Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android libstagefright still exploitable

blog.exodusintel.com

Post reply on HN
Print view View original

51–60 of 150 posts

Re: Android libstagefright still exploitable

#51

Post by ocdtrekkie »

eropple wrote: post #41
ocdtrekkie wrote: post #38

Earlier quoted context omitted.

And for those of us who don't want Lollipop, we'll never be offered the update. We have to either accept a bad system "upgrade" or stay insecure.

I feel for people whose providers won't upgrade them and I think they've got a good complaint, but if you choose to get off the upgrade path I think it's reasonable to assert that you're assuming responsibility for your own choices and security. I expect it can be backported to 4.x via custom ROMs for folks in that spot.

Here's the problem: It's a DROID Turbo. It's locked down by Verizon/Motorola, and neither root nor bootloader unlock has been achieved. So it's not even an option.

The problem is that the "upgrade path" and the "security fix" path need to be separate things. People should not be forced to have their device changed in an unacceptable manner (I did not buy a device with 'material design' for a reason, and being forced to get it to get a security fix is an unacceptable situation.)

Re: Android libstagefright still exploitable

#53

Post by kreutzwj »

canistr wrote: post #34
kreutzwj wrote: post #11

Earlier quoted context omitted.

Agreed. There is a major issue, not sure if in the rest of the world, but in Canada, the service provider has to request, and commonly pay for, the patch to which the manufacturer completes and then the service provider then pushes out to their devices. At least that is how it was when the E911 issue happened, it may be better now, but knowing Telecoms in Canada, I wouldn't be surprised if it wasn't.

It's not better. Look at the proposed target released dates for StageFright patches by Telus. And considering that it is not even fully patches, this only adds to the insanity of the situation with regards to Android fragmentation and carrier's controlling releases. http://forum.telus.com/thread/54211/category/top/board/Mobil... OEM Model Target Release HTC One M7 August 14th HTC One M8 August 14th HTC One M9 August…

Yeah, I just checked Rogers, it looks even worse and not even updated for if it is completed.

http://communityforums.rogers.com/t5/forums/forumtopicpage/b...

Re: Android libstagefright still exploitable

#54

Post by ocdtrekkie »

oconnor663 wrote: post #43
ocdtrekkie wrote: post #26

Earlier quoted context omitted.

Because withholding security updates over accepting horrifically invasive UI and branding changes is unacceptable. Similar to Microsoft still patching Vista nearly ten years later, Google should be obligated to deliver security patches to all versions of Android within a reasonable timeframe.

I think it's more difficult to patch old versions of Android than you're suggesting. You can't just backport a few lines of code and hope for the best. You have to maintain all the testing infrastructure that you had in place back when that version was supported, to avoid introducing new bugs with your change. And if you're releasing a security fix, you now have to coordinate that release across all versions that wer…

Google released a patch for Stagefright for 4.4.x anyways. So this is not the reason. The problem is that Android is currently flawed in implementation in that it treats security fixes and system upgrades the same way. There's only one "path" to get updates. So by blocking 5.1, I also don't get a Stagefright fix for my 4.4, even though a fix for 4.4 already exists.

Also, companies like Microsoft do charge extra for supporting old versions. Specifically, versions OVER TEN YEARS OLD. (Vista security updates are still free!) However, Google does not properly support OS versions released within the last year, which is drastically worse.

Re: Android libstagefright still exploitable

#55

Post by beagle3 »

eropple wrote: post #41
ocdtrekkie wrote: post #38

Earlier quoted context omitted.

And for those of us who don't want Lollipop, we'll never be offered the update. We have to either accept a bad system "upgrade" or stay insecure.

I feel for people whose providers won't upgrade them and I think they've got a good complaint, but if you choose to get off the upgrade path I think it's reasonable to assert that you're assuming responsibility for your own choices and security. I expect it can be backported to 4.x via custom ROMs for folks in that spot.

It's not just a providers. I've got a couple of el-cheapo $80 Androids just a month ago to use while traveling. They're running 4.4, Android 5 is not at all being offered for them, and probably never will. I guess I can throw them in the trash if I care about owning them myself.

Being el-cheapos, they aren't even supported by cyanogenmod. Anyone has an idea for how to use them (somewhat) securely?

Re: Android libstagefright still exploitable

#56

Post by autobahn »

johansch wrote: post #13

Things like this is why I trust an iPhone enough to handle two-factor auth for banking (in Sweden: "Mobil BankId"), but not an Android device. I hope Google will raise the security level now that they have reached global dominance, in no small part through lax security (as a consequence to their liberal licensing models).

because somehow magically an iphone is more secure because reasons?

