people. How many Android handset manufactures have shipped units with the AOSP browser as the default?
- untog 12y ago
  "a browser that isn't supported by Google" But still a browser that was created by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android <=4.3 accounts for 75% of Android users: https://developer.android.com/about/dashboards/index.html?utm_source=ausdroid.net https://developer.android.com/about/dashboards/index.html?ut... Just because Google decided not to support it any more doesn't mean they shouldn't. Pointing out Firefox and Opera is all very well, but this is the default browser on Android <=4.3, and very few users explore alternative browsers (Chrome being the exception, to a point). It's also the browser engine used in embedded webviews, don't forget.
  - kb120 12y ago
    Very few people explore other browsers? Alt browsers are often the first app that people download. Chrome is included in gapps.
    - untog 12y ago
      Alt browsers are often the first app the people download. Which people? I'll grant that Chrome is an exception, given that it's bundled, but I've never seen usage number of other alternative Android browsers hit any meaningful numbers.
    - 12y ago
helpbygrace 12y ago
Use Chrome.
- lucb1e 12y ago
  Use Firefox. Why? Chrome isn't open source, if you care about that kind of thing. And personal preference also.
  - deleted 12y ago
    [deleted]
  - jonknee 12y ago
    https://code.google.com/p/chromium/wiki/AndroidBuildInstructions https://code.google.com/p/chromium/wiki/AndroidBuildInstruct...
    - gress 12y ago
      That's not chrome.
      - azernik 12y ago
        It is very very close: https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoogleChrome https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo... tl;dr: Chromium is Chrome minus: 1. Crash/usage reporting to Google. 2. Proprietary video format support 3. Embedded Flash implementation (which doesn't exist on mobile anyway). 4. Google API keys. If what you care about is security auditability, that's pretty good. If you care about running only open source software, that's going to be very hard to do in the Android/Google-Play ecosystem.
        gcb0 12y ago
        > If you care about running only open source software, that's going to be very hard to do in the Android/Google-Play ecosystem. yet, the main advertisement google trhows for android is "open source" "community driven" yadda yadda
steakejjs 12y ago
If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If you click on the button and you see an alert box, you're vulnerable (I doubt many on HN will....) Many other browser's also seem to be vulnerable. So if you use something else best be safe and check yourself
- yeahforbes 12y ago
  I have a browser called InBrowser and it gives an alert on your test page. Maybe it wraps AOSP? I don't have "Browser" in my list of apps though, it came with Chrome instead and I installed InBrowser myself. (Android 4.1.2)
  - TD-Linux 12y ago
    Almost all third-party browsers on the Play Store wrap the Android WebView, which is vulnerable. You'll need to use a browser that includes its own rendering engine, such as Firefox, to remain secure.
    - sucramb 12y ago
      The Android WebView uses since quite some time the same rendering and javascript engines as Chrome. Thus I would expect third party browsers to be no more vulnerable with regard to this bug than Chrome. Edit: since 4.4 [https://developer.chrome.com/multidevice/webview/overview https://developer.chrome.com/multidevice/webview/overview]
  - tompod 12y ago
    Hi YeahForbes, TomPod, the creators of InBrowser, here. We're unable to reproduce this error on a oneplus and a HTC M8 running the latest version of InBrowser. But rest assured, we'll check this with our suite of devices and Android version during the day. Since version 2.11 (43), 2014-03-09 we limit the usage of JavaScript: due to another bug in Android. Hopefully it'll fix this issue as well. So please make sure that you're on latest version from Google Play. If we can fix this on our side we'll push a fix asap. If not, we unfortunately need to wait for Google to address this. We'll post any updates on this issue at @tompodapps. Thanks for reporting it!
1ris 12y ago
>While the AOSP has "been killed off" by Google, it... I do not follow android closely, but this refers to the browser only, right?
- jayd16 12y ago
  yes
- RyJones 12y ago
  he's missing the word browser. It should read: > While the AOSP browser has "been killed off"...
- kllrnohj 12y ago
  The author is also slightly mistaken on that. The AOSP browser is just a UI shell for WebView, and WebView has absolutely not been killed off. The WebView in KitKat sits on top of Chromium, for example, so installing an AOSP browser on KitKat will likely not have this vulnerability.
  - fulafel 12y ago
    But it will still have vulnerabilities that have been fixed in current Chromium. (In the Chromium WebView FAQ they say they're working on fixing it, but there are major difficulties. https://developer.chrome.com/multidevice/webview/overview https://developer.chrome.com/multidevice/webview/overview)
seccess 12y ago
Does anyone know if WebView is similarly susceptible?
- joev_ 12y ago
  I wish I had tested this sooner, but yes, Webview is vulnerable (use document.write(document.domain) instead of alert() to test). So afaict apps that embed webview/ads on < 4.4 are at risk.
  - ClashTheBunny 12y ago
    How would this be exploited? Can you read the contents of a webview in another process? Your users would have to navigate somehow to an exploited page (via an ad)?
javert 12y ago
I am a big Linux fan and appreciate the openness and control that I can get with Android as opposed to Apple and Microsoft products, but... My Android experience has been shit, and I'm really getting sick of it. Admittedly, much or even most of the problem for me is the OEMs screwing things up and not sending out updates.
- autism_hurts 12y ago
  You're not the only one. I'm sorry, but the Android issue has devolved into a holy war but... .. support is terrible on the Android side. Really terrible.
  - blocke 12y ago
    People need to stop buying terrible phones. Consumers keep rewarding companies who don't keep up with their promises and thus no one ends up giving a crap. In my opinion if you're not going to buy a Nexus device or a Moto E/G/X then you might as well buy Apple. The Android One program will hopefully add more to that.
    - robocat 12y ago
