Finally, someone's fixed THAT Android hole. Was it your mobe network? No A new tool attempts to close down the master-key vulnerability in Google Android that allows malicious software to masquerade as legit apps. Free utility ReKey hooks into the underlying operating system to defend fandroids who may be fretting about exactly when an official patch will arrive from their smartphone manufacturer …
From www.rekey.io :
"In order to patch the vulnerabilities on your device, ReKey requires escalated privileges. Normal unprivileged applications on stock Android devices do not possess such privileges, hence the need for a rooted device with the Superuser (or similar) application."
Quick poll of Android devices in the office that are "patched":
Sony Xperia Z
Sony Xperia SP
Samsung Galaxy S III
Something's not right here. The first two are fairly new but the S3 hasn't been patched for ages. Either the statement "only the Samsung Galaxy S4 has been patched" is incorrect, or the scanner's wrong, or not all devices were vulnerable in the first place.
Just tried the Bluebox tool on a HTC Desire S and it says unpatched, also tried on a Galaxy Note 2 which it says is patched, the Note 2 did download an update as soon as I unboxed it.
My Galaxy S3 did actually download a small patch from Vodafone quite recently, unfortunately it's being repaired at the moment as I dropped it and am unable to test.
that ReKey is having problems and causing some devices to enter a boot-loop. They say it's fixed in the latest version, but "non-destructive"? a boot-loop you can't get out of is a major implementation flaw, and almost as good as bricking your device.
I'll be waiting for a few more positive reviews before I take the plunge, personally.
The fact that it can just disable the firewall with a root shell. Even system apps are vulnerable to a root shell. That's why SU apps prompt you before they're given the OK. It's all up to you to make sure what you're allowing does what it's supposed to do because once they get the shell, it's all "caveat utilitor".
as it is reported, all Android powered devices are OPEN to the world without the patch.
can we really complain about a 'fix' that 'takes root and/or superuser privileges' in order to close the security flaw?
which is the lesser evil, 'devious gov's, individuals, institutions, mobile phone carriers' placing malware on your device via this flaw or 'some basic trust' in a well meaning security group, that yes could be hacked themselves to produce a product or backdor?
bit like your front door lock being broken. do you:
a) close the door hoping no-one will try and get in?
b) trust that the person who replaced the lock didn't sell a spare key to one of his mates?
I think you're miss understanding. The front door isn't open as you must first install a dodgy application for it to gain access to your system. This is more akin to your safe door being open and you then opening your front door and inviting a burglar in.
Have I misunderstood this vulnerability or is it:
- Hacker could take Facebook/Twitter/etc. APK.
- Add malicious code into it.
- Distribute the app (via 3rd party sites unless they have access to the companies Google Play login) and it would be installed as a valid update to your already installed Facebook/Twitter/etc. apps.
But if you could get people to install your app from a non-Google Play source, couldn't you just as easily have them install any app that's labelled as Facebook/Twitter/etc. and just have the app open a web view or crash on startup (once you've done whatever you wanted to)?
So what's the real vulnerability to end users? Not suggesting it shouldn't be fixed, but how does this make it easier to infect a phone?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
