Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

community.rapid7.com

Post reply on HN
Print view View original

71–80 of 232 posts

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#71

Post by TD-Linux »

yeahforbes wrote: post #22
steakejjs wrote: post #15

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If y…

I have a browser called InBrowser and it gives an alert on your test page. Maybe it wraps AOSP? I don't have "Browser" in my list of apps though, it came with Chrome instead and I installed InBrowser myself. (Android 4.1.2)

Almost all third-party browsers on the Play Store wrap the Android WebView, which is vulnerable. You'll need to use a browser that includes its own rendering engine, such as Firefox, to remain secure.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#72

Post by zmmmmm »

guelo wrote: post #66
ufmace wrote: post #42

Earlier quoted context omitted.

Could they update it, though? I thought part of the reason they went to Chrome is that the AOSP browser is baked into the OS and so not updateable without updating the whole OS. So to patch it, they'd have to update the OS, but if you're doing that, then why not just move to the latest OS, which is already fixed?

Yes they can update it. Android provides an update mechanism for system apps.

They can update the "Android Browser" app, but the flaw is in a system level component (the Android WebView). They might be able to mitigate the flaw with an update to the app, but all other applications (including any OEM shipped browser that utilises the system web view) would still be vulnerable.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#73

Post by chadzawistowski »

rsync wrote: post #68
kb120 wrote: post #11

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

"So the bug is only for a browser that isn't supported by Google?" Wait, what ? I'm not an android user, but I am a chrome user on all of my desktops ... can someone enlighten me ? How is chrome not a browser supported by google ?

AOSP Browser is the unsupported one. Google deprecated it in favor of Chrome.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#74

Post by azernik »

gcb0 wrote: post #62
azernik wrote: post #53

Earlier quoted context omitted.

It is very very close: https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo... tl;dr: Chromium is Chrome minus: 1. Crash/usage reporting to Google. 2. Proprietary video format support 3. Embedded Flash implementation (which doesn't exist on mobile anyway). 4. Google API keys. If what you care about is security auditability, that's pretty good. If you care about running only open source software, that's going…

> If you care about running only open source software, that's going to be very hard to do in the Android/Google-Play ecosystem. yet, the main advertisement google trhows for android is "open source" "community driven" yadda yadda

Main advertisement? I just went to android.com and developer.android.com; android.com advertises "Google built in" and lots of platforms, with a very small link to AOSP at the bottom of the page; developer.android.com has an AOSP link buried in its menus.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#76

Post by spydum »

rsync wrote: post #68
kb120 wrote: post #11

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

"So the bug is only for a browser that isn't supported by Google?" Wait, what ? I'm not an android user, but I am a chrome user on all of my desktops ... can someone enlighten me ? How is chrome not a browser supported by google ?

This is not a bug in Chrome, but a bug in AOSP which was the browser shipped with android before Chrome became the default.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#77

Post by meowface »

zmmmmm wrote: post #72
guelo wrote: post #66

Earlier quoted context omitted.

Yes they can update it. Android provides an update mechanism for system apps.

They can update the "Android Browser" app, but the flaw is in a system level component (the Android WebView). They might be able to mitigate the flaw with an update to the app, but all other applications (including any OEM shipped browser that utilises the system web view) would still be vulnerable.

I imagine this would be fixable with an Android OS patch, no? I think this is critical enough to warrant that.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#78

Post by mbq »

legohead wrote: post #63
allegory wrote: post #10

It's this sort of thing that puts me off Android as a platform. Even my mother got sold a 2.2 handset recently (Samsung Galaxy Ace) that hasn't been patched for the best part of 3 years. You never know when you're going to end up with a lemon on your hands. Big jump to this conclusion but I'm more inclined to trust Microsoft at the moment as they have a better reputation for lifetime (unlike Android), have a very pub…

Yes, this continues to be a problem that I hope Google addresses somehow. I got the Samsung Galaxy Nexus because I assumed it would be kept up to date with the latest Android version, since it's using the Google brand 'Nexus' name. I even asked the sales representative if it would be kept up to date (knowing I couldn't trust them, but was looking for any extra assurance), and they said yes. Right now it's at 4.3 and…

Just switch to CyanogenMod or other custom compilation; there is a gain from Nexus brand in the ease of unlocking bootloader (;

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#79

Post by slingerofwheat »

Is anyone familiar with the code that allows this vulnerability to be present and where I can find it(I believe this project is open source)? I understand the exploit is adding a nullbyte at the beginning of some javascript due to some bad handling in the parsing code. So I'm looking here: https://android.googlesource.com/platform/packages/apps/Brow...

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#80

Post by JetSpiegel »

kb120 wrote: post #50
EpicEng wrote: post #34

Earlier quoted context omitted.

Who, engineers? Certainly not my wife or anyone else I have ever met who isn't technical.

My grandmother managed to switch entirely to Chrome on her PC without the help of anyone in our family. Anecdotal evidence works both ways. It isn't 1998. Most people know what a browser is and which one they are using on their desktop. Making the leap to a second browser on a phone (where they can easily get it from Google Play) isn't that ridiculous.

Chrome on Desktop has adapted several malware techniques to get installed without the user noticing. Bundled by default in many installers, including Flash, installs with user permissions only.
Post reply on HN