Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror

Slashdot videos: Now with more Slashdot!

  • View

  • Discuss

  • Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

×
Android Cellphones Google Handhelds Security IT

Researchers Find Big Leaks In Pre-installed Android Apps 136

Posted by Soulskill
from the secure-your-leaking-data-with-large-bucket dept.
An anonymous reader sends this quote from an article at Ars Technica: "Researchers at North Carolina State University have uncovered a variety of vulnerabilities in the standard configurations of popular Android smartphones from Motorola, HTC, and Samsung, finding that they don't properly protect privileged permissions from untrusted applications (PDF). In a paper just published by researchers Michael Grace, Yajin Zhou, Zhi Wang, and Xuxian Jiang, the four outlined how the vulnerabilities could be used by an untrusted application to send SMS messages, record conversations, or even wipe all user data from the handset without needing the user's permission. The researchers evaluated the security of eight phones: the HTC Legend, EVO 4G, and Wildfire S; the Motorola Droid and Droid X; the Samsung Epic 4G; and the Google Nexus One and Nexus S. While the reference implementations of Android used on Google's handsets had relatively minor security issues, the researchers were 'surprised to find out these stock phone images [on the devices tested] do not properly enforce [Android's] permission-based security model.' The team shared the results with Google and handset vendors, and have received confirmation of the vulnerabilities from Google and Motorola. However, the researchers have 'experienced major difficulties' in trying to report issues to HTC and Samsung."
This discussion has been archived. No new comments can be posted.

Researchers Find Big Leaks In Pre-installed Android Apps

Comments Filter:
  • Cyanogenmod (Score:5, Insightful)

    by Skarecrow77 (1714214) on Friday December 02, 2011 @02:05PM (#38240342)

    What does it say when I trust a bunch of random coders on the internet to give me a better performing, more secure, and overall more pleasing experience with my smartphone than the company that created it.

  • Carriers (Score:3, Insightful)

    by bonch (38532) on Friday December 02, 2011 @02:10PM (#38240420)

    The lack of control the carriers have over iOS is just one of the reasons I prefer it over Android. They wanted to pre-install a bunch of junk on the iPhone, and Apple wouldn't have it. The difficulty reporting these vulnerabilities to HTC and Samsung is not surprising.

  • Re:facepalm (Score:5, Insightful)

    by TheRealMindChild (743925) on Friday December 02, 2011 @02:15PM (#38240476) Homepage Journal
    You say this, like something complex is doomed to be incomprehensible to do correctly. Simple fact of the matter is, these silly folks are still using strlen(...) and ridiculously bad coding practices, known for decades, all to come in under deadlines. I see WAY too often a multi-tier database application, where security is implemented by constantly querying what rights the user has from a "Users" table. They implement security with a bunch of 'if/switch' statements and claim "it's the nature of complex software!" when a security vulnerability is found, rather than putting security on the database.
  • by Samalie (1016193) on Friday December 02, 2011 @02:17PM (#38240518)

    But you CAN root your phone, which means that these massive security flaws are actually a FEATURE of Android phones, because it will inspire everyone to root their android phone too!

    Duh!

  • by mtrachtenberg (67780) on Friday December 02, 2011 @02:18PM (#38240534) Homepage

    I hope all of the people thinking it would be very cool and convenient to vote via smart phones (or the internet, or the telephone, or the mail system) will notice that smart phones might not yet be perfect.

    Voting is a classic example of a situation where the requirements cry out for appropriate technology.

    The requirements are unique: you must not be able to prove how you voted, you must not be able to sell your vote or be coerced by anyone, you should be able to have complete confidence that your vote was counted properly along with everyone else's.

    The technology that is required is completely straightforward -- people have to go to protected locations, create physically countable and non-traceable artifacts that represent their uncoerced opinions, deposit these artifacts into a locked box at the location, and know that the contents of the locked box are properly reflected in the results.

    The best way to accomplish the last step is to count the contents in public before the contents are moved, and to generate and digitally sign images of the artifacts so that anyone who wants to confirm your count is an accurate representation of the contents is able to do that.

    All attempts to modernize voting for convenience's sake are misguided. All opinions that making a simple approach more complex to speed up the distribution of results are misguided. Something that is convenient but cannot be checked is not appropriate for voting. And any time a computer scientist tells you how secure something is, introduce them to real people and the way they protect their passwords.

  • Re:facepalm (Score:5, Insightful)

    by The Moof (859402) on Friday December 02, 2011 @02:31PM (#38240688)
    Yea, sure bugs exist. But when you force this software on your customers, and restrict their ability to remove the software, you better make damn sure that software's secure.
  • Re:facepalm (Score:5, Insightful)

    by MozeeToby (1163751) on Friday December 02, 2011 @02:36PM (#38240770)

    Nope. This complex software (Android) has a surprisingly good security model. Carriers are installing software which ignores permissions, is not removable by the user, and creates new, serious security issues. The carriers are being evil and/or incompetent.

