Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Latest Android phones hijacked with one-shot Chrome exploit

theregister.co.uk

Post reply on HN
Print view View original

11–20 of 46 posts

Re: Latest Android phones hijacked with one-shot Chrome exploit

#11

Post by pjmlp »

fpgeek wrote: post #8
pjmlp wrote: post #5

Earlier quoted context omitted.

iOS and Windows Phone architecture are already much better than Android in this regard. Also Symbian had a relatively good security architecture, with its micro-kernel and the permissions model introduced in S60 v3. Android security lags behind, because Google doesn't want to force OEMs and providers to provide updates. Additionally the OS architecture makes it pretty easy to extract an APK and reverse engineer it, e…

> Android security lags behind, because Google doesn't want to force OEMs and providers to provide updates. What do OEM updates have to do with a security hole in Chrome ? Despite all the merger chatter, Chrome isn't an OS-level part Android the way it is with ChromeOS. The exploit sounds serious, but once the Chrome team understands it and comes up with a fix, all Google needs to do to deploy it is publish a new ver…

First of all, I was replying to " I wonder if the next generation of phone operating systems will have something more akin to a true exo or micro kernel to help mitigate these sorts of attacks."

Second, most mobile users use whatever app is labeled as "Internet" on their phones and tablets. Only savy users get to install Chrome.

Third, anyone using an Android system older than Lollipop won't get WebView updates.

So on those devices a Chrome update is indeed an OS update.

Re: Latest Android phones hijacked with one-shot Chrome exploit

#12

Post by Maarten88 »

Am I alone being amazed that we still have not experienced an Android worm or virus shutting down all mobile networks globally for a few days? I remember Slammer, which brought down many corporate networks and severely impacted all internet traffic. With all these unpatched phones and so many vulnerabilities it seems a matter of time before something like this happens on a grander scale in mobile networks.

Would it be that the bad guys have become smarter and there is more money in silently p0wning devices? Or is network management able to stop such events from happening nowadays?

Re: Latest Android phones hijacked with one-shot Chrome exploit

#15

Post by Spittie »

Play Services have a way to install applications in the background (http://stackoverflow.com/questions/23695170/how-to-install-a...) that does a signature check, and refuse to work if the request didn't come from a Google App. Maybe they found a way to call that from Chrome's v8?

What makes me think so is that they claim to have installed a "BMX Game" (which I guess is on the Play Store), and I don't see any claim of it being automatically launched after the installation (Android >2.3 should block that).

That would be much better for Android than the alternatives. As far as I can tell, applications can only install stuff in the background if they are system applications (live into some /system subfolder, which Chrome does when preinstalled/installed from a GAPPS package) AND declade the "INSTALL_PACKAGES" permission in their manifest (Chrome doesn't).

That should be the only way, apart from getting root (but I guess they would have just said "we got root" then).

EDIT: Obviously all of this is just a guess. I'm just happy that there is no Chrome on my phone :) (but the WebView on Android 5.1 is based on Chromium - so i wonder if that's exploitable as well?)

Re: Latest Android phones hijacked with one-shot Chrome exploit

#16

Post by pjmlp »

brazzledazzle wrote: post #10
pjmlp wrote: post #5

Earlier quoted context omitted.

iOS and Windows Phone architecture are already much better than Android in this regard. Also Symbian had a relatively good security architecture, with its micro-kernel and the permissions model introduced in S60 v3. Android security lags behind, because Google doesn't want to force OEMs and providers to provide updates. Additionally the OS architecture makes it pretty easy to extract an APK and reverse engineer it, e…

>Google doesn't want to force OEMs and providers to provide updates I think you're assuming a lot about the relationship's power dynamics and what contracts are at play that may have been written quite a while ago. Also forgetting that more often than not it's the telco that's blocking or bottlenecking updates. The reason Apple was able to do what it did is because they provided the software and hardware and were abl…

I used to work for a famous Finn company with seat in Espoo.

Re: Latest Android phones hijacked with one-shot Chrome exploit

#17

Post by ce4 »

Spittie wrote: post #15

Play Services have a way to install applications in the background ( http://stackoverflow.com/questions/23695170/how-to-install-a... ) that does a signature check, and refuse to work if the request didn't come from a Google App. Maybe they found a way to call that from Chrome's v8? What makes me think so is that they claim to have installed a "BMX Game" (which I guess is on the Play Store), and I don't see any claim…

Wouldn't Chrome be able to auto login on the play store website and click the install button there? There have been XSS attacks on the play store website allowing this before.

Edit: I had this in mind https://jon.oberheide.org/blog/2011/03/07/how-i-almost-won-p...

Re: Latest Android phones hijacked with one-shot Chrome exploit

#18

Post by devit »

This is why you should use Firefox for Android: it's a great browser (even offering extensions such as uBlock Origin), but it has very little marketshare and is thus unlikely to be attacked.

This is also part of the reason a frequently updated Android distribution (Nexus or CyanogenMod) might in fact be more secure than iOS, where you are forced to be vulnerable to Apple's Webkit engine.

The same reasoning also applies to such updated versions of Android: the vast majority of people use outdated Android versions, so it's less likely that people would bother developing exploits for the latest Android version, as opposed to the latest version of iOS.

Obviously this is a self-defeating prophecy, but hopefully a proper securely isolated mobile OS will become available before things change.

Re: Latest Android phones hijacked with one-shot Chrome exploit

#19

Post by blisterpeanuts »

devit wrote: post #18

This is why you should use Firefox for Android: it's a great browser (even offering extensions such as uBlock Origin), but it has very little marketshare and is thus unlikely to be attacked. This is also part of the reason a frequently updated Android distribution (Nexus or CyanogenMod) might in fact be more secure than iOS, where you are forced to be vulnerable to Apple's Webkit engine. The same reasoning also appli…

So, are there more exploits for iOS out there? I had the impression that Android has more. Also, this particular one is a browser JavaScript problem that affects multiple android versions, is it not?
Post reply on HN