31–40 of 72 posts
Earlier quoted context omitted.
Sure, but as soon as it's patched out, you're back to no root.
Maybe I'm missing something here, but what stops you from putting a setuid "su" binary and keeping the root access, even if the kernel is upgraded?
I wonder how many people carelessly run a script that downloads, builds, and executed something with root access. If that zip gets compromised (i.e. The source means harm) there is no end to the pain a careless user can endure. It is like blindly copying and running shell commands you don't understand with sudo rights. My intention is not to offend the author by the way :). It is to remind people to understand these…
From looking at the script and the makefile : you don't need to be root
Earlier quoted context omitted.
Thanks! What kind of warning message would you suggest? A "the exploit might be compromised" message, a "verify your download with this hash" message, or something else?
One thing you can do is simply fork the repo, and use your repo as the path in the script. So you're not at the mercy of upstream author's changes.
For those who didn't see it: I didn't write this exploit, I just wrote this script that automates the exploit. The repository with the actual exploit is here https://goo.gl/f8HdO7, and the script to automate it is here https://goo.gl/r2dFia .
For those who didn't see it: I didn't write this exploit, I just wrote this script that automates the exploit. The repository with the actual exploit is here https://goo.gl/f8HdO7, and the script to automate it is here https://goo.gl/r2dFia .
The first goo.gl link is dead for me... Care to give the real link instead of a shortened URL? Edit as noted elsewhere, should be https://github.com/timwr/CVE-2016-5195
Technically, this is not specific to Android phones. It's a hardware flaw and also possible on iOS. edit: Correct, I was confusing it with Row Hammer.
Forgive my ignorance, how this is possible on iOS?
Do I understand correctly that vulnerabilities like this one mean I do not have any protection when I install an App on my phone? I mean the Android permissions system is useless, when any App can just use an exploit to get root isn't it?
Sorry for the beginner question, I am just hoping I am missing something.
Earlier quoted context omitted.
Forgive my ignorance, how this is possible on iOS?
Rowhammer rapidly flips bits in RAM. The bits that are rapidly flipped are chosen for their proximity to the physical transistors which store the UID. By flipping the bit near the transistors storing the UID very quickly, it's possible to induce a bit flips in the UID value itself and gain root access. This is a flaw inherent to DRAM, and it completely OS independent. It's a hardware level exploit.
So I have a Galaxy Nexus, which does not get OS Updates anymore (Android 4.3 at the moment). Do I understand correctly that vulnerabilities like this one mean I do not have any protection when I install an App on my phone? I mean the Android permissions system is useless, when any App can just use an exploit to get root isn't it? Sorry for the beginner question, I am just hoping I am missing something.