It’s a matter of time before two serious security flaws in Google’s Android mobile phone OS hits millions and millions of users. Unless Google gets its act together and begins communicating and issuing effective updates then it’s loyal users are at risk. Come on Google wake up !!
Android security woes got worse on Thursday, with two separate reports of code defects that put millions of end users at risk.The first involves the update Google released last week fixing a flaw that allowed attackers to execute malicious code on an estimated 950 million phones with nothing more than a maliciously crafted text message. Seven days later, security researchers are reporting that the patch, which has been in Google’s possession since April, is so flawed that attackers can exploit the vulnerability anyway.
“The patch is 4 lines of code and was (presumably) reviewed by Google engineers prior to shipping,” Jordan Gruskovnjak and Aaron Portnoy, who are researchers with security firm Exodus Intelligence, wrote in a blog post published Thursday. “The public at large believes the current patch protects them when it in fact does not.”
The code-execution vulnerability is the result of a buffer overflow bug in Stagefright, a code library that processes video. Last week’s patch, which was submitted by the researcher who discovered the flaw and privately reported it to Google in April, closed some but not all exploits. Specifically, booby-trapped MP4 videos that supplied variables with 64-bit lengths were able to overflow the buffer and feed malicious code into Android memory. Typically, MP4 videos work with 32-bit variable lengths, but the Exodus researchers found rare cases where 64-bit lengths can be used.
Buffers act as containers that are designated to hold specific amounts of data. When the designated size is exceeded, contents can be executed. Newer versions of Android have a security measure known as address space layout randomization that makes overflow exploits harder to carry out. The defense works by randomizing the memory locations the malicious code is loaded into, preventing attack code from being able to call it. As a result, devices merely crash rather than execute the code. The exploit mitigation, however, can often be bypassed using more advanced hacking techniques.
At the time this post was being prepared, Google was continuing to make last week’s patch available, both to end users through over-the-air updates and to partners. Company engineers have allocated the vulnerability identifier CVE-2015-3864 to the flawed patch, the Exodus researchers said, but so far there’s no word when a corrected fix will be available. The incident underscores just how hard it is to get security right.
Read the full text and alternative views here.
Znet give Google some stick for lack of action on Android.
CNBC report on new update plans.