      You can only know if it is a "terrible" phone until long after you have bought it. Most people don't have the ability to make an informed decision about a phones purchase (or they want to buy an iPhone or Nexus but they simply can't afford it). I bought a Google Nexus at USD650 retail - a perfect counterexample to your advice. I recommend iPhones to those who can afford it (purchase price, insurance, screen replacements etc.). I recommend Huawei Y310/320/330 for those who don't have much. In between there are too many other factors to make a straight recommendation (e.g. buy second hand iPhone versus a Moto G).
      - bad_user 12y ago
        My one year old Nexus 4 is on KitKat. I guess you're talking about the Galaxy Nexus. While I agree with you that they dropped the support a way too soon, being the reference phone you'll have no problems in updating it with CyanogenMod, which is a really good distribution btw. But as a slight counterpoint, given the fast release cycle, you can't expect them to support a phone forever. You mentioned iPhones. Well I have an iPhone 3GS. It's a perfectly capable phone that still works and that was still sold as the low-price alternative after iPhone 4 happened, yet Apple stopped supporting it as well. But I can understand that, because these OSes get more bloated with stuff and it leads to a shitty experience. I was able to upgrade an older Galaxy S (first generation, shipped originally with 2.1) to 4.3 by means of CyanogenMod and it was unusable due to the less than capable hardware. Google did drop the support too early for the Galaxy Nexus, but try out CyanogenMod. I'm even thinking of installing it on my Nexus 4 because the Android on this device is bloated with Google-stuff that I cannot uninstall and it pisses me off. It's also enlightening to install CyanogenMod without Google Play, for an all open-source experience ;-)
fencepost 12y ago
Replaced by Chrome ("that giant hog"). I'm on a slightly older phone, but I actually removed Chrome from it not long ago. I started having problems with updating apps due to insufficient space, and while I have a fair amount of crap installed, I also have ~2.5GB of "Phone" storage for apps so I started investigating (this is separate from "sdcard" data storage which is ~8GB). Turns out Chrome, at least on the HTC Amaze 4G with 4.0.3, takes up about 250MB - my largest installed app by about a factor of 4 (next largest was ~80MB). This was not cache or data, this was the app itself. I don't know what all they've moved into there as part of their push to cripple Android except as a host for the "Google Play Ecosystem," but crap like this is not endearing.
- gcb0 12y ago
  google is learning how to be evil with offline tech. online they just shutdown the old system. offline now they leave holes and announce them when they want you to upgrade. "for security"
- hnha 12y ago
  I am running out of space because Play Store and Google Framework get bigger and bigger. It fills me with rage how Google actively makes my old phone less capable over time for no benefit to me.
  - oftenwrong 12y ago
    I lost the ability to write to my external sdcard when I got the kitkat upgrade. Of course rooting allowed me write access again. This is why the "rooting voids the warrant" policies are bullshit. When an upgrade is forced on a user, and removes critical functionality for no good reason, what is the user to do? I, for one, am never buying a locked down phone again. I'd rather not even have a phone.
  - AjithAntony 12y ago
    Yeah. I was using a Nexus One for a long time until I had to prune so many apps due to space that it wasn't worth using. I got a new phone, HTC One S (I needed a t-mobile branded phone for wifi calling) with several gigs of system partition space, and now I have to play that game again. I recognize that there are a bunch of features now that I get to enjoy, but now I have to choose which ones I want to keep. When I switched, 20MB was a big app. Now I have at least 30 apps that are bigger. Chrome in particular seems bogus. The desktop version isn't even this big. Chrome : 211MB Facebook: 116MB Google search: 70MB Google+: 65MB Amazon: 60MB Mantano Reader: 54MB Dropbox: 50MB Google Play services: 50MB Google Text-to-speach engine: 45MB Hangouts: 35MB t-mobile my account: 33MB SwitftKey: 33MB Kindle: 30MB Evernote: 30MB BaconReader: 28MB twitter: 25MB Hulu: 25MB Google Maps: 24MB Google Drive: 24MB <...> I do recognize that these apps balance the data differently. Chrome is 189MB app, and facebook is 80MB data.
ck2 12y ago
If you haven't tried Firefox Fennec (android mobile) it is actually pretty good now. https://play.google.com/store/apps/details?id=org.mozilla.firefox https://play.google.com/store/apps/details?id=org.mozilla.fi... https://www.mozilla.org/en-US/firefox/partners/#android https://www.mozilla.org/en-US/firefox/partners/#android They make it for arm and x86 android. They used to make a windows version but sadly stopped that build.
- aidenn0 12y ago
  It crashes every time I hit the menu button. I sent in the crash report; I couldn't figure out where on mozilla's website to report mobile bugs though.
- anonbanker 12y ago
  Been using Firefox mobile for four months now, and forcefully removed both chrome and the vulnerable browser from my device about one month in. Slight battery drain issues, but those are almost all solved in recent releases. Definitely give it a try.
slingerofwheat 12y ago
Is anyone familiar with the code that allows this vulnerability to be present and where I can find it(I believe this project is open source)? I understand the exploit is adding a nullbyte at the beginning of some javascript due to some bad handling in the parsing code. So I'm looking here: https://android.googlesource.com/platform/packages/apps/Browser/+/master/src/com/android/browser https://android.googlesource.com/platform/packages/apps/Brow...
- joev_ 12y ago
  I don't know the exact location, but it is probably somewhere in the webview tree, since it affects apps that embed webviews as well: https://android.googlesource.com/platform/frameworks/base/+/jb-release/core/java/android/webkit/ https://android.googlesource.com/platform/frameworks/base/+/...
  - smtddr 12y ago
    Since it's both webview and browser itself, I'd suspect some kind of common denominator object at fault... like...https://android.googlesource.com/platform/frameworks/base/+/jb-release/core/java/android/net/UrlQuerySanitizer.java https://android.googlesource.com/platform/frameworks/base/+/... Especially with a method called "public static class IllegalCharacterValueSanitizer".
pmontra 12y ago
This leaves us with little alternatives. Tint is affected. Dolphin is affected. Firefox is just horrible on mobile, come see this page and you'll understand why (they can't get font inflation right). Chrome and Opera are what's left. Anything else?
