Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

community.rapid7.com

Post reply on HN
Print view View original

121–130 of 232 posts

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#121

Post by [deleted] »

AjithAntony wrote: post #110
gcb0 wrote: post #96

Earlier quoted context omitted.

did you disable cache somehow? open a bunch of ssl pages and see app data space explode. same happens with firefox

The cache doesn't seem relevant but I could test that. Presently my breakdown is 189MB+21MB , App+data, and 13MB Cache. Uninstalled. Reinstalled. (play store reports 30MB download) Before opening the app 65MB+4KB, 0MB cache First launch (no sync sign-in) 65MB + 10MB, 60KB cache Browsed Noisy SSL page (google plus feed): 65MB + 14MB, 13MB cache Signed into sync: no change ( 10min later, no change) Browsed image heavy…

[deleted]

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#122

Post by wernercd »

jamesisaac wrote: post #112
blocke wrote: post #95

Earlier quoted context omitted.

The only Nexus phones here that don't already have a fix available is the phone they announced as being end of life. 4.4 is not affected and is available for the Nexus 4, 5, both generations of 7 and I believe the 10. Dear Galaxy Nexus users... It's time to let go.

The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies? Don't think I've ever owned anything with such a serious planned obscolence issue. Windows supports its OS releases for 12 years (and doesn't lock you in, so you can usually follow official upgrade procedure anyway). And anything "dumber" than a smartph…

Since when has anything over 2 years, for a phone, had support? Anything over that is the exception, not the rule.

Apple has better support than most, but even their phones degrade with features missing on older phones AND included new features run like ass (every time my fiance upgrades old phone to new iOS she hate life until upgrade).

A 2 year old phone really is ancient... much less three or four... Who actually supports phones that old CONSISTENTLY?

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#123

Post by ufmace »

geographomics wrote: post #118
steakejjs wrote: post #15

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If y…

The alert did not appear on an Android 2.3 device (HTC Desire), or a 2.2 emulator (via BrowserStack.com) - not vulnerable, or not compatible with the exploit test?

I tried it myself also a few minutes ago, on an old Droid Eris/HTC Hero (IIRC) running CM7, Android 2.3.2. It does do an odd double-loading thing, but it doesn't show the alert.

Also, damn this thing is slow and tiny compared to my current phone.

Tried again with a Galaxy Nexus on 4.3. Sure enough, it duplicates fine on the stock browser, and works correctly in Chrome.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#124

Post by cpeterso »

ufmace wrote: post #42
untog wrote: post #16

Earlier quoted context omitted.

"a browser that isn't supported by Google" But still a browser that was created by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android https://developer.android.com/about/dashboards/index.html?ut... Just because Google decided not to support it any more doesn't mean they shouldn't . Pointing out Firefox and Opera is all very well, but this is the default b…

Could they update it, though? I thought part of the reason they went to Chrome is that the AOSP browser is baked into the OS and so not updateable without updating the whole OS. So to patch it, they'd have to update the OS, but if you're doing that, then why not just move to the latest OS, which is already fixed?

Chrome only supports Android 4.0+ (Ice Cream Sandwich), so people with older Android devices don't have that choice. OTOH, Firefox supports Android 2.3+ (Gingerbread). Mozilla only recently dropped Froyo support.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#125

Post by ufmace »

javert wrote: post #37

I am a big Linux fan and appreciate the openness and control that I can get with Android as opposed to Apple and Microsoft products, but... My Android experience has been shit, and I'm really getting sick of it. Admittedly, much or even most of the problem for me is the OEMs screwing things up and not sending out updates.

I find Android's a lot nicer if you stick to Nexus and GPE devices, and don't root or otherwise hack them. Yeah, carriers and OEMs are mostly terrible about updates and support, but it's not like this is some big secret.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#126

Post by cpeterso »

azernik wrote: post #53
gress wrote: post #29

Earlier quoted context omitted.

That's not chrome.

