Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android libstagefright still exploitable

blog.exodusintel.com

Post reply on HN
Print view View original

111–120 of 150 posts

Re: Android libstagefright still exploitable

#111

Post by bitmapbrother »

stevenh wrote: post #72

Any competent malware developer must have already figured out how to exploit this the first time around. Now that every single one of those malware developers has learned it is still exploitable, the payload they've spent the past month perfecting can now be deployed in the wild. So, can someone explain why a disastrous worm hasn't already swept the globe and infected 99% of Android devices on the planet within ten m…

>So, can someone explain why a disastrous worm hasn't already swept the globe and infected 99% of Android devices on the planet within ten minutes of being released in the wild?

There are a couple of reasons:

1) Just because you have an exploit it doesn't guarantee you'll be able to execute code because you still need to bypass ASLR. The PoC's released do not do this.

2) Infecting phones with malware is very rare. The "tech pundits" like to scare the public, but the reality is that smartphones are rarely infected. Besides, the people that write and distribute malware are too busy infecting Windows machines.

Re: Android libstagefright still exploitable

#112

Post by eropple »

ocdtrekkie wrote: post #107
eropple wrote: post #104

Earlier quoted context omitted.

I think, honestly, the only real answer is "don't buy locked devices if you want to make those choices." Google doesn't control those devices, and that part of Android is open source. You can make those decisions, but you're earning the consequences with them. This, as it happens, is why I buy phones with unlockable bootloaders. My current phone uses the OEM build, but I like having that choice.

Google :does: control those devices. They're MADA agreement devices, which means Google approves every device that goes to sale, and Google approves every software update they release. Unfortunately, as a Verizon customer, I don't have a wide variety of options with unlockable bootloaders. And the battery life on the Turbo was simply, the only feature that mattered. Usually there's an unlock within a few months, but…

Obviously it wasn't the only feature that mattered, though? I mean, you're complaining about another feature right now. =) Like, I'm sympathetic, but this is a solvable problem with the information at hand. Buy phones with unlocked bootloaders. (As it happens, this is why I steer clear of Verizon...)

Re: Android libstagefright still exploitable

#113

Post by nadams »

SamReidHughes wrote: post #73
nadams wrote: post #69

Earlier quoted context omitted.

> Even if Google patches this, there's an incredible delay in getting the patch to users. I don't think delay is the problem - not being able to get or apply the patch yourself is the problem. Ignoring the somewhat ridiculous requirements to compile Android (200GB of HD space and 16GB of RAM [1]) - you couldn't put it on your Android device due to proprietary drivers for wireless and/or video. Assuming you can get an…

> I don't think delay is the problem - not being able to get or apply the patch yourself is the problem. Almost all users would be incapable of applying patches themselves.

> Almost all users would be incapable of applying patches themselves.

There are currently 357,101 registered users on XDA developers. Saying "almost" every android user can't apply a patch is somewhat far fetched.

Most procedures on XDA developers have a much better step by step documentation than most SDKs I've seen - and every time I've used them it's been successful. I've only had one issue regarding flashing a radio - but that was my fault for not reading/paying attention and Motorola for not allowing a lower version of radio to be flashed...

Yes - there are grandmas and people who don't even know what Linux is would not be able to apply the patch themselves - but you are going to find that in any market.

Re: Android libstagefright still exploitable

#114

Post by johansch »

redwards510 wrote: post #59
johansch wrote: post #13

Things like this is why I trust an iPhone enough to handle two-factor auth for banking (in Sweden: "Mobil BankId"), but not an Android device. I hope Google will raise the security level now that they have reached global dominance, in no small part through lax security (as a consequence to their liberal licensing models).

How do you think jailbreaking is accomplished?

Not via the appstore.

Re: Android libstagefright still exploitable

#115

Post by johansch »

autobahn wrote: post #56
johansch wrote: post #13

Things like this is why I trust an iPhone enough to handle two-factor auth for banking (in Sweden: "Mobil BankId"), but not an Android device. I hope Google will raise the security level now that they have reached global dominance, in no small part through lax security (as a consequence to their liberal licensing models).

because somehow magically an iphone is more secure because reasons? I agree that iphone's patching model is superior to android, but your statement shows a bit of ignorance.

Because they have a working patching model, yes.

Re: Android libstagefright still exploitable

#116

Post by nissehulth »

pokpokpok wrote: post #108
ryandvm wrote: post #100

Earlier quoted context omitted.

It's not often that Android's fragmentation is touted as a benefit, but the fact that Android isn't a monoculture is certainly one of the hurdles to developing a worm capable of mass deployment. Supposedly the varying implementations of the Android media services mean a libstragefright exploit may or may not end up with root access. Now, if this were an iOS zero-day exploit... [Actually, it'd be trivial for the carri…

do carriers already have a mechanic in place to trigger precautions a message matching worm-like patterns (similarity, mass transmission)? or would they have to implement one after it's too late?

I'm afraid carrier don't care enough to do that. I hope I'm wrong.

Re: Android libstagefright still exploitable

#117

Post by acqq »

zurn wrote: post #63
ploxiln wrote: post #50

Earlier quoted context omitted.

Performance. That's an extra branch on every arithmetic operation.

There's a performance cost now because processor instruction sets have dropped hardware overflow detection due to disuse. Current processors are largely engineered to just run legacy C code fast. See eg. https://news.ycombinator.com/item?id=7847980

No, overflow is still properly detected by common CPU instructions. There are flags that are set on overflow after the addition and subtraction and they can be tested.

It's only hard to test the flags in "standard" C (I don't know if it's better with newer standards or those in progress) but the CPUs do their work on the hardware level.

Re: Android libstagefright still exploitable

#118

Post by bitmapbrother »

johansch wrote: post #13

Things like this is why I trust an iPhone enough to handle two-factor auth for banking (in Sweden: "Mobil BankId"), but not an Android device. I hope Google will raise the security level now that they have reached global dominance, in no small part through lax security (as a consequence to their liberal licensing models).

This is not a pretty picture: http://www.cvedetails.com/product/15556/Apple-Iphone-Os.html...

And before you nominate Apple for security sainthood, let's not forget the bruteforce / unlimited password attempts hack on iCloud that allowed hackers to get ahold of sensitive pictures belonging to celebrities.

Re: Android libstagefright still exploitable

#119

Post by bitmapbrother »

m3rc wrote: post #85
stevenh wrote: post #72

Any competent malware developer must have already figured out how to exploit this the first time around. Now that every single one of those malware developers has learned it is still exploitable, the payload they've spent the past month perfecting can now be deployed in the wild. So, can someone explain why a disastrous worm hasn't already swept the globe and infected 99% of Android devices on the planet within ten m…

Didn't a number of texting apps, possibly including hangouts, update to fix it separate of this botched fix? EDIT: I just checked and sure enough my texting app, QKSMS, updated to remove the Stagefright library

No, apps cannot remove system libraries responsible for processing video. What your MMS app did was disable the auto-retrieval of MMS messages.

Re: Android libstagefright still exploitable

#120

Post by bitmapbrother »

ocdtrekkie wrote: post #21
x0x0 wrote: post #16

Earlier quoted context omitted.

Eh, fuck google. They still haven't patched the original stagefright for android 4.4.4 on my nexus 5, and I don't want to upgrade to android 5, which I shouldn't be required to do to get security releases.

Same problem. My options for my Droid Turbo are suffer Android 5.x or get a Windows Phone. ...I'm getting a Windows Phone.

Because Microsoft is right on top of those Windows Phone updates, right?

There are Windows Phones on U.S carriers still sporting Amber.

Post reply on HN