- jarek 12y ago
  I'm using Firefox on Android 4.4 as my full-time browser, it is rather good most of the time. TBH HN is the only site I can think of that gives me trouble... and knowing the authors' attitude to HTML I'm prepared to accept the fault is not Firefox's.
  - pmontra 12y ago
    There are many font inflation bugs open on Firefox mobile. One of them was opened about HN https://bugzilla.mozilla.org/show_bug.cgi?id=707195 https://bugzilla.mozilla.org/show_bug.cgi?id=707195 in 2011. Others are about reddit. Others are about other sites. Firefox didn't grok a way to handle font inflation in a reasonable way. All the other browsers did. I quote a Firefox developer: ------ From a UX perspective, we should really try to fix this somehow. Reddit and ycombinator look terrible in our browser right now. Some examples: ycombinator http://cl.ly/0l2f2v0p3v0e290J0A0W http://cl.ly/0l2f2v0p3v0e290J0A0W Reddit http://cl.ly/1M452m2a2D3D04070S1I http://cl.ly/1M452m2a2D3D04070S1I These pages look perfectly fine in stock Browser -- they are a little wonky in Chrome but still better than us ------ https://bugzilla.mozilla.org/show_bug.cgi?id=707195#c27 https://bugzilla.mozilla.org/show_bug.cgi?id=707195#c27 That was 2012-05-01.
    - jarek 12y ago
      1) reddit renders fine for me now, zoom is consistent (Firefox 32, Android 4.4) 2) HN uses HTML straight out of 90s (tables nested three deep, spacer images to indent threads) so I don't mind them not focusing on trying to salvage it. Also from the comments thread: "to fix this we'd want to know the widths of the containers of all the text, which requires doing layout on the whole subtree (or at least a decent part of it), but we need to know the inflation numbers before we do layout. (It's probably doable by constructing reflow states for the entire subtree as we walk it, but that would be a significant performance hit that I don't think we want to take.)" Don't abuse tables and you won't have a problem.
diminish 12y ago
As Firefox saved us from dangerous browsing circa 2004m from IE5,6,7, now I may save us from obsolete Android stock browsers. At least that's what I use.
- ZoFreX 12y ago
  Unfortunately a lot of apps embed the Android browser as well, and you can't change that.
downandout 12y ago
Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): "Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities" [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their Android license agreements with device makers. At least then, when these things are discovered and publicized, tens of millions of people won't be left vulnerable. [1] http://www.zdnet.com/android-fragmentation-turning-devices-into-a-toxic-hellstew-of-vulnerabilities-7000028342/ http://www.zdnet.com/android-fragmentation-turning-devices-i...
- Pxtl 12y ago
  Even if they do fast vuln updates, what about older devices? Even Google only offers 2y of support.
  - downandout 12y ago
    I think Google needs to change that as well. Android is seen as a second class OS by a large percentage of people, and these kinds of revelations only increase that percentage. Google can do better, but for whatever reason they aren't.
    - acdha 12y ago
      > Google can do better, but for whatever reason they aren't. s/aren't/choose not to/ This is simply bad management – we're talking, what, a single engineer to backport critical fixes and some testing support. Contrast that against the damage this has done to Android's competitiveness – even the non-nerds I know talk about how they bought an iOS device because Android never gets updates – and increases the likelihood that they'll have a major security problem at some point when someone creates widespread exploit affecting all of those abandoned phones and the headlines talk about how many millions of people are at risk for a problem which was reported years ago. The phone vendors and carriers had a large part in creating this problem but most of the reputation sticks to the platform and, as with the more general fragmentation problem, Google has been very slow to take it seriously.
Shofo 12y ago
If only Meego took off.
fidotron 12y ago
It was a mistake to put Webkit as an operating system level component in the first place. It would be better if the solution wasn't to push Chromium but a storage framework style pluggable component, mainly since they can't get stuff like text sizing right. Luckily since most vital user info is going to be in apps this doesn't have nearly the same impact as it would on desktop, but it does represent yet another demonstration that having the web as a sort of super-platform-on-a-platform doubles your attack surface. Android really is comparable to 90s era Windows, in every possible sense. For better or worse Chrome OS is clearly being positioned as the NT equivalent as well, but it's hard to see how you can recreate the functionality of Android without adopting the flaws too.
thejdude 12y ago
The general lack of updates is exactly why I use/install/recommend Firefox. That and the automatic syncing w/ Desktop and the regular performance improvements. (Chrome isn't an option. I can't even turn off third-party cookies. In 2014.) Too bad it uses quite a few resources and may be too heavy for low-end phones.
paulirish 12y ago
Just an update from the Google side: As discussed below, any Android users on 4.4+ or running Chrome are not affected. For earlier versions of Android, we've shipped patches for AOSP: https://android.googlesource.com/platform/external/webkit/+/1368e05e8875f00e8d2529fe6050d08b55ea4d87 https://android.googlesource.com/platform/external/webkit/+/... https://android.googlesource.com/platform/external/webkit/+/7e4405a7a12750ee27325f065b9825c25b40598c https://android.googlesource.com/platform/external/webkit/+/... These are in the AOSP branches for jb-dev, jb-mr1-dev, jb-mr1.1-dev, and jb-mr2-dev.
- junktest 12y ago
  is android kitkat 4.4.x safe from this bug regardless of whether chrome browser exists (not installed or uninstalled) in the phone or not? please enlighten. thanks.
  - joev_ 12y ago
    My understanding is that Chrome replaced Webkit in WebView's internal implementation in 4.4, so the bug should never appear in 4.4.
    - paulirish 12y ago
      Yup correct. Completely different WebView. And the bug is technically in the WebView.
- schwarze_pest 12y ago
  Does this mean that there will be an update for the Galaxy Nexus?
  - aiiane 12y ago
    OS updates for $SPECIFIC_PHONE are generally reliant on the carrier to decide to push out a patch, even after AOSP itself is patched. So an answer "from the Google side" can't really answer your question.

