Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#1

Post by zhongjiewu » Sat, Jan 25, 2014, 12:26 AM UTC

Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks
blog.trustlook.com

Re: Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#2

Post by xinbenlv » Sat, Jan 25, 2014, 12:38 AM UTC

That is shocking

Re: Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#3

Post by eric_hu » Sat, Jan 25, 2014, 1:04 AM UTC

MSFT sucks big time, and I'm glad someone found out about it.. Many thanks to trustlook.com

Re: Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#4

Post by zhongjiewu » Sat, Jan 25, 2014, 1:07 AM UTC

Sounds like very dangerous attack and not very difficult to implement.

DNS hijacking:

1. Quicker DNS response than router to pollute the Android's DNS

2. Rouge AP that pretend to be common free public wifi like "att", "starbucks", "cablewifi" or "Free Public WiFi"

3. De-authenticate valid AP connections and force user to try rouge WIFI

MITM attack: 1. ARP spoofing

Re: Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#5

Post by trustlook » Sat, Jan 25, 2014, 1:10 AM UTC

zhongjiewu wrote: post #4

Sounds like very dangerous attack and not very difficult to implement. DNS hijacking: 1. Quicker DNS response than router to pollute the Android's DNS 2. Rouge AP that pretend to be common free public wifi like "att", "starbucks", "cablewifi" or "Free Public WiFi" 3. De-authenticate valid AP connections and force user to try rouge WIFI MITM attack: 1. ARP spoofing

Correct ;-)

Re: Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#6

Post by iagox86 » Sat, Jan 25, 2014, 1:32 AM UTC

"There's a horrible vulnerability in the Bing app! ...but we're not going to give you any details."

I hate stories like that.

Re: Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#7

Post by stormbrew » Sat, Jan 25, 2014, 1:37 AM UTC

There's a bing app?

(sorry, had to do it)

Re: Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#8

Post by click170 » Sat, Jan 25, 2014, 1:43 AM UTC

"Warning: infected app! download and install our app to protect yourself!"

thank god there is an app to protect... wait a minute... where have I seen these tactics used before...

Re: Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#9

Post by joshbaptiste » Sat, Jan 25, 2014, 1:48 AM UTC

Hmm.. interesting, well luckily I don't use Bing app, I don't even use Bing on a normal browser. It just sounds wierd to me for some reason .. "Ok Ima Bing that information right now!".

Re: Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

#10

Post by vezzy-fnord » Sat, Jan 25, 2014, 1:50 AM UTC

trustlook wrote: post #5

zhongjiewu wrote: post #4

Sounds like very dangerous attack and not very difficult to implement. DNS hijacking: 1. Quicker DNS response than router to pollute the Android's DNS 2. Rouge AP that pretend to be common free public wifi like "att", "starbucks", "cablewifi" or "Free Public WiFi" 3. De-authenticate valid AP connections and force user to try rouge WIFI MITM attack: 1. ARP spoofing

Correct ;-)

That's a universal network attack though, how is it an exclusive vulnerability to this app?