Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Potentially rogue binary" in Sprint Evo

unrevoked.com

Post reply on HN
Print view View original

11–20 of 23 posts

Re: "Potentially rogue binary" in Sprint Evo

#11

Post by dandelany »

mahmud wrote: post #5

Look, if your backdoor binary sits in /usr/bin or similar in a file system, you really have no business writing backdoors. Sprint could have the same functionality built into the kernel and no one would have noticed it. It's actually a good thing it's not running by default. I would snoop around further and see how it's launched; the command list only has the shutdown commands, not the launcher. Without the trigger y…

That's what makes me believe the "leftover debugger" explanation... If they were doing it maliciously, they probably would have hidden it a little better. One would think. Either that or they're malicious and incompetent.

Re: "Potentially rogue binary" in Sprint Evo

#12

Post by joubert »

po wrote: post #8
jchonphoenix wrote: post #2

What's unstated here but recognized by unrevoked is that Sprint had skyagent purposefully on their phones so that they could easily gain root access and keep their phones under their command.

If is recognized by unrevoked that that is true, then why does it state, "At this time, we believe that skyagent was a debugging binary left over from manufacture. We have been consistently impressed with the actions taken by Google, Sprint, and HTC to expeditiously resolve this issue."

But a few paragraphs later they write:

However, the security vulnerabilities present in skyagent are of less cause for concern than the purpose of the program. It appears that the binary was designed as a backdoor into the phone, allowing remote control of the device without the user's knowledge or permission. When the program is invoked, it listens for connections over TCP (by default, port 12345, on all interfaces, including the 3G network!) that accepts a fixed set of commands. These commands appear to be authenticated only by a fixed “magic number”; the commands are neither encrypted on the way to the device or on the way back. The commands that we have knowledge of at this time include:

sending and monitor user tap and drag input (“PentapHook”), sending key events (“InputCapture”), dumping the framebuffer (“captureScreen”), listing processes (“GetProc”), rebooting the device immediately, and executing arbitrary shell commands as root (“LaunchChild”)

Re: "Potentially rogue binary" in Sprint Evo

#14

Post by po »

joubert wrote: post #12
po wrote: post #8

Earlier quoted context omitted.

If is recognized by unrevoked that that is true, then why does it state, "At this time, we believe that skyagent was a debugging binary left over from manufacture. We have been consistently impressed with the actions taken by Google, Sprint, and HTC to expeditiously resolve this issue."

But a few paragraphs later they write: However, the security vulnerabilities present in skyagent are of less cause for concern than the purpose of the program. It appears that the binary was designed as a backdoor into the phone, allowing remote control of the device without the user's knowledge or permission. When the program is invoked, it listens for connections over TCP (by default, port 12345, on all interfaces,…

OK yeah that's a bit creepy. I missed that part. Why do they seemingly absolve them of any suspicion earlier in the report? I still feel like we should trust the judgement of the reporters. They're taking a measured response to this.

Re: "Potentially rogue binary" in Sprint Evo

#15

Post by illumin8 »

joubert wrote: post #12
po wrote: post #8

Earlier quoted context omitted.

If is recognized by unrevoked that that is true, then why does it state, "At this time, we believe that skyagent was a debugging binary left over from manufacture. We have been consistently impressed with the actions taken by Google, Sprint, and HTC to expeditiously resolve this issue."

But a few paragraphs later they write: However, the security vulnerabilities present in skyagent are of less cause for concern than the purpose of the program. It appears that the binary was designed as a backdoor into the phone, allowing remote control of the device without the user's knowledge or permission. When the program is invoked, it listens for connections over TCP (by default, port 12345, on all interfaces,…

Typical debugging routines. It's fairly obvious some developer wrote this to troubleshoot devices and they forgot to remove it from the final golden master build.

This happens a lot, and there is nothing malicious about it. Now, if they had spawned this process from init and left it running on all phones leaving the factory, that would be another story.

