Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

community.rapid7.com

Post reply on HN
Print view View original

11–20 of 232 posts

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#11

Post by kb120 »

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#12

Post by dozy »

iancarroll wrote: post #6
takeda wrote: post #5

Earlier quoted context omitted.

You can try Opera Mobile Classic, it's important to use classic version since the new Opera Mobile uses the same engine as chrome so it might have the same vulnerabilities.

AOSP != Chrome, right? ...

Correct. Chrome is a separate project from the AOSP.

That said, Android 4.4 and later use Chromium for their WebViews, the source for which is developed along with Chrome as a part of the Chromium project - it does not live in AOSP.

Presumably the stock browser that is in AOSP 4.4+ wraps Chromium, which more or less means the AOSP browser is Chrome...but not the other way around. :)

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#14

Post by jamroom »

kb120 wrote: post #11

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

Most "normal" people assume whatever browser comes with Android is "Google's Browser" (right or wrong), so this could be a very big deal to A LOT of people. How many Android handset manufactures have shipped units with the AOSP browser as the default?

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#15

Post by steakejjs »

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy.

If you would like to test on your device/browser, you can on ejj.io/SOP.php . If you click on the button and you see an alert box, you're vulnerable (I doubt many on HN will....)

Many other browser's also seem to be vulnerable. So if you use something else best be safe and check yourself

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#16

Post by untog »

kb120 wrote: post #11

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

"a browser that isn't supported by Google"

But still a browser that was created by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android https://developer.android.com/about/dashboards/index.html?ut...

Just because Google decided not to support it any more doesn't mean they shouldn't. Pointing out Firefox and Opera is all very well, but this is the default browser on Android It's also the browser engine used in embedded webviews, don't forget.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#17

Post by Zigurd »

allegory wrote: post #10

It's this sort of thing that puts me off Android as a platform. Even my mother got sold a 2.2 handset recently (Samsung Galaxy Ace) that hasn't been patched for the best part of 3 years. You never know when you're going to end up with a lemon on your hands. Big jump to this conclusion but I'm more inclined to trust Microsoft at the moment as they have a better reputation for lifetime (unlike Android), have a very pub…

Android One is meant to make it simple for lo-end OEMs to ship high quality implementations of up-to-date Android and keep up with new releases. It's hard to migrate a huge OEM ecosystem to that kind of program quickly.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#20

Post by sitkack »

kb120 wrote: post #11

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

So on 90% of phones when someone opens "the web" using the browser installed on their device, they are using an unsupported browser. How would they know this?
Post reply on HN