543 points by mike-cardwell 12y ago

talos 12y ago

This is nuts. On a sidenote, any suggestions for an equivalently fast, secure browser for Android 4.2 on a relatively old phone? Not gonna use AOSP anymore!

voidlogic 12y ago
Firefox mobile works great, give that a look.
aroch 12y ago
I use Firefox on my Android phones, it's come a long way since its first release and is pleasantly stable and comparably quick to chrome.
takeda 12y ago
You can try Opera Mobile Classic, it's important to use classic version since the new Opera Mobile uses the same engine as chrome so it might have the same vulnerabilities.
- iancarroll 12y ago
  AOSP != Chrome, right? ...
  - nokcha 12y ago
    Right, the AOSP browser is not Chrome. The AOSP browser is deprecated and is not installed by default on recent versions of Android.
  - dozy 12y ago
    Correct. Chrome is a separate project from the AOSP. That said, Android 4.4 and later use Chromium for their WebViews, the source for which is developed along with Chrome as a part of the Chromium project - it does not live in AOSP. Presumably the stock browser that is in AOSP 4.4+ wraps Chromium, which more or less means the AOSP browser is Chrome...but not the other way around. :)
deleted 12y ago
[deleted]
bhaile 12y ago
Chrome/Firefox. Not AOSP stock browser.
untog 12y ago
Chrome?
higherpurpose 12y ago
Opera Classic is great. The new Opera works very much like Chrome, since it's based on Chromium.
jrapdx3 12y ago
Just tested all browsers installed on Android 4.2.1 tablet: Opera Classic OK Opera Mini OK Tint Vulnerable Default Vulnerable Opera has usually worked OK, though sometimes rendering is a bit off. Better than the default browser, especially now.

allegory 12y ago

It's this sort of thing that puts me off Android as a platform. Even my mother got sold a 2.2 handset recently (Samsung Galaxy Ace) that hasn't been patched for the best part of 3 years. You never know when you're going to end up with a lemon on your hands. Big jump to this conclusion but I'm more inclined to trust Microsoft at the moment as they have a better reputation for lifetime (unlike Android), have a very public security process and good industry comms and the devices are proven usable if not faster after recent updates (unlike iOS which starts to be terribly limiting performance-wise). Plus they're dirt cheap.