Re: "Potentially rogue binary" in Sprint Evo

#16

Post by Mrcurious »

mmastrac wrote: post #9

I'm part of the team that found this backdoor. A few points: 1. "Never Trust Sprint Again" is editorializing on the part of the submitter, not our stance. It's a very, very crappy thing to put on a phone, but there's no evidence it was placed there maliciously. 2. It was released in the wild on the HTC Hero for some time. We believe it would have been in the wild on the EVO if we hadn't reported it. 3. Sprint was ver…

This looks like an automated debugging/testing tool that should not have made it to a production build to me. Is there anything that points in or away from that possibility? Pentaps seems extraneous for a backdoor...

Re: "Potentially rogue binary" in Sprint Evo

#17

Post by ramchip »

joubert wrote: post #12
po wrote: post #8

Earlier quoted context omitted.

If is recognized by unrevoked that that is true, then why does it state, "At this time, we believe that skyagent was a debugging binary left over from manufacture. We have been consistently impressed with the actions taken by Google, Sprint, and HTC to expeditiously resolve this issue."

But a few paragraphs later they write: However, the security vulnerabilities present in skyagent are of less cause for concern than the purpose of the program. It appears that the binary was designed as a backdoor into the phone, allowing remote control of the device without the user's knowledge or permission. When the program is invoked, it listens for connections over TCP (by default, port 12345, on all interfaces,…

Isn't your comment fully supporting the previous poster?

It sounds a lot more like a debugging tool than a malevolent program: a backdoor sitting in an obvious folder, with an easy default port and no encryption, that allows to see system status, events, or run commands. Also, "We do not believe that skyagent could ever be invoked remotely".

Re: "Potentially rogue binary" in Sprint Evo

#18

Post by joubert »

ramchip wrote: post #17
joubert wrote: post #12

Earlier quoted context omitted.

But a few paragraphs later they write: However, the security vulnerabilities present in skyagent are of less cause for concern than the purpose of the program. It appears that the binary was designed as a backdoor into the phone, allowing remote control of the device without the user's knowledge or permission. When the program is invoked, it listens for connections over TCP (by default, port 12345, on all interfaces,…

Isn't your comment fully supporting the previous poster? It sounds a lot more like a debugging tool than a malevolent program: a backdoor sitting in an obvious folder, with an easy default port and no encryption, that allows to see system status, events, or run commands. Also, "We do not believe that skyagent could ever be invoked remotely".

Curious name for a "debugging tool", but maybe that's just me.

Re: "Potentially rogue binary" in Sprint Evo

#19

Post by Turing_Machine »

mmastrac wrote: post #9

I'm part of the team that found this backdoor. A few points: 1. "Never Trust Sprint Again" is editorializing on the part of the submitter, not our stance. It's a very, very crappy thing to put on a phone, but there's no evidence it was placed there maliciously. 2. It was released in the wild on the HTC Hero for some time. We believe it would have been in the wild on the EVO if we hadn't reported it. 3. Sprint was ver…

Clarification request: I don't have one of these phones, but have friends who do. Are the OTA updates installed automatically, or do they need to take some action (e.g. run a software update app or the like)?

Re: "Potentially rogue binary" in Sprint Evo

#20

Post by mmastrac »

Turing_Machine wrote: post #19
mmastrac wrote: post #9

I'm part of the team that found this backdoor. A few points: 1. "Never Trust Sprint Again" is editorializing on the part of the submitter, not our stance. It's a very, very crappy thing to put on a phone, but there's no evidence it was placed there maliciously. 2. It was released in the wild on the HTC Hero for some time. We believe it would have been in the wild on the EVO if we hadn't reported it. 3. Sprint was ver…

Clarification request: I don't have one of these phones, but have friends who do. Are the OTA updates installed automatically, or do they need to take some action (e.g. run a software update app or the like)?

If you're running stock (or close to stock firmware), you'll get a popup notification saying there's an update available. If you haven't received one for a few days, you're more than likely up-to-date.
Post reply on HN