Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Security Flaw In Android Web Browser

timothy posted more than 5 years ago | from the more-information-would-be-nice dept.

Cellphones 59

r writes "The New York Times reports on a security flaw discovered in the new Android phones. The article is light on details, but it hints at a security hole in the browser, allowing for trojans to install themselves in the same security partition as the browser: 'The risk in the Google design, according to Mr. Miller, who is a principal security analyst at Independent Security Evaluators in Baltimore, lies in the danger from within the Web browser partition in the phone. It would be possible, for example, for an intruder to install software that would capture keystrokes entered by the user when surfing to other Web sites. That would make it possible to steal identity information or passwords.'"

Sorry! There are no comments related to the filter you selected.

This would be an easy fix... (-1, Flamebait)

Anonymous Coward | more than 5 years ago | (#25511545)

This would be an easy fix if users actually had access to things like source that they could compile themselves on the face. Unfortunately, Android is just as locked down and anti-user as anything by Apple, in spite of Google's "open platform" hype.

Re:This would be an easy fix... (-1, Flamebait)

Anonymous Coward | more than 5 years ago | (#25511595)

Thank You!

Why is that concept so hard for everybody to grasp?! Did mothafuckas believe they'd be able their own encrypted VPN VoIP applications? Hell NAW, brother!

Re:This would be an easy fix... (5, Funny)

Anonymous Coward | more than 5 years ago | (#25511647)

Did mothafuckas believe they'd be able their own encrypted VPN VoIP applications?

I think you accidentally a whole verb.

what the fuck it's ohrrible (0)

Anonymous Coward | more than 5 years ago | (#25511677)

somebody broke slashdot

Re:what the fuck it's ohrrible (-1)

Anonymous Coward | more than 5 years ago | (#25511843)

Nevermind, clearing the ol' cache fixed it.

For more info, check out this [yahoo.com] page.

Re:what the fuck it's ohrrible (2, Funny)

Ethanol-fueled (1125189) | more than 5 years ago | (#25511875)

After reading the article you linked to, I'm not sure what Yahoo is trying to suggest.

Perhaps it's a conceptual description of how Yahoo's staff would feel if Yahoo were bought out by Microsoft.

Re:what the fuck it's ohrrible (0)

Anonymous Coward | more than 5 years ago | (#25511933)

Nobody knows for sure, but it's wide open for debate.

Goatse warning (1)

Crazyswedishguy (1020008) | more than 5 years ago | (#25512079)

Don't click the link above unless you have something stuck in your stomach that you're trying to get out.

Re:Goatse warning (-1, Troll)

Anonymous Coward | more than 5 years ago | (#25512283)

Some faggot and/or nigger like this always has to go and spoil the fun for us decent and respectable trolls. Good job you twat.

Re:Goatse warning (0)

Anonymous Coward | more than 5 years ago | (#25514599)

If anybody is deserving of a +5 Troll, it's you.

Re:This would be an easy fix... (0)

Anonymous Coward | more than 5 years ago | (#25511803)

Did mothafuckas believe they'd be able their own encrypted VPN VoIP applications?

I think you accidentally a whole verb.

Not the whole thing!

Re:This would be an easy fix... (0)

Anonymous Coward | more than 5 years ago | (#25518805)

Did a 4chan meme posted anonymously just get modded +5 on slashdot?

Re:This would be an easy fix... (4, Informative)

Anonymous Coward | more than 5 years ago | (#25511597)

Erm, the entire source code for Android is now available, so yes, you can download it, fix it, compile it, then flash it onto your phone, or maybe a different phone.

Re:This would be an easy fix... (1)

larry bagina (561269) | more than 5 years ago | (#25511833)

Are you speaking from experience? You flashed android onto a phone (and it works)? Or maybe you're just blowing it out your ass. If it was that simple, nobody would be complaining about tivo.

