Latest Android phones hijacked with one-shot Chrome exploit
theregister.co.uk
Latest Android phones hijacked with one-shot Chrome exploit
1–10 of 46 posts
Re: Latest Android phones hijacked with one-shot Chrome exploit
#2Not too surprising, considering the level of complexity in a modern browser and javascript engine I suppose. I wonder if the next generation of phone operating systems will have something more akin to a true exo or micro kernel to help mitigate these sorts of attacks.
Re: Latest Android phones hijacked with one-shot Chrome exploit
#3Will this impact NodeJS which is built on the V8 engine?
Re: Latest Android phones hijacked with one-shot Chrome exploit
#4Will this impact NodeJS which is built on the V8 engine?
I doubt it. It likely requires running a specialized script, and if you are running arbitrary JS on your NodeJS server/app you are already in trouble.
Re: Latest Android phones hijacked with one-shot Chrome exploit
#5Not too surprising, considering the level of complexity in a modern browser and javascript engine I suppose. I wonder if the next generation of phone operating systems will have something more akin to a true exo or micro kernel to help mitigate these sorts of attacks.
iOS and Windows Phone architecture are already much better than Android in this regard.
Also Symbian had a relatively good security architecture, with its micro-kernel and the permissions model introduced in S60 v3.
Android security lags behind, because Google doesn't want to force OEMs and providers to provide updates. Additionally the OS architecture makes it pretty easy to extract an APK and reverse engineer it, even if written with the NDK.
But in any case, the best exploits are social and there isn't any help there.
Most of the users get p0wned trying to find stuff for free in dubious sites, and installing it, instead of paying for the real deal.
Re: Latest Android phones hijacked with one-shot Chrome exploit
#6Even by Android standards, this is pretty shocking.
Being that this a one-shot exploit that the author believes will work on any Android with the latest Chrome makes it doubly so.
I'd also be more concerned that the exploit is described as targeting V8 specifically, considering how widely it is being used out of the browser these days.
Re: Latest Android phones hijacked with one-shot Chrome exploit
#7Not too surprising, considering the level of complexity in a modern browser and javascript engine I suppose. I wonder if the next generation of phone operating systems will have something more akin to a true exo or micro kernel to help mitigate these sorts of attacks.
iOS and Windows Phone architecture are already much better than Android in this regard. Also Symbian had a relatively good security architecture, with its micro-kernel and the permissions model introduced in S60 v3. Android security lags behind, because Google doesn't want to force OEMs and providers to provide updates. Additionally the OS architecture makes it pretty easy to extract an APK and reverse engineer it, e…
How does reverse engineer affect security?
Re: Latest Android phones hijacked with one-shot Chrome exploit
#8Not too surprising, considering the level of complexity in a modern browser and javascript engine I suppose. I wonder if the next generation of phone operating systems will have something more akin to a true exo or micro kernel to help mitigate these sorts of attacks.
iOS and Windows Phone architecture are already much better than Android in this regard. Also Symbian had a relatively good security architecture, with its micro-kernel and the permissions model introduced in S60 v3. Android security lags behind, because Google doesn't want to force OEMs and providers to provide updates. Additionally the OS architecture makes it pretty easy to extract an APK and reverse engineer it, e…
> Android security lags behind, because Google doesn't want to force OEMs and providers to provide updates.
What do OEM updates have to do with a security hole in Chrome? Despite all the merger chatter, Chrome isn't an OS-level part Android the way it is with ChromeOS.
The exploit sounds serious, but once the Chrome team understands it and comes up with a fix, all Google needs to do to deploy it is publish a new version of Chrome on the Play Store. I suppose they could add a nudge or two via Play Services (or otherwise) if people aren't installing the new version, but, in any case, that's nowhere near the effort required to get an OS update out (and neither OEMs nor carriers can block the fix).
Re: Latest Android phones hijacked with one-shot Chrome exploit
#9Earlier quoted context omitted.
iOS and Windows Phone architecture are already much better than Android in this regard. Also Symbian had a relatively good security architecture, with its micro-kernel and the permissions model introduced in S60 v3. Android security lags behind, because Google doesn't want to force OEMs and providers to provide updates. Additionally the OS architecture makes it pretty easy to extract an APK and reverse engineer it, e…
How does reverse engineer affect security?
Allows to expose security flaws in existing code?
Re: Latest Android phones hijacked with one-shot Chrome exploit
#10Not too surprising, considering the level of complexity in a modern browser and javascript engine I suppose. I wonder if the next generation of phone operating systems will have something more akin to a true exo or micro kernel to help mitigate these sorts of attacks.
iOS and Windows Phone architecture are already much better than Android in this regard. Also Symbian had a relatively good security architecture, with its micro-kernel and the permissions model introduced in S60 v3. Android security lags behind, because Google doesn't want to force OEMs and providers to provide updates. Additionally the OS architecture makes it pretty easy to extract an APK and reverse engineer it, e…
>Google doesn't want to force OEMs and providers to provide updates
I think you're assuming a lot about the relationship's power dynamics and what contracts are at play that may have been written quite a while ago. Also forgetting that more often than not it's the telco that's blocking or bottlenecking updates. The reason Apple was able to do what it did is because they provided the software and hardware and were able to leverage the demand for it against the likes of Verizon (probably the most notorious blocker of updates no matter how critical they might be).