Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Android 'root' phones via dirtyc0w exploit

gist.github.com

Post reply on HN
Print view View original

61–70 of 72 posts

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#61

Post by daveloyall »

sdrothrock wrote: post #5
jmickey wrote: post #3

Earlier quoted context omitted.

Well if you can run any executable as root, that sure counts as rooting in my book.

The advantage I see here is that you don't have to actually root your phone, which means that apps/games that check for root access would continue to work normally.

I've always wondered: what exactly are they checking for?

What's the difference between "I can become the root user on my phone whenever I want" and "My phone is rooted"?

Note: I'm asking as a GNU/Linux user, not as a phone user.

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#62

Post by daveloyall »

digi_owl wrote: post #54
cyphar wrote: post #19

Earlier quoted context omitted.

It's painful to read. Only one person in that thread appears to know what SELinux actually does, and nobody has mentioned the fact that SELinux was explicitly designed to make a root privesc contained. The ironic part is that since DirtyCOW is a kernel bug they could probably modify the exploit to disable SELinux from inside the kernel (or load a module that disables SELinux). But they're just trying to use the PoC a…

Welcome to the world of phone firmware modding. I suspect you got much the same back in the microcomputer era. Just look at the various phreaker stuff salvaged from BBSs.

Well at least these github repos and gists are an improvement beyond "here, download this .apk from megaupload and install it!"

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#63

Post by daveloyall »

therein wrote: post #31
omribahumi wrote: post #18

Earlier quoted context omitted.

Maybe I'm missing something here, but what stops you from putting a setuid "su" binary and keeping the root access, even if the kernel is upgraded?

You're root running in a limited selinux context.

Are you saying that on Android, you can achieve UID=0 via this exploit, but still not write to anywhere important on the device?

What are these different "methods" listed in the table here?

https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

Can one of those methods allow me to write to some file in /etc? (Which is enough to grant me the access I want, unless selinux is just MAGIC.)

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#64

Post by ommunist »

lnx01 wrote: post #37
ommunist wrote: post #8

Earlier quoted context omitted.

Forgive my ignorance, how this is possible on iOS?

Rowhammer rapidly flips bits in RAM. The bits that are rapidly flipped are chosen for their proximity to the physical transistors which store the UID. By flipping the bit near the transistors storing the UID very quickly, it's possible to induce a bit flips in the UID value itself and gain root access. This is a flaw inherent to DRAM, and it completely OS independent. It's a hardware level exploit.

Thank you for the explanation. But will it not disable automatic updates, and AppStore functionality, since UID will loose its integrity?

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#65

Post by gcb0 »

bastijn wrote: post #11

I wonder how many people carelessly run a script that downloads, builds, and executed something with root access. If that zip gets compromised (i.e. The source means harm) there is no end to the pain a careless user can endure. It is like blindly copying and running shell commands you don't understand with sudo rights. My intention is not to offend the author by the way :). It is to remind people to understand these…

not much different than any app store, which not even the author can validate the binary wasn't changed

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#66

Post by gcb0 »

pja wrote: post #45
w23j wrote: post #38

So I have a Galaxy Nexus, which does not get OS Updates anymore (Android 4.3 at the moment). Do I understand correctly that vulnerabilities like this one mean I do not have any protection when I install an App on my phone? I mean the Android permissions system is useless, when any App can just use an exploit to get root isn't it? Sorry for the beginner question, I am just hoping I am missing something.

Pretty much. This is one of the reasons people install CyanogenMod on their phones: to get security updates to devices that the supplier has stopped supporting.

which shows how "just don't install 3rd party" argument is pure noxious bs.

i trust apps i install from f-droid more than the playstore.

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#67

Post by Arinerron »

Okay, sorry guys. I know it's broken right now. The problem is that wget and unzip commands aren't being used properly. I can't fix it on my phone, because the editor isn't working. I won't have computer access till tonight (it's 4PM here, and I'm at school). Really sorry about the delay!

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#68

Post by sdrothrock »

daveloyall wrote: post #61
sdrothrock wrote: post #5

Earlier quoted context omitted.

The advantage I see here is that you don't have to actually root your phone, which means that apps/games that check for root access would continue to work normally.

I've always wondered: what exactly are they checking for? What's the difference between "I can become the root user on my phone whenever I want" and "My phone is rooted"? Note: I'm asking as a GNU/Linux user, not as a phone user.

http://www.cs.ucr.edu/~zhiyunq/pub/ccs15_root_providers.pdf

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#69

Post by daveloyall »

sdrothrock wrote: post #68
daveloyall wrote: post #61

Earlier quoted context omitted.

I've always wondered: what exactly are they checking for? What's the difference between "I can become the root user on my phone whenever I want" and "My phone is rooted"? Note: I'm asking as a GNU/Linux user, not as a phone user.

http://www.cs.ucr.edu/~zhiyunq/pub/ccs15_root_providers.pdf

2015-08-20. The document describes analysis performed on those apps which root your phone for you.

Thanks!

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#70

Post by Arinerron »

Arinerron wrote: post #67

Okay, sorry guys. I know it's broken right now. The problem is that wget and unzip commands aren't being used properly. I can't fix it on my phone, because the editor isn't working. I won't have computer access till tonight (it's 4PM here, and I'm at school). Really sorry about the delay!

Okay, should be working now. If you have any issues, feel free to comment them here: https://gist.github.com/Arinerron/0e99d69d70a778ca13a0087fa6...
Post reply on HN