6

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your Android device.

In the video, the cyber security expert gets the correspondent to click on one link on his phone and then tells him he's compromised. Two questions:

  1. How could someone be compromised that quickly by merely clicking on a link? Don't modern browsers prevent any sort of app from being installed without asking the user first? Is there some JavaScript exploit at play here?

  2. How is an Android app able to access so much of this information anyway (provided that it's installed)? I take it that the only way to access these resources (be it messages, hardware, whatever) is through the standard Android SDK, and that the OS would prevent complete and open access to those resources without the user permission.


Summary of Video:
James Lyne, Sophos Global

James shows a complete RATting of an Android phone by simply clicking a link. It is explained that this is possible if the user allows the installing of apps from outside Google Play.

  • Nothing of the attack is explained. If the phone was rooted, then the normally security measures would be disabled and this type of compromise would occur. – schroeder May 27 '15 at 3:14
  • A android app can do alot of things if you click install with a long list of permissions. Such as installing a malicious service. Even if the phone was not rooted and did not have the permissions to record your mic etc...you can exploit most old android phones without the phone being rooted (kernel <=3.14.5). By exploiting a bug in the kernel it is possible to preform anything that phone is capable of doing. – Tim Jonas May 27 '15 at 9:01
7

(Difficulty: Incredibly Easy): If you're in Developer Mode, many of the restrictions in place to keep you safe are missing. This makes it easy for developers to test apps, but makes the device incredibly insecure. Thankfully, turning on Developer Mode is non-trivial in newer versions of Android (just a few years ago, it was not much more than a checkbox in the main settings menu). This mode should always be disabled on hardware that contains any data you care about.

(Difficulty: Easy): If you allow installs external to the Play Store, it's possible to spoof permissions due to various glitches in the permissions API. Without using the Play Store, your device can install non-Google managed software, including malicious software that can be linked to from a normal URL. It's also possible make a "no-permissions app" that later elevates its permissions through a stack overflow/underflow or buffer overrun/underrun exploit. I don't know of any specifics about those types of vulnerabilities, but I would presume that such attacks are possible.

(Difficulty: Moderate/Dependent): Some devices are "rooted" by the user, which is necessary to install some classes of apps that are not ordinarily allowed. This bypasses many of the restrictions that Linux provides, because the user is now logged in as "root", giving superuser access to the user and all apps that they install or run. Many people don't realize this is a bad idea, and so are later surprised to find out their device was compromised simply because they gave the primary user account elevated privileges (translation: they didn't know what they were doing, and what the risks were).

(Difficulty: Hard): Otherwise, if you're not in Developer Mode, and you're not allowing external installs, and you haven't rooted your device, there are vulnerabilities that exist in various scripting engines that are used by the Play Store and other apps. These can be exploited through UXSS (Universal Cross Site Scripting) attacks, where the main installation intent is invoked without the usual permissions dialog, and the only thing that's necessary is loading the script in memory through a link in a message or email. For example, Android Jellybean and lower could be hacked this way. Never trust links from sources you don't trust, and consider installing security software to reduce the likelihood of unwanted installs. NOTE: As far as I know, most apps automatically attempt to invoke an intent rather than check for some arbitrary notion of security. That is, the browser doesn't know if you meant to install an app, but it looks like you did, so it sends this request to the installation intent/Play Store.

Note that this isn't unique to Android, as iOS, Firefox OS, and Windows Mobile all have potential vulnerabilities, especially if "rooted" or otherwise modified than ways that were intended. It's also possible that carrier-provided software (those annoying apps you can't uninstall) could also have vulnerabilities, and you might not even be able to uninstall or disable those apps.

  • 3
    'the user is now logged in as "root"' is NOT what "rooted" means – Ben Voigt May 27 '15 at 18:45
  • @BenVoigt True, but for the intent of the discussion, I felt it was close enough. The point being that the user gains escalated privileges, normally tucked safely out of the user's reach, with the intent of protecting them from their own folly, much like how a normal Linux user should never log in as root, or how a Windows user should never log in as Administrator. Simple mistakes become far more catastrophic when a user unlocks full access to the system. – phyrfox May 27 '15 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.