Zigurd 12y ago
Android One is meant to make it simple for lo-end OEMs to ship high quality implementations of up-to-date Android and keep up with new releases. It's hard to migrate a huge OEM ecosystem to that kind of program quickly.
- allegory 12y ago
  I doubt that will happen. At $100 a handset where is the return and motivation for an OEM to bother pushing updates out for firmware/integration testing etc (that the telcos require)? Look at the aforementioned Galaxy Ace in my last comment which is exactly where this will end up, yet again. Also, they say 2 years' support. If you look at the phone recycling business, there is 4-5 years life in a franken-handset shipped abroad.
  - aroch 12y ago
    Google's providing the OS support -- they make money on you using their services. Even if the revenue per user is only ¢10/year, when you get 100's of millions to billions of users that adds up.
- npizzolato 12y ago
  And Nexus was meant to make it simpler for Google to ship updates directly to users, rather than having to go through OEMs. If Google can't keep their own phones up to date, do you expect Android One to be any different?

kb120 12y ago

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

jamroom 12y ago
Most "normal" people assume whatever browser comes with Android is "Google's Browser" (right or wrong), so this could be a very big deal to A LOT of people. How many Android handset manufactures have shipped units with the AOSP browser as the default?
untog 12y ago
"a browser that isn't supported by Google" But still a browser that was created by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android <=4.3 accounts for 75% of Android users: https://developer.android.com/about/dashboards/index.html?utm_source=ausdroid.net https://developer.android.com/about/dashboards/index.html?ut... Just because Google decided not to support it any more doesn't mean they shouldn't. Pointing out Firefox and Opera is all very well, but this is the default browser on Android <=4.3, and very few users explore alternative browsers (Chrome being the exception, to a point). It's also the browser engine used in embedded webviews, don't forget.
- kb120 12y ago
  Very few people explore other browsers? Alt browsers are often the first app that people download. Chrome is included in gapps.
  - untog 12y ago
    Alt browsers are often the first app the people download. Which people? I'll grant that Chrome is an exception, given that it's bundled, but I've never seen usage number of other alternative Android browsers hit any meaningful numbers.
  - 12y ago

helpbygrace 12y ago

Use Chrome.

lucb1e 12y ago
Use Firefox. Why? Chrome isn't open source, if you care about that kind of thing. And personal preference also.
- deleted 12y ago
  [deleted]
- jonknee 12y ago
  https://code.google.com/p/chromium/wiki/AndroidBuildInstructions https://code.google.com/p/chromium/wiki/AndroidBuildInstruct...
  - gress 12y ago
    That's not chrome.
    - azernik 12y ago
      It is very very close: https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoogleChrome https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo... tl;dr: Chromium is Chrome minus: 1. Crash/usage reporting to Google. 2. Proprietary video format support 3. Embedded Flash implementation (which doesn't exist on mobile anyway). 4. Google API keys. If what you care about is security auditability, that's pretty good. If you care about running only open source software, that's going to be very hard to do in the Android/Google-Play ecosystem.
      - gcb0 12y ago
        > If you care about running only open source software, that's going to be very hard to do in the Android/Google-Play ecosystem. yet, the main advertisement google trhows for android is "open source" "community driven" yadda yadda

steakejjs 12y ago

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If you click on the button and you see an alert box, you're vulnerable (I doubt many on HN will....) Many other browser's also seem to be vulnerable. So if you use something else best be safe and check yourself

yeahforbes 12y ago
I have a browser called InBrowser and it gives an alert on your test page. Maybe it wraps AOSP? I don't have "Browser" in my list of apps though, it came with Chrome instead and I installed InBrowser myself. (Android 4.1.2)
- TD-Linux 12y ago
  Almost all third-party browsers on the Play Store wrap the Android WebView, which is vulnerable. You'll need to use a browser that includes its own rendering engine, such as Firefox, to remain secure.
  - sucramb 12y ago
    The Android WebView uses since quite some time the same rendering and javascript engines as Chrome. Thus I would expect third party browsers to be no more vulnerable with regard to this bug than Chrome. Edit: since 4.4 [https://developer.chrome.com/multidevice/webview/overview https://developer.chrome.com/multidevice/webview/overview]
- tompod 12y ago
  Hi YeahForbes, TomPod, the creators of InBrowser, here. We're unable to reproduce this error on a oneplus and a HTC M8 running the latest version of InBrowser. But rest assured, we'll check this with our suite of devices and Android version during the day. Since version 2.11 (43), 2014-03-09 we limit the usage of JavaScript: due to another bug in Android. Hopefully it'll fix this issue as well. So please make sure that you're on latest version from Google Play. If we can fix this on our side we'll push a fix asap. If not, we unfortunately need to wait for Google to address this. We'll post any updates on this issue at @tompodapps. Thanks for reporting it!