Re:This would be an easy fix... (2, Insightful)

lysergic.acid (845423) | more than 5 years ago | (#25513877)

his point is that the troll's blatant flamebaiting:

This would be an easy fix if users actually had access to things like source that they could compile themselves on the face. Unfortunately, Android is just as locked down and anti-user as anything by Apple, in spite of Google's "open platform" hype.

is untrue.

users do in fact have access to the source and can compile it themselves. whether your phone is currently supported or has open hardware is a different and unrelated matter. you're flaming him on a completely inapt issue. just because he can't compile the linux kernal himself doesn't mean that it's not open source. or just because my copy of Microsoft Word won't read ODF doesn't mean it's not an open format.

Re:This would be an easy fix... (3, Insightful)

davester666 (731373) | more than 5 years ago | (#25511837)

Are you sure you can flash new firmware onto the G1 based on the source, without the binary needing to be signed by T-Mobile?

Being able to actually use personal builds doesn't necessary follow from the source being available.

Re:This would be an easy fix... (2, Insightful)

Superken7 (893292) | more than 5 years ago | (#25516223)

You don't actually need to replace the entire firmware of the phone.

The Application Framework is designed in a way that permits you to replace any application with your own application. Be it the dialer, contacts manager or web browser.

That said, i would still like to know if there are already any efforts of trying to replace the entire firmware. I presume the HTC phone is designed (or android has been modified) in a way that prevents that kind of tampering, but i still have not heard of any hacking attempts.

Hello reverse engineers ? :-)

Re:This would be an easy fix... (3, Informative)

MikaelC (584630) | more than 5 years ago | (#25512219)

Yep. Of course you will probably have to write new device drivers for a different phone. And judging by this comment [android.com] it seems that the not all of the source for the G1 is available.

Re:This would be an easy fix... (3, Informative)

Anonymous Coward | more than 5 years ago | (#25513121)

Actually yes you can, we haven't tried with the G1 yet, but have been putting Android on previous HTC models for quite a bit (even before Android was released)

Re:This would be an easy fix... (2, Insightful)

fuzzyfuzzyfungus (1223518) | more than 5 years ago | (#25511775)

You seem to be confusing Android with a particular Android device. Unfortunately, thanks largely to the delightsome world of the telcomms, phones are a disgusting mass of lockdown, including Android ones. OpenMoko excepted.

Android itself is, IIRC, Apache licenced, which certainly qualifies as free software. Unlike GPL3 stuff, though, it does not enforce your freedom on particular devices. It would have been very nice if Android had done that, the world could really use more phones that live up to their computery potential; but I suspect that, had google done so, the response would have been fewer android phones, not freer android phones.

Re:This would be an easy fix... (3, Interesting)

lysergic.acid (845423) | more than 5 years ago | (#25514391)

so true. you have to wonder what cellular networks would be like if they were not closed proprietary infrastructure.

of course there are the obvious things like:

  • retail phones with mp3 players would actually let you use mp3s as ringtones, instead of forcing you to buy short, low-quality clips of the same songs from your service carrier at a higher cost than the actual song.
  • calls & text messaging rates would correspond to their actual network costs--the same way e-mails, IMs, voice chat, etc. on the internet do not cost anything extra, but are covered by your ISP fees.
  • retail phones come with original unrestricted firmware rather than the crippled carrier-rebranded interface that users see.

but there'd be other less-obvious indirect benefits, such as:

  • better nationwide network coverage--since we'd be using open public networks, cellphone towers would have a natural & more even distribution covering all parts of the country rather than having lots of redundant/competing infrastructure consisting of a bunch of small concentrated clumps of cellular coverage in urban areas with lucrative markets and almost no coverage at all in poorer, more sparsely populated areas.
  • lower cost of entry to the handset market due to anyone being able to develop devices to use the open networks without carrier approval ($$$). this would lead to more handset makers, meaning lower handset costs & wider selections.
  • boundless technological innovation and creativity. being unhampered by the draconian rule of the telecoms over their proprietary networks, anyone and everyone will be free to develop new and useful applications for the network. that is what propelled the internet from its primitive beginnings to the thriving online digital ecosystem it is today. such technological process is nonexistent on today's cellular networks because it's up to the carriers alone to implement new cellular applications, and they are adversed to experimenting with new technology prevent.
  • the development of mobile communications networks would be put back into the hands of the people. right now people only get to pick their handset from a list of preapproved models allowed by their carrier. useless, poorly designed and unncessary technologies (WAP) continue to be forced on consumers. instead of this, consumer demand would drive the adoption of new/useful technology, while bad products/services designed solely to exploit consumers would be immediately dispensed with.