I agree that iphone's patching model is superior to android, but your statement shows a bit of ignorance.

Re: Android libstagefright still exploitable

#57

Post by cwyers »

eropple wrote: post #41
ocdtrekkie wrote: post #38

Earlier quoted context omitted.

And for those of us who don't want Lollipop, we'll never be offered the update. We have to either accept a bad system "upgrade" or stay insecure.

I feel for people whose providers won't upgrade them and I think they've got a good complaint, but if you choose to get off the upgrade path I think it's reasonable to assert that you're assuming responsibility for your own choices and security. I expect it can be backported to 4.x via custom ROMs for folks in that spot.

It's not an apples-to-apples comparison, but Android has been around since 2007, and they're up to API level 22 right now. In that same time period, Microsoft has had the following releases of Windows (excluding Mobile/Phone and Server):

Vista, which actually came out in 2006 in the OEM edition Windows 7 Windows 8 Windows 8.1 Windows 10

Windows has had a much slower release cadence than Android. It's a much, much bigger burden on Google to continue to support older Android versions with bugfixes and security patches than it is Windows. Now, you can counter that Google decided on this release cadence, but still, I don't think it's reasonable to expect Google to support Android versions as long as Microsoft does Windows versions, as some here are stumping for.

(That said, every time I read an article about Android these days I get the urge to buy a Windows Phone.)

Re: Android libstagefright still exploitable

#58

Post by semenko »

ajross wrote: post #40
jimrandomh wrote: post #7

Summary: A little over two weeks ago, it was publicly disclosed that MMS messages can cause Android phones to decode video with libstagefright, which is a C++ library with vulnerabilities and insufficient sandboxing, leading to remote code execution without user interaction. Today, Exodus Intelligence is reporting that the patch to fix one of these vulnerabilities does not, in fact, fix it. Thus, all Android phones a…

I'm still unclear on the sandboxing assertion. The mediaserver in current versions is, in fact, pretty well isolated. I've had to work around and defeat lots of this protection for debugging purposes in my professional life, so I know it's there. IIRC you can't read system or app data outside the sdcard area, you can't write anywhere persistent. You can open network sockets and make binder requests, which is not triv…

The isolation seems mostly defined by this SELinux policy: https://github.com/android/platform_system_core/blob/lollipo...

   service media /system/bin/mediaserver
       class main
       user media
       group audio camera inet net_bt net_bt_admin net_bw_acct drmrpc mediadrm
       ioprio rt 4
You'd need another exploit to elevate from SELinux (and I think send MSSes for a self-propagating worm). Though given Android's abysmal patching, most Android kernels are also terribly outdated...

Re: Android libstagefright still exploitable

#59

Post by redwards510 »

johansch wrote: post #13

Things like this is why I trust an iPhone enough to handle two-factor auth for banking (in Sweden: "Mobil BankId"), but not an Android device. I hope Google will raise the security level now that they have reached global dominance, in no small part through lax security (as a consequence to their liberal licensing models).

How do you think jailbreaking is accomplished?

Re: Android libstagefright still exploitable

#60

Post by ocdtrekkie »

cwyers wrote: post #57
eropple wrote: post #41

Earlier quoted context omitted.

I feel for people whose providers won't upgrade them and I think they've got a good complaint, but if you choose to get off the upgrade path I think it's reasonable to assert that you're assuming responsibility for your own choices and security. I expect it can be backported to 4.x via custom ROMs for folks in that spot.

It's not an apples-to-apples comparison, but Android has been around since 2007, and they're up to API level 22 right now. In that same time period, Microsoft has had the following releases of Windows (excluding Mobile/Phone and Server): Vista, which actually came out in 2006 in the OEM edition Windows 7 Windows 8 Windows 8.1 Windows 10 Windows has had a much slower release cadence than Android. It's a much, much big…

The fact that Google created a huge maintenance burden for themselves shouldn't absolve them of responsibility to provide that maintenance.

Microsoft supports Windows versions for ten years, and I agree that's crazy for Android. However, three years I feel is a bare minimum expectation. Devices tend to remain on the market for about a year, and the standard phone contract is two years. So three years from a version release should cover the vast majority of users for the life of their device, should they choose not to take "system upgrades" which may slow their device or change it in an unwanted manner.

Post reply on HN