1ris 12y ago

>While the AOSP has "been killed off" by Google, it... I do not follow android closely, but this refers to the browser only, right?

jayd16 12y ago
yes
RyJones 12y ago
he's missing the word browser. It should read: > While the AOSP browser has "been killed off"...
kllrnohj 12y ago
The author is also slightly mistaken on that. The AOSP browser is just a UI shell for WebView, and WebView has absolutely not been killed off. The WebView in KitKat sits on top of Chromium, for example, so installing an AOSP browser on KitKat will likely not have this vulnerability.
- fulafel 12y ago
  But it will still have vulnerabilities that have been fixed in current Chromium. (In the Chromium WebView FAQ they say they're working on fixing it, but there are major difficulties. https://developer.chrome.com/multidevice/webview/overview https://developer.chrome.com/multidevice/webview/overview)

seccess 12y ago

Does anyone know if WebView is similarly susceptible?

joev_ 12y ago
I wish I had tested this sooner, but yes, Webview is vulnerable (use document.write(document.domain) instead of alert() to test). So afaict apps that embed webview/ads on < 4.4 are at risk.
- ClashTheBunny 12y ago
  How would this be exploited? Can you read the contents of a webview in another process? Your users would have to navigate somehow to an exploited page (via an ad)?

javert 12y ago

I am a big Linux fan and appreciate the openness and control that I can get with Android as opposed to Apple and Microsoft products, but... My Android experience has been shit, and I'm really getting sick of it. Admittedly, much or even most of the problem for me is the OEMs screwing things up and not sending out updates.

autism_hurts 12y ago
You're not the only one. I'm sorry, but the Android issue has devolved into a holy war but... .. support is terrible on the Android side. Really terrible.
- blocke 12y ago
  People need to stop buying terrible phones. Consumers keep rewarding companies who don't keep up with their promises and thus no one ends up giving a crap. In my opinion if you're not going to buy a Nexus device or a Moto E/G/X then you might as well buy Apple. The Android One program will hopefully add more to that.
  - robocat 12y ago
    You can only know if it is a "terrible" phone until long after you have bought it. Most people don't have the ability to make an informed decision about a phones purchase (or they want to buy an iPhone or Nexus but they simply can't afford it). I bought a Google Nexus at USD650 retail - a perfect counterexample to your advice. I recommend iPhones to those who can afford it (purchase price, insurance, screen replacements etc.). I recommend Huawei Y310/320/330 for those who don't have much. In between there are too many other factors to make a straight recommendation (e.g. buy second hand iPhone versus a Moto G).
    - bad_user 12y ago
      My one year old Nexus 4 is on KitKat. I guess you're talking about the Galaxy Nexus. While I agree with you that they dropped the support a way too soon, being the reference phone you'll have no problems in updating it with CyanogenMod, which is a really good distribution btw. But as a slight counterpoint, given the fast release cycle, you can't expect them to support a phone forever. You mentioned iPhones. Well I have an iPhone 3GS. It's a perfectly capable phone that still works and that was still sold as the low-price alternative after iPhone 4 happened, yet Apple stopped supporting it as well. But I can understand that, because these OSes get more bloated with stuff and it leads to a shitty experience. I was able to upgrade an older Galaxy S (first generation, shipped originally with 2.1) to 4.3 by means of CyanogenMod and it was unusable due to the less than capable hardware. Google did drop the support too early for the Galaxy Nexus, but try out CyanogenMod. I'm even thinking of installing it on my Nexus 4 because the Android on this device is bloated with Google-stuff that I cannot uninstall and it pisses me off. It's also enlightening to install CyanogenMod without Google Play, for an all open-source experience ;-)

fencepost 12y ago

Replaced by Chrome ("that giant hog"). I'm on a slightly older phone, but I actually removed Chrome from it not long ago. I started having problems with updating apps due to insufficient space, and while I have a fair amount of crap installed, I also have ~2.5GB of "Phone" storage for apps so I started investigating (this is separate from "sdcard" data storage which is ~8GB). Turns out Chrome, at least on the HTC Amaze 4G with 4.0.3, takes up about 250MB - my largest installed app by about a factor of 4 (next largest was ~80MB). This was not cache or data, this was the app itself. I don't know what all they've moved into there as part of their push to cripple Android except as a host for the "Google Play Ecosystem," but crap like this is not endearing.

