Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blueborne – A new attack vector endangering major operating systems

armis.com

Post reply on HN
Print view View original

11–20 of 34 posts

Re: Blueborne – A new attack vector endangering major operating systems

#11

Post by sevensor »

yumaikas wrote: post #8
wohlergehen wrote: post #5

Earlier quoted context omitted.

Well, I've been meaning to root mine and flash crDroid... This is certainly the final push. They state 10% of all Android devices are vulnerable and won't get patches, and since the vulnearbility is arguably wormable I can't see how these devices will stay clean.

Does keeping the BlueTooth radio turned off help here?

I have the same question -- I turned off the Bluetooth radio on my phone the day I got it, and I've never turned it back on. But does that mean the radio is actually powered down, or is the phone blocking Bluetooth at a higher level? Similarly, or possibly the same question, is an rfkill soft block adequate for a laptop with bluetooth?

Re: Blueborne – A new attack vector endangering major operating systems

#12

Post by Aaron1011 »

amluto wrote: post #9

Is there an exploit that works on systems with stack canaries? If not, then sensible Linux devices (which may well be a small minority) are not so severely affected. I'm more worried about higher value targets like cars and things like lightbulbs that never get updated. This could be an amazing wormable bug.

From the white paper:

> Despite this, the Linux Kernel is lagging behind in implementing some modern mitigations in its default configuration. Both stack canaries - which protect against stack overflows, and KASLR (kernel address space layout randomization) are lacking in most devices running Linux today

It seems that they opted not to try to bypass stack canaries, probably because of the number of Android devices running old versions of Linux.

It seems inaccurate for them to categorize this as a problem with kernel itself, however. The kernel itself isn't "lagging behind" if mobile/embedded devices won't update to never versions containing newer mitigation techniques.

Re: Blueborne – A new attack vector endangering major operating systems

#13

Post by Aaron1011 »

Based on the white paper, "Blueborne" is really a collection of distinct vulnerabilities in various implementations of the Bluetooth protocol. This is in contrast to something like the 'Over the air' vulnerability (https://googleprojectzero.blogspot.com/2017/04/over-air-expl...), which was a bug in the firmware shared by Android and iOS.

Re: Blueborne – A new attack vector endangering major operating systems

#14

Post by codewiz »

sverige wrote: post #7
hkothari wrote: post #3

Am I missing something? The first line says: "Armis Labs revealed a new attack vector endangering major mobile, desktop, and IoT operating systems, including Android, iOS, Windows, and Linux, and the devices using them." Why is the title singling out Linux? Reading through the rest of it, it seems like this is on pretty much everything.

Windows was patched in July. Google has provided a patch for Android. Therefore, Linux is the only one left to make an announcement.

> Windows was patched in July. Google has provided a patch for Android. Therefore, Linux is the only one left to make an announcement.

For some reason, this vuln was not promptly disclosed to the Kernel security team. From the article:

  Google – Contacted on April 19, 2017
  Microsoft – Contacted on April 19, 2017
  Apple – Contacted on August 9, 2017
  Linux – Contacted August 15 and 17, 2017
Oh, and the most amusing one:

    Samsung – Contact on three separate occasions in April, May, and June. No response was received back from any outreach.

Re: Blueborne – A new attack vector endangering major operating systems

#15

Post by mrguyorama »

For a moment I was excited, as I thought this might finally be an avenue to root my abandoned, older android phones, however, looks like the permissions given to the bluetooth service are not actually full scale root (which is reasonable of course).

I wonder whether it is still worth investigating?

Re: Blueborne – A new attack vector endangering major operating systems

#16

Post by kbenson »

mrguyorama wrote: post #15

For a moment I was excited, as I thought this might finally be an avenue to root my abandoned, older android phones, however, looks like the permissions given to the bluetooth service are not actually full scale root (which is reasonable of course). I wonder whether it is still worth investigating?

What you probably want is this combined with some privilege escalation technique. If you feel like doing the work, have at it.[1]

1: https://www.cvedetails.com/vendor/1224/Google.html

Re: Blueborne – A new attack vector endangering major operating systems

#17

Post by dmix »

amluto wrote: post #9

Is there an exploit that works on systems with stack canaries? If not, then sensible Linux devices (which may well be a small minority) are not so severely affected. I'm more worried about higher value targets like cars and things like lightbulbs that never get updated. This could be an amazing wormable bug.

I'd expect this to be a minimum requirement, especially if you're planning to make a logo and website for a Linux exploit...

Re: Blueborne – A new attack vector endangering major operating systems

#18

Post by mrguyorama »

kbenson wrote: post #16
mrguyorama wrote: post #15

For a moment I was excited, as I thought this might finally be an avenue to root my abandoned, older android phones, however, looks like the permissions given to the bluetooth service are not actually full scale root (which is reasonable of course). I wonder whether it is still worth investigating?

What you probably want is this combined with some privilege escalation technique. If you feel like doing the work, have at it.[1] 1: https://www.cvedetails.com/vendor/1224/Google.html

If I already had a working privilege escalation strategy, wouldn't I just be able to run that from a terminal emulator program on the phone? Or using an adb shell? My problem is exactly that there is no privilege escalation vulnerability in my version of the OS (that I know of)

Re: Blueborne – A new attack vector endangering major operating systems

#19

Post by 5travac »

Aaron1011 wrote: post #12
amluto wrote: post #9

Is there an exploit that works on systems with stack canaries? If not, then sensible Linux devices (which may well be a small minority) are not so severely affected. I'm more worried about higher value targets like cars and things like lightbulbs that never get updated. This could be an amazing wormable bug.

From the white paper: > Despite this, the Linux Kernel is lagging behind in implementing some modern mitigations in its default configuration. Both stack canaries - which protect against stack overflows, and KASLR (kernel address space layout randomization) are lacking in most devices running Linux today It seems that they opted not to try to bypass stack canaries, probably because of the number of Android devices ru…

True. The real interesting part would have been how they bypassed ASLR, DEP and stack canaries.

Re: Blueborne – A new attack vector endangering major operating systems

#20

Post by kbenson »

mrguyorama wrote: post #18
kbenson wrote: post #16

Earlier quoted context omitted.

What you probably want is this combined with some privilege escalation technique. If you feel like doing the work, have at it.[1] 1: https://www.cvedetails.com/vendor/1224/Google.html

If I already had a working privilege escalation strategy, wouldn't I just be able to run that from a terminal emulator program on the phone? Or using an adb shell? My problem is exactly that there is no privilege escalation vulnerability in my version of the OS (that I know of)

Since there are 34 "Gain Priv" listed on that page for Android (many versions) in 2017, and well over 200 listed for 2016, I would imagine with those as a starting point it might not be too hard to look for likely candidates that have been weaponized (or have working proof of concept code) if you search around a bit. It's not exactly easy, but given the huge number of exploits to work with, it would probably yield something without too much work.

I did notice that the entries there include whether there's a known metasploit module, which none that I looked at had one shown there. I googled metasploit and android and found some video tutorial for hacking a Android phone using metasploit from early 2017[1], so maybe that will help you. In any case, good luck if you try.

1: https://www.youtube.com/watch?v=gfAE1xVBNdo

Post reply on HN