this may seem like a pipe dream right now, but it might happen if wireless access internet becomes a basic public utility like roads and sidewalks. VoIP services like Vonage are already stealling business customers from conventional telecoms because of their competitive pricing. old business models will no longer be viable in the information age as closed proprietary specialized communication networks are assimilated by the open and public internet, which is a generalized communication network that can serve the needs of telecommunication, radio broadcast, TV broadcast, etc.

Re:This would be an easy fix... (1)

MadnessASAP (1052274) | more than 5 years ago | (#25514633)

And I want a pony, doesn't mean I'm gonna get it though. The reason your dream, as wondersoem as it is, will never happen is becuase of money. Infrastructure doesn't just grow out of the ground, it costa money lots of it. And carriers have to first invest in infrastucture and then the profit follow, so you better beleive they are going to fight tooth and nail for every square inch of it that the ycan get. The only way your dream will ever happen is if the governments go back to heavily subsidizing and regulating the industry in an open and fair way. But of course that wont happen because that's communism, unless it fattens the wallet of a politician in whcih case it becomes "helping the consumer." Either way, no telcom dream for you, and no pony for me.

Re:This would be an easy fix... (2, Insightful)

im_thatoneguy (819432) | more than 5 years ago | (#25515919)

Ummmm...

My AT&T phone lets me use any MP3 as long as it's less than 60 seconds long and a couple of sampling requirements. Which tells me it's related to the ringtone playback software not some lockdown. Also the Googlephone allows this.

What's an "Actual network cost" I'm happy that 14 year old girls are subsidizing my actual network costs with their outrageous text messaging fees. With an unlimited data plan you can IM all you want through chat applications. For instance the Google phone's best feature is its notifications pane which does an amazing job of managing all your internet aware apps. So forget text messaging and just use GTalk or MSN or whatever IM clients it supports. Also with the google phone I think TMobile includes texting with the data plan so you could do that too.

Again. Android has little to zero branding. IPhone has almost no branding. HTC Touch/TouchPro/Diamond don't seem very heavily branded or modified. Even my AT&T Phone looks like any other LG Phone except that it has AT&T up on the status pane. OH NO!

How would this magical "no redundancy" network operate exactly? And how would they share space? "Oh sorry I already have a tower in downtown New York. Too bad for you! And if someone's tower coverage was poor who do you complain to? Who's tower was it? That sounds like a fantastic way to develop a network monopoly. I also don't see how this free for all would result in better coverage in rural areas. I'm suspicious that the only profit that they derive from those towers as it is--is from urban centers offsetting their costs and offering the rural areas to ensure their customers can roam.

Considering all handsets tend to be carrier subsidized I'm not certain how all phones being sold at retail price would be considered "cheaper". It would certainly mean less lock-in but I don't know about cheaper. I'm not going to pay $600 for a smart phone I know that.

Again. I'm not certain what draconian rules you're refering to. Let's take Android as an example. What draconian rules are being imposed? The only software I think that is banned is VOIP software. And that would probably be spectacularly spotty in quality over a wireless data link. VOIP requires nice low latency coverage. Low Latency and multi-point wireless broadband are not synonymous. This might be true of my AT&T LG phone. But the sky is the limit with just about every single Windows Mobile, Android or iPhone.

I'm all about dumb fat pipe but I disagree strongly with how far from that we currently are. Furthermore. I also disagree that our cellphone networks are ready for a dumb fat pipe to work well.

Re:This would be an easy fix... (1)

xaositects (786749) | more than 5 years ago | (#25542183)

G1 lets you use any mp3 on your phone for any notification, regardless of length.