gcb0 12y ago
google is learning how to be evil with offline tech. online they just shutdown the old system. offline now they leave holes and announce them when they want you to upgrade. "for security"
hnha 12y ago
I am running out of space because Play Store and Google Framework get bigger and bigger. It fills me with rage how Google actively makes my old phone less capable over time for no benefit to me.
- oftenwrong 12y ago
  I lost the ability to write to my external sdcard when I got the kitkat upgrade. Of course rooting allowed me write access again. This is why the "rooting voids the warrant" policies are bullshit. When an upgrade is forced on a user, and removes critical functionality for no good reason, what is the user to do? I, for one, am never buying a locked down phone again. I'd rather not even have a phone.
- AjithAntony 12y ago
  Yeah. I was using a Nexus One for a long time until I had to prune so many apps due to space that it wasn't worth using. I got a new phone, HTC One S (I needed a t-mobile branded phone for wifi calling) with several gigs of system partition space, and now I have to play that game again. I recognize that there are a bunch of features now that I get to enjoy, but now I have to choose which ones I want to keep. When I switched, 20MB was a big app. Now I have at least 30 apps that are bigger. Chrome in particular seems bogus. The desktop version isn't even this big. Chrome : 211MB Facebook: 116MB Google search: 70MB Google+: 65MB Amazon: 60MB Mantano Reader: 54MB Dropbox: 50MB Google Play services: 50MB Google Text-to-speach engine: 45MB Hangouts: 35MB t-mobile my account: 33MB SwitftKey: 33MB Kindle: 30MB Evernote: 30MB BaconReader: 28MB twitter: 25MB Hulu: 25MB Google Maps: 24MB Google Drive: 24MB <...> I do recognize that these apps balance the data differently. Chrome is 189MB app, and facebook is 80MB data.

ck2 12y ago

If you haven't tried Firefox Fennec (android mobile) it is actually pretty good now. https://play.google.com/store/apps/details?id=org.mozilla.firefox https://play.google.com/store/apps/details?id=org.mozilla.fi... https://www.mozilla.org/en-US/firefox/partners/#android https://www.mozilla.org/en-US/firefox/partners/#android They make it for arm and x86 android. They used to make a windows version but sadly stopped that build.

aidenn0 12y ago
It crashes every time I hit the menu button. I sent in the crash report; I couldn't figure out where on mozilla's website to report mobile bugs though.
anonbanker 12y ago
Been using Firefox mobile for four months now, and forcefully removed both chrome and the vulnerable browser from my device about one month in. Slight battery drain issues, but those are almost all solved in recent releases. Definitely give it a try.

slingerofwheat 12y ago

Is anyone familiar with the code that allows this vulnerability to be present and where I can find it(I believe this project is open source)? I understand the exploit is adding a nullbyte at the beginning of some javascript due to some bad handling in the parsing code. So I'm looking here: https://android.googlesource.com/platform/packages/apps/Browser/+/master/src/com/android/browser https://android.googlesource.com/platform/packages/apps/Brow...

joev_ 12y ago
I don't know the exact location, but it is probably somewhere in the webview tree, since it affects apps that embed webviews as well: https://android.googlesource.com/platform/frameworks/base/+/jb-release/core/java/android/webkit/ https://android.googlesource.com/platform/frameworks/base/+/...
- smtddr 12y ago
  Since it's both webview and browser itself, I'd suspect some kind of common denominator object at fault... like...https://android.googlesource.com/platform/frameworks/base/+/jb-release/core/java/android/net/UrlQuerySanitizer.java https://android.googlesource.com/platform/frameworks/base/+/... Especially with a method called "public static class IllegalCharacterValueSanitizer".

pmontra 12y ago

This leaves us with little alternatives. Tint is affected. Dolphin is affected. Firefox is just horrible on mobile, come see this page and you'll understand why (they can't get font inflation right). Chrome and Opera are what's left. Anything else?

jarek 12y ago
I'm using Firefox on Android 4.4 as my full-time browser, it is rather good most of the time. TBH HN is the only site I can think of that gives me trouble... and knowing the authors' attitude to HTML I'm prepared to accept the fault is not Firefox's.
- pmontra 12y ago
  There are many font inflation bugs open on Firefox mobile. One of them was opened about HN https://bugzilla.mozilla.org/show_bug.cgi?id=707195 https://bugzilla.mozilla.org/show_bug.cgi?id=707195 in 2011. Others are about reddit. Others are about other sites. Firefox didn't grok a way to handle font inflation in a reasonable way. All the other browsers did. I quote a Firefox developer: ------ From a UX perspective, we should really try to fix this somehow. Reddit and ycombinator look terrible in our browser right now. Some examples: ycombinator http://cl.ly/0l2f2v0p3v0e290J0A0W http://cl.ly/0l2f2v0p3v0e290J0A0W Reddit http://cl.ly/1M452m2a2D3D04070S1I http://cl.ly/1M452m2a2D3D04070S1I These pages look perfectly fine in stock Browser -- they are a little wonky in Chrome but still better than us ------ https://bugzilla.mozilla.org/show_bug.cgi?id=707195#c27 https://bugzilla.mozilla.org/show_bug.cgi?id=707195#c27 That was 2012-05-01.
  - jarek 12y ago
    1) reddit renders fine for me now, zoom is consistent (Firefox 32, Android 4.4) 2) HN uses HTML straight out of 90s (tables nested three deep, spacer images to indent threads) so I don't mind them not focusing on trying to salvage it. Also from the comments thread: "to fix this we'd want to know the widths of the containers of all the text, which requires doing layout on the whole subtree (or at least a decent part of it), but we need to know the inflation numbers before we do layout. (It's probably doable by constructing reflow states for the entire subtree as we walk it, but that would be a significant performance hit that I don't think we want to take.)" Don't abuse tables and you won't have a problem.

