Winter is icummin in, Lhude sing Goddamm - John Bryan
|
|
|
Android SD card exploit exposed
A JAVASCRIPT VUNERABILITY in Android has been found that allows dodgy websites to retrieve data from a smartphone's SD card.
The flaw was discovered by insecurity researcher Thomas Cannon and in his spare time he also posted a "proof of concept exploit" using Android 2.2 on an HTC Desire smartphone.
The Android browser automatically downloads files and Javascript can be used to access the payload information locally. The browser can also run Javascript and provide read access to the files without letting users know.
It's only possible to retrieve data from the SD card on smartphones if the directory path is already known.
"However, a number of applications store data with consistent names on the SD card, and pictures taken on the camera are stored with a consistent naming convention," said Cannon. That means hackers can easily access the data.
Though Cannon used Android 2.2 on an HTC Desire smartphone for proof of concept, the exploit will work on any smartphone running any version of Android. However, the flaw runs in the Android sandbox so it's not a root exploit and thus can't be used to steal any file from a phone, only those on the SD card.
Cannon has already alerted Google's Android Security Team, which is working on a fix, but he thinks the fix will still leave a huge number of users vulnerable.
"Not all OEMs are providing Android OS updates to all of their devices, and the ones that are we have seen are not always doing it in a timely fashion," he said.
"There may be legitimate reasons for this but the bottom line is there will still be a great deal of devices exposed for quite some time or perhaps forever." µ
Share this:
Share
This vunerability is extremely easy to exploit. If anybody can get their hands on things like mail files it is going to be a huge security risk.
Think about major organizations being compromised because their mail is exposed trough android handsets. Android handset that often fake security policies to get connected to secure Exchange servers.
I think he is merely pointing out that the level of vitirol seems to drop substantially when it is other than Microsoft (or Apple if Nick "The Dick" Farrell is commenting). I assume he wants everyone treated with the same level of(dis)respect. You know to be fair and all that. I'm guessing he won lots of participation awards at school. :)
Everyone is baised, get used to it.
If Android evers gets as prevalent as Windows, then I am sure it will get a kicking at the hands on the Inq wherever and whenever necessary.
Just sayin'
@ Mitchell.
So why are they reporting it then?
Had this occurred to a Microsoft Windows Phone 7 the INQ would be crowing like it was the end of the world but if it happens to Android well nothing to see here.