It is very very close: https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo... tl;dr: Chromium is Chrome minus: 1. Crash/usage reporting to Google. 2. Proprietary video format support 3. Embedded Flash implementation (which doesn't exist on mobile anyway). 4. Google API keys. If what you care about is security auditability, that's pretty good. If you care about running only open source software, that's going…

> 3. Embedded Flash implementation (which doesn't exist on mobile anyway).

Firefox for Android still supports Adobe's Flash plugin for Android.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#127

Post by jamesisaac »

wernercd wrote: post #122
jamesisaac wrote: post #112

Earlier quoted context omitted.

The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies? Don't think I've ever owned anything with such a serious planned obscolence issue. Windows supports its OS releases for 12 years (and doesn't lock you in, so you can usually follow official upgrade procedure anyway). And anything "dumber" than a smartph…

Since when has anything over 2 years, for a phone, had support? Anything over that is the exception, not the rule. Apple has better support than most, but even their phones degrade with features missing on older phones AND included new features run like ass (every time my fiance upgrades old phone to new iOS she hate life until upgrade). A 2 year old phone really is ancient... much less three or four... Who actually…

Well yeah with smartphones really short release cycles are "the rule" - because Google/Apple dominate the industry and set the rules - that's what I'm complaining about.

There's no fundamental reason a 2 year old phone should be seen as ancient. Hardware can last many times longer than that, and software can be updated. Google is just not making the effort to support its older devices.

For people like me who don't want to buy a new phone every 18 months (both a wasteful use of my money, and the earth's natural resources), Android is looking like a pretty bad choice.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#128

Post by derefr »

AjithAntony wrote: post #110
gcb0 wrote: post #96

Earlier quoted context omitted.

did you disable cache somehow? open a bunch of ssl pages and see app data space explode. same happens with firefox

The cache doesn't seem relevant but I could test that. Presently my breakdown is 189MB+21MB , App+data, and 13MB Cache. Uninstalled. Reinstalled. (play store reports 30MB download) Before opening the app 65MB+4KB, 0MB cache First launch (no sync sign-in) 65MB + 10MB, 60KB cache Browsed Noisy SSL page (google plus feed): 65MB + 14MB, 13MB cache Signed into sync: no change ( 10min later, no change) Browsed image heavy…

It does on the desktop: Omaha, a.k.a. Google Updater, follows a "keep a few recent versions around and just symlink the current one" model to enable atomic upgrades and rollbacks of failed upgrades. If Android Chrome manages its own updates, it's likely using Omaha for them.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#129

Post by userbinator »

GICodeWarrior wrote: post #115
gcb0 wrote: post #60

Earlier quoted context omitted.

good old blacklist instead of whitelist. why forbid javascript: and some other thing that you know know, if you know for sure you only want http or https? always allow what you know for sure how to handle instead of denying what you think you know that you don't want.

While good advice, I suspect that isn't what's going on. My guess would be that the URL is being validated with code which relies on null-terminated strings, and it's being processed/executed with code that uses a separate length value. The empty string "" will pass a same-origin check as it refers to the current page. "\0javascript:alert()" looks like the empty string to validation code expecting null-terminated str…

However, it's a valid URL

I doubt "\0javascript" is a valid URI scheme since they must begin with a letter, and any code that uses 0-terminated strings would just see it as an empty string. The fact that the \0 somehow seems to be ignored completely is most disturbing.

Edit: I double-checked the spec ( http://www.w3.org/TR/html5/browsers.html#dom-open ) just to make sure there's no weird "skip nulls" behaviour, and there isn't.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#130

Post by joev_ »

geographomics wrote: post #118
steakejjs wrote: post #15

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If y…

The alert did not appear on an Android 2.3 device (HTC Desire), or a 2.2 emulator (via BrowserStack.com) - not vulnerable, or not compatible with the exploit test?

I didn't test back this far; I should have, it's about 10% of android users. I tested back to 4.0 (not that 4.0-4.1.2 being vulnerable matters much, since you can get remote code execution easily through the addJavascriptInterface vulnerability). I tried out 2.1 in the emulator just now and got the same results as you, so it looks like 2.x is not affected by this.
Post reply on HN