Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

community.rapid7.com

Post reply on HN
Print view View original

111–120 of 232 posts

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#111

Post by jamesisaac »

legohead wrote: post #63
allegory wrote: post #10

It's this sort of thing that puts me off Android as a platform. Even my mother got sold a 2.2 handset recently (Samsung Galaxy Ace) that hasn't been patched for the best part of 3 years. You never know when you're going to end up with a lemon on your hands. Big jump to this conclusion but I'm more inclined to trust Microsoft at the moment as they have a better reputation for lifetime (unlike Android), have a very pub…

Yes, this continues to be a problem that I hope Google addresses somehow. I got the Samsung Galaxy Nexus because I assumed it would be kept up to date with the latest Android version, since it's using the Google brand 'Nexus' name. I even asked the sales representative if it would be kept up to date (knowing I couldn't trust them, but was looking for any extra assurance), and they said yes. Right now it's at 4.3 and…

Same situation here. I could put up with outdated Android version, gradually deteriorating performance, and bloating of apps leading to very little free space, but it's very disappointing to find out that even to remain secure, we're expected to shell out at every stage of Google's 12-month release cycle...

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#112

Post by jamesisaac »

blocke wrote: post #95
npizzolato wrote: post #88

Earlier quoted context omitted.

And Nexus was meant to make it simpler for Google to ship updates directly to users, rather than having to go through OEMs. If Google can't keep their own phones up to date, do you expect Android One to be any different?

The only Nexus phones here that don't already have a fix available is the phone they announced as being end of life. 4.4 is not affected and is available for the Nexus 4, 5, both generations of 7 and I believe the 10. Dear Galaxy Nexus users... It's time to let go.

The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies?

Don't think I've ever owned anything with such a serious planned obscolence issue. Windows supports its OS releases for 12 years (and doesn't lock you in, so you can usually follow official upgrade procedure anyway). And anything "dumber" than a smartphone doesn't really open itself up to these gaping security flaws, so still operates fine after many years.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#113

Post by owenversteeg »

steakejjs wrote: post #15

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If y…

Clickable: http://ejj.io/SOP.php

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#114

Post by 27182818284 »

kb120 wrote: post #11

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

>. If security is such a big deal to a user they should use a browser that is supported by a strong development team.

Recalls happen in older cars still. Maybe since it is 2014, we think about a similar idea with software involving millions of users.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#115

Post by GICodeWarrior »

gcb0 wrote: post #60
steakejjs wrote: post #15

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If y…

good old blacklist instead of whitelist. why forbid javascript: and some other thing that you know know, if you know for sure you only want http or https? always allow what you know for sure how to handle instead of denying what you think you know that you don't want.

While good advice, I suspect that isn't what's going on.

My guess would be that the URL is being validated with code which relies on null-terminated strings, and it's being processed/executed with code that uses a separate length value.

The empty string "" will pass a same-origin check as it refers to the current page. "\0javascript:alert()" looks like the empty string to validation code expecting null-terminated strings. However, it's a valid URL and is executed as JavaScript by code that knows the true length.

One easy way this could happen is if the same-origin check happens in C++ (eg. WebKit) and the URL fetch happens in Java.

The same problem can happen in reverse and has before. Java had a file path vulnerability where Java code would see the full path and the OS calls Java passed to would only process up to the first null. This opened up bypasses in application logic designed to validate paths.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#116

Post by megablast »

hnha wrote: post #65
fencepost wrote: post #56

Replaced by Chrome ("that giant hog"). I'm on a slightly older phone, but I actually removed Chrome from it not long ago. I started having problems with updating apps due to insufficient space, and while I have a fair amount of crap installed, I also have ~2.5GB of "Phone" storage for apps so I started investigating (this is separate from "sdcard" data storage which is ~8GB). Turns out Chrome, at least on the HTC Ama…

I am running out of space because Play Store and Google Framework get bigger and bigger. It fills me with rage how Google actively makes my old phone less capable over time for no benefit to me.

Don't get too raged, this has been happening on almost every computer for the last 20 years. The more you use it, there more there is to store, the more apps you use, the more data is placed everywhere.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#117

Post by smtddr »

joev_ wrote: post #103
slingerofwheat wrote: post #79

Is anyone familiar with the code that allows this vulnerability to be present and where I can find it(I believe this project is open source)? I understand the exploit is adding a nullbyte at the beginning of some javascript due to some bad handling in the parsing code. So I'm looking here: https://android.googlesource.com/platform/packages/apps/Brow...

I don't know the exact location, but it is probably somewhere in the webview tree, since it affects apps that embed webviews as well: https://android.googlesource.com/platform/frameworks/base/+/...

Since it's both webview and browser itself, I'd suspect some kind of common denominator object at fault... like...https://android.googlesource.com/platform/frameworks/base/+/...

Especially with a method called "public static class IllegalCharacterValueSanitizer".

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#118

Post by geographomics »

steakejjs wrote: post #15

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If y…

The alert did not appear on an Android 2.3 device (HTC Desire), or a 2.2 emulator (via BrowserStack.com) - not vulnerable, or not compatible with the exploit test?

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#119

Post by [deleted] »

AjithAntony wrote: post #86
hnha wrote: post #65

Earlier quoted context omitted.

I am running out of space because Play Store and Google Framework get bigger and bigger. It fills me with rage how Google actively makes my old phone less capable over time for no benefit to me.

Yeah. I was using a Nexus One for a long time until I had to prune so many apps due to space that it wasn't worth using. I got a new phone, HTC One S (I needed a t-mobile branded phone for wifi calling) with several gigs of system partition space, and now I have to play that game again. I recognize that there are a bunch of features now that I get to enjoy, but now I have to choose which ones I want to keep. When I s…

[deleted]

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#120

Post by steakejjs »

geographomics wrote: post #118
steakejjs wrote: post #15

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If y…

The alert did not appear on an Android 2.3 device (HTC Desire), or a 2.2 emulator (via BrowserStack.com) - not vulnerable, or not compatible with the exploit test?

I would think this means you are not vulnerable. The js begins with a null byte and works on a lot of different versions.

I think the vuln probably just had not been introduced at that time, but I obviously can't be certain without digging through the git log (and even then...all I can do is corroborate commits with release dates).

Post reply on HN