diminish 12y ago

As Firefox saved us from dangerous browsing circa 2004m from IE5,6,7, now I may save us from obsolete Android stock browsers. At least that's what I use.

ZoFreX 12y ago
Unfortunately a lot of apps embed the Android browser as well, and you can't change that.

downandout 12y ago

Android has its merits, but more and more I am reminded of this aptly titled article (proudly mentioned by Tim Cook during the WWDC keynote): "Android Fragmentation Turning Devices Into a Toxic Hellstew of Vulnerabilities" [1]. These kinds of incredibly serious, system level issues are a significant competitive disadvantage, and they keep happening. Google needs to build fast security update requirements into their Android license agreements with device makers. At least then, when these things are discovered and publicized, tens of millions of people won't be left vulnerable. [1] http://www.zdnet.com/android-fragmentation-turning-devices-into-a-toxic-hellstew-of-vulnerabilities-7000028342/ http://www.zdnet.com/android-fragmentation-turning-devices-i...

Pxtl 12y ago
Even if they do fast vuln updates, what about older devices? Even Google only offers 2y of support.
- downandout 12y ago
  I think Google needs to change that as well. Android is seen as a second class OS by a large percentage of people, and these kinds of revelations only increase that percentage. Google can do better, but for whatever reason they aren't.
  - acdha 12y ago
    > Google can do better, but for whatever reason they aren't. s/aren't/choose not to/ This is simply bad management – we're talking, what, a single engineer to backport critical fixes and some testing support. Contrast that against the damage this has done to Android's competitiveness – even the non-nerds I know talk about how they bought an iOS device because Android never gets updates – and increases the likelihood that they'll have a major security problem at some point when someone creates widespread exploit affecting all of those abandoned phones and the headlines talk about how many millions of people are at risk for a problem which was reported years ago. The phone vendors and carriers had a large part in creating this problem but most of the reputation sticks to the platform and, as with the more general fragmentation problem, Google has been very slow to take it seriously.

Shofo 12y ago

If only Meego took off.

fidotron 12y ago

It was a mistake to put Webkit as an operating system level component in the first place. It would be better if the solution wasn't to push Chromium but a storage framework style pluggable component, mainly since they can't get stuff like text sizing right. Luckily since most vital user info is going to be in apps this doesn't have nearly the same impact as it would on desktop, but it does represent yet another demonstration that having the web as a sort of super-platform-on-a-platform doubles your attack surface. Android really is comparable to 90s era Windows, in every possible sense. For better or worse Chrome OS is clearly being positioned as the NT equivalent as well, but it's hard to see how you can recreate the functionality of Android without adopting the flaws too.

thejdude 12y ago

The general lack of updates is exactly why I use/install/recommend Firefox. That and the automatic syncing w/ Desktop and the regular performance improvements. (Chrome isn't an option. I can't even turn off third-party cookies. In 2014.) Too bad it uses quite a few resources and may be too heavy for low-end phones.

paulirish 12y ago

Just an update from the Google side: As discussed below, any Android users on 4.4+ or running Chrome are not affected. For earlier versions of Android, we've shipped patches for AOSP: https://android.googlesource.com/platform/external/webkit/+/1368e05e8875f00e8d2529fe6050d08b55ea4d87 https://android.googlesource.com/platform/external/webkit/+/... https://android.googlesource.com/platform/external/webkit/+/7e4405a7a12750ee27325f065b9825c25b40598c https://android.googlesource.com/platform/external/webkit/+/... These are in the AOSP branches for jb-dev, jb-mr1-dev, jb-mr1.1-dev, and jb-mr2-dev.

junktest 12y ago
is android kitkat 4.4.x safe from this bug regardless of whether chrome browser exists (not installed or uninstalled) in the phone or not? please enlighten. thanks.
- joev_ 12y ago
  My understanding is that Chrome replaced Webkit in WebView's internal implementation in 4.4, so the bug should never appear in 4.4.
  - paulirish 12y ago
    Yup correct. Completely different WebView. And the bug is technically in the WebView.
schwarze_pest 12y ago
Does this mean that there will be an update for the Galaxy Nexus?
- aiiane 12y ago
  OS updates for $SPECIFIC_PHONE are generally reliant on the carrier to decide to push out a patch, even after AOSP itself is patched. So an answer "from the Google side" can't really answer your question.