Vulnerabilities / Threats

11/29/2010
10:46 AM
50%
50%

Android Vulnerable To Data Theft Exploit

Google is preparing a fix for the bug that could allow attackers to use JavaScript to read files from handsets.

RockMelt Social Web Browser Revealed
(click image for larger view)
Slideshow: RockMelt Social Web Browser Revealed

Google is working to patch a new data-stealing vulnerability that affects all versions of the Android operating system.

The vulnerability was discovered by security researcher Thomas Cannon. "While doing an application security assessment one evening I found a general vulnerability in Android which allows a malicious website to get the contents of any file stored on the SD card," he said on his blog. "It would also be possible to retrieve a limited range of other data and files stored on the phone using this vulnerability." In other words, a successful exploit wouldn't provide the attacker with root access to all device data.

Cannon said that after he emailed Google about the bug, the company made contact to discuss the issue just 20 minutes later. Google also asked him to withhold some details while it works on a fix. "As my intention is to inform people about the risk, not about how to exploit users, I've agreed," he said.

The vulnerability stems from the way Android saves downloaded files -- it always saves them in the same location. Using JavaScript, however, an attacker could automatically open any downloaded file, as well as read the contents of the file, or related files, albeit only inside the Android sandbox. While the attacker would need to know the name of the file she wanted to exploit, many applications, including the built-in camera, always save files with the same name.

Relaying any purloined files back to the attacker is likewise apparently easy. "Once the JavaScript has the contents of a file it can post it back to the malicious website," said Cannon. "This is a simple exploit involving JavaScript and redirects, meaning it should also work on multiple handsets and multiple Android versions without any effort."

Google said it will patch the issue as part of its forthcoming Gingerbread (2.3) maintenance release of Android.

But Chester Wisniewski, senior security advisor at Sophos Canada, warned about older devices that, because of memory limitations, can't run the latest version of Android, such as the HTC Dream (G1) or Motorola Devour. Accordingly, they could be "vulnerable in perpetuity" to the attack, while even the latest devices will be vulnerable for at least the next couple of weeks.

As a workaround, he said, don't use the built-in Android browser. "For now the only option is to choose third-party applications that are updated through the Android Market instead of using the embedded applications." In particular, he recommended Opera Mobile or Firefox 4 portable (currently in beta).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
More Than Half of Users Reuse Passwords
Curtis Franklin Jr., Senior Editor at Dark Reading,  5/24/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11471
PUBLISHED: 2018-05-25
Cockpit 0.5.5 has XSS via a collection, form, or region.
CVE-2018-11472
PUBLISHED: 2018-05-25
Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php).
CVE-2018-11473
PUBLISHED: 2018-05-25
Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
CVE-2018-11474
PUBLISHED: 2018-05-25
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&user_id=1 does not invalidate a session that is open in a different browser.
CVE-2018-11475
PUBLISHED: 2018-05-25