  • by ackthpt (218170) on Friday December 02, 2011 @02:37PM (#38240782) Homepage Journal

    if (x < 0) {do_sfuff(); exit;}
    if (x == 0) { do_other_stuff(); exit;}
    if (x > 1) {

    ... establish restrictions ...

    perform_secure_operation();

    }
    .
    .
    .
     

    So... what happens when x == 1

  • by Galestar (1473827) on Friday December 02, 2011 @02:37PM (#38240786)
    No no and no. Open source is not by definition vulnerable. Also, if you bother to read the title, let alone RTFA, you'd notice it is the handset manufacturer that is making the security blunders. The reference implementation (the open source stuff) "had relatively minor security issues".

    Open source, assuming you have enough (competent) people working on it, is MORE secure than closed source.

    In short, it appears you have some rather backwards pre-conceived notions about open source, and apparently you also have a reading comprehension problem.
  • by Dr_Barnowl (709838) on Friday December 02, 2011 @02:42PM (#38240872)

    The appropriate technology for voting is a pencil.

    Anything mechanized or computerized might be splendid, efficient, and offer a whole host of other benefits. But they all lack the absolutely vital feature; the average man on the street must be able to audit it. And verily, should be required to do so.

    Making a voting system where only a limited set of technocrats can audit it's veracity is madness.

  • Re:facepalm (Score:3, Insightful)

    by CmdrPony (2505686) on Friday December 02, 2011 @02:44PM (#38240910)
    Wait, what now? So when it's about Android vulnerabilities it's "Faceplam. This just in: complex software has security vulnerabilities." and when it's about Windows vulnerabilities, Gates should get a death sentence and we should bomb half the planet to kill every human being has ever even touched Windows?
  • Re:Carriers (Score:0, Insightful)

    by Anonymous Coward on Friday December 02, 2011 @02:46PM (#38240946)

    The IPhone comes with a pile of junk on it too, which you can't remove. Furthermore, Apple have admitted they've been using Carrier IQ, which was obfuscated from detection.

    Finally, the iPhones are the only phones you can root by merely going to a website. Now that is utterly pathetic!

  • Re:facepalm (Score:2, Insightful)

    by masternerdguy (2468142) on Friday December 02, 2011 @02:47PM (#38240974)
    If you've read my posts you'll see I really am not a google fan.
  • Re:facepalm (Score:4, Insightful)

    by AJH16 (940784) <aj@noSpam.gccafe.com> on Friday December 02, 2011 @02:59PM (#38241150) Homepage

    How then do you prevent the user from circumventing the application and using their db permissions to misbehave directly if the user should only be able to do certain things in certain situations? To say blanketly that the only correct approach to security is to implement it at the db level is naive as there are many situations where it is not desirable that the user have any permission to the DB other than through the application. It would be nice if it was possible to have a combined security that would only allow the user to have permission while going through the application, but that is also notoriously difficult (if not impossible) to implement in many situations or on certain platforms.

  • Re:facepalm (Score:4, Insightful)

    by UnknowingFool (672806) on Friday December 02, 2011 @03:29PM (#38241608)
    If you bothered to read the summary, the vulnerabilities lie in how the manufacturers implemented Android. To use an analogy if Dell made PCs that had a vulnerability because of the sound drivers they implemented, the fault lies with Dell. Where we give MS grief is Windows vulnerabilities affect versions of Windows regardless of the OEM that installed it.
  • Re:Cyanogenmod (Score:5, Insightful)

    by clarkn0va (807617) <apt DOT get AT gmail DOT com> on Friday December 02, 2011 @03:33PM (#38241654) Homepage
    You're right, and what a sad statement that is on the current state of affairs when a group of companies can treat their consumer base with something between indifference and contempt and yet continue to profit from them.
  • Re:Cyanogenmod (Score:4, Insightful)

    by jasno (124830) on Friday December 02, 2011 @03:53PM (#38241934) Journal

    Look, the people who develop the phones use them too. The reality is that there just aren't that many smart, motivated, capable engineers out there. Even when you have a few alpha-engineers on a team, their time is usually spent trying to squash those hard-to-fix bugs instead of doing a thorough security analysis. They're rushing to get the damn thing to production so they can move on to the next big thing.

    I've spent my career developing embedded applications and not once has anyone paid me to address security. Bugs - user experience issues, stability problems, content security, standards compliance - those get the money. No one in management values security or privacy and they won't unless security researchers and hackers make the consumer aware of it.

  • Re:facepalm (Score:3, Insightful)

    by thoromyr (673646) on Friday December 02, 2011 @04:58PM (#38243054)

    If you read the paper you would find that *Google* phones also suffered from the problem, albeit to the least degree. Both the Nexus One and Nexus S did not effectively protect the DELETE_PACKAGES permission. That isn't exactly insignificant. Now, the likelihood of a google fixing it is rather higher than Samsung or HTC who ignored the researchers reports prior to release of the paper, but it isn't *just* a carrier issue.

It is masked but always present. I don't know who built to it. It came before the first kernel.

Working...