Quality Issues? (0)

postbigbang (761081) | more than 5 years ago | (#25511573)

It'll be interesting to see how fast Google reacts to this. Their quality assurance has been questioned recently in the light of GMail going down, oddities with Google Ads, and so on. With luck they'll become software heros, but they also risk a huge backlash if they don't pay attention to quality issues in the face of others that are trying.

Re:Quality Issues? (1, Insightful)

Anonymous Coward | more than 5 years ago | (#25511805)

Quality has never been a concern for google. They are a culture of academics. They just want to make a proof-of-concept, and that's good enough. (Just like writing a paper, you only need to make it work ONCE.)

All of their ventures display that. None of them get, as they say, "productized."

Do a job interview with them (I never have, but know several who have). All they care about is algorithms. If you even mention practices, you get turfed. They're a bunch of cowboy coders with no discipline.

Re:Quality Issues? (2, Funny)

Anonymous Coward | more than 5 years ago | (#25515579)

I liked you better when you were throwing chairs, Mr. Ballmer.

Hmm (5, Insightful)

tsa (15680) | more than 5 years ago | (#25511579)

It seems Mr. Miller doesn't like the Google Phone much. He should have notified Google of the bug and give them time to fix it before going public (as Google states in TFA).

Here's why. (3, Insightful)

Anonymous Coward | more than 5 years ago | (#25511773)

He should have notified Google of the bug and give them time to fix it before going public (as Google states in TFA).

..according to Mr. Miller, who is a principal security analyst at Independent Security Evaluators in Baltimore

It wouldn't have given him a name. Now, when the CIOs are reading the tech highlights on their Crackberries, what they'll see is Miller-Independent-Security-Evaluators-Baltimore-finds-security-flaw. And then think ... must hire next time I need security advice.

In this incredibly competitive world where you're competing with everyone all over the World and there's plenty of folks who'll do it cheaper, you have to find ways to stand out. Never compete on price because there's always someone who'll do it cheaper. Could he have told Google? Sure. But it wouldn't have made a splash in the media and when it got posted here on Slashdot, it would have said instead that "Google fixes security flaw" with no mention of Miller.

So, that's is why Mr. Miller jumped the gun and published his findings.

Being in business can really suck.

Re:Here's why. (1)

Directrix1 (157787) | more than 5 years ago | (#25512333)

Yeah, well now he will be seen as somebody who doesn't know how to do a simple security related bug report. Yeah, I totally want his advice.

Re:Hmm (5, Informative)

Shemmie (909181) | more than 5 years ago | (#25511795)

I was about to agree with you. However, upon reading their page: [securityevaluators.com]

The Android security architecture is very well constructed and the impact of this attack is somewhat limited by it. A successful attacker will have access to any information the browser may use, such as cookies used for accessing sites, information put into web application form fields, saved passwords, etc. They may also change the way the browser works, tricking the user into entering sensitive information. However, they can not control other, unrelated aspects of the phone, such as dialing the phone directly. This is in contrast, for example, with Apple's iPhone which does not have this application sandboxing feature and allows access to all features available to the user when compromised. For more information on the security of the iPhone, visit ISE's site describing the first exploit of an iPhone security vulnerability here [securityevaluators.com] .

Re:Hmm (4, Informative)

Shemmie (909181) | more than 5 years ago | (#25511807)

Oops, left out:

Working with Google
Google was notified of this issue on October 20th, 2008. We are working with them to try to get a fix as quickly as possible.

Re:Hmm (0, Offtopic)

Vexorian (959249) | more than 5 years ago | (#25514215)

Yeah right! Everybody knows of that little trick to cut your posts so

Re:Hmm (1)

Vexorian (959249) | more than 5 years ago | (#25514227)

oops, sorry forgot to put this:

So you get twice as much karma!

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#25516557)

Twice zero is still zero, I see...

Maybe you should've added a "Burma Shave"?

Re:Hmm (1)

rsmith-mac (639075) | more than 5 years ago | (#25514413)

This is in contrast, for example, with Apple's iPhone which does not have this application sandboxing feature and allows access to all features available to the user when compromised

When that exploit was published, it was the infamous TIFF exploit in the iPhoneOS 1.0-1.1.1. At the time the iPhone ran everything as root, so compromising Safari immediately granted root access. Since 1.1.3 however Apple has gone to granular permissions, most applications run as the limited "Mobile" user, for example. With that in mind, I'm not sure if the author's statement is true any longer. Safari certainly runs as a limited user, I just don't know how limited it is.

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#25511865)

Wow! An Ad Hominem attack! That certainly changes the fact that there is a security issue with the android browser, doesn't it?

Mr. Miller is under no obligation to tell Google anything, unless he is their paid consultant. I certainly wouldn't do their QA work for them for free.

Re:Hmm (1)

Chlorus (1146335) | more than 5 years ago | (#25514617)

It seems Mr. Miller doesn't like the Google Phone much. He should have notified Google of the bug and give them time to fix it before going public (as Google states in TFA).

When the hell would any slashdotter extend that courtesy, to say, M$ or Sun?

Microsoft strikes again (-1, Flamebait)

Anonymous Coward | more than 5 years ago | (#25511661)

We all know that M$ is behind this. After all, how else would they be able to post their research on the web if they didn't use AOL in Windows?

iPhone weak like other smartphones? (5, Interesting)

alphad0g (1172971) | more than 5 years ago | (#25511757)

It would be interesting to hear more about this hack as they seem to make a pretty bold and bogus claim in the article:

"Unlike modern personal computers and other advanced smartphones like the iPhone, the Google phone creates a series of software compartments that limit the access of an intruder to a single application."

The iPhone is very compartmentalized. That is why there is no cut and paste - all apps are limited to their own directory. Anyone that has jailbroken an iPhone is familiar with how one app can NOT access data in another apps directory unless permissions are changed.

Anyone else know more about this comment? It is true for WinMo smartphones - no perms at all, but I am pretty sure that the iPhone does not apply. Is this just a dig at apple?

Re:iPhone weak like other smartphones? (3, Informative)

Anonymous Coward | more than 5 years ago | (#25511969)

It is true for WinMo smartphones - no perms at all, but I am pretty sure that the iPhone does not apply.

Not quite... Windows Mobile has security based on privilege levels (e.g. user vs. admin in the desktop world), so I don't think it's fair (or accurate) to say "no perms at all." You can assign access rights to resources (files, registry keys, etc.) associated with your application, so other apps must be appropriately signed to initeract with your data.

Contrast that with the iPhone: Everything that ships on an iPhone runs as root, and not in a compartment. Period. If you hack the browser (or any other in-ROM app), you've hacked the entire device with root level access (how do you think jailbreak works?).

You're probably thinking of app-store applications. Things installed from the app-store run sandboxed in their own compartment, but that's only because Apple doesn't have a reasonable security model in place throughout the rest of the system. Oh, and you also can't run multiple sandboxed apps simultaneously. It's really a much worse security story than you're imagining, I think.

Re:iPhone weak like other smartphones? (1)

Moebius Loop (135536) | more than 5 years ago | (#25514419)

Contrast that with the iPhone: Everything that ships on an iPhone runs as root, and not in a compartment. Period. If you hack the browser (or any other in-ROM app), you've hacked the entire device with root level access (how do you think jailbreak works?).

FYI, the iPhone has not run user apps as root since version 2.0 came out. They run as a secondary non-privileged user. Of course, your personal data is also owned by that user, so it's still not anything like the Android sandbox.

Re:iPhone weak like other smartphones? (1)

RiotingPacifist (1228016) | more than 5 years ago | (#25512125)

bullshit! how do you think the jailbreak works? the browser runs as root. iPhone = least secure phone EVER!!!

Re:iPhone weak like other smartphones? (1)

Free the Cowards (1280296) | more than 5 years ago | (#25513723)

Just in the interests of accuracy, I note that the "navigate to a site that hacks your browser and jailbreaks your phone" jailbreaker has been dead for quite a long time. Modern jailbreakers work by exploiting the phone as it's connected to the computer over the USB cable. I think they perform a software restore and convince it to load a hacked OS, but I'm not sure.

None of this detracts in any way from your overall point, though. The "hack your browser" jailbreaker no longer works because Apple patched the bug it exploited, not because the browser no longer runs as root.

Re:iPhone weak like other smartphones? (1, Informative)

Anonymous Coward | more than 5 years ago | (#25513925)

The jailbreak doesn't happen through the browser. It requires flashing the OS through the USB cable. Has anyone here actually used an iPhone?

Re:iPhone weak like other smartphones? (3, Informative)

nahdude812 (88157) | more than 5 years ago | (#25514371)

It used to work by exploiting a vulnerability in TIFF processing. The browser runs as root, and the earlier jailbreak app was a "visit this site, reboot, and you're done" sort of thing. As Free The Cowards said, this doesn't work this way not because they changed the permissions model, but because they closed the TIFF exploit.

Re:iPhone weak like other smartphones? (1)

Moebius Loop (135536) | more than 5 years ago | (#25514425)

MobileSafari has not run as root since version 2.0. It now runs as the 'mobile' unprivileged user.

Re:iPhone weak like other smartphones? (0)

Anonymous Coward | more than 5 years ago | (#25512173)

That is such a nonsense. That is restriction put on the apps from the app store.

Everything runs under the same user. An attack that would get control of the browser would be able to access anything on the phone that the user it is running under can.

Fix Speed vs Apple (1, Insightful)

CritterNYC (190163) | more than 5 years ago | (#25511889)

It will be interesting to see how quickly Google fixes this compared to how long it took Apple to fix the security issues in Safari on the iPhone (a couple months, I believe, was their slowest).

Re:Fix Speed vs Apple (1)

onefriedrice (1171917) | more than 5 years ago | (#25511979)

Yeah, it's a sad position for Apple. Either they fix their security vulnerabilities quickly and everyone cries about how they are killing jailbreaking because everyone knows they just want complete control over the iPhone... or they leave the door open a while and all of the sudden they are slow at plugging security holes.

Re:Fix Speed vs Apple (1)

Miseph (979059) | more than 5 years ago | (#25512135)

Of course, they could just fix the security holes without imposing draconian controls on what's installed or how... but I guess that would run afoul of their stated interests.

Re:Fix Speed vs Apple (0)

Anonymous Coward | more than 5 years ago | (#25514271)

Wow two frigging months? I wonder how the apple fan boys feel in Monday when this is fixed

Re:Fix Speed vs Apple (1)

Superken7 (893292) | more than 5 years ago | (#25516265)

from TFA:

He said that the company had already fixed an open-source version of the software and was working with its partners, T-Mobile and HTC, to offer fixes for its current customers.

so anybody who is impatient enough should be already able to replace the browser with a custom build. :)

Can we make this any more clear? (2, Funny)

THESuperShawn (764971) | more than 5 years ago | (#25512985)

NOW do you see why we call everything we do a "beta"? Sheesh! Your Friend, Google

you fail It (-1, Troll)

Anonymous Coward | more than 5 years ago | (#25513273)

newsflash (1)

Dreen (1349993) | more than 5 years ago | (#25517513)

newsflash: new software has bugs

Security SDK Announced for Android (1)

wurtis (1394379) | more than 5 years ago | (#25519453)

Shameless commerce, but relevant: My company, Mocana, just announced a security SDK for Googleâ(TM)s Android platform that readers of this article might be interested in investigating. With it Android developers can build robust encryption, authentication, VPN, antivirus and antimalware feature into Android Handsets. Itâ(TM)s called NanoPhone, and you can learn more at http://mocana.com/NanoPhone-Android.html [mocana.com] -Kurt

Good in a way (1)

Darkness404 (1287218) | more than 5 years ago | (#25521989)

This is good in a way similar to the iPhone Safari attacks, while it is bad as any security flaw is, this might pave a way for unlocking, etc.

Re: (1)

clint999 (1277046) | more than 5 years ago | (#25522045)

This is in contrast, for example, with Apple's iPhone which does not have this application sandboxing feature and allows access to all features available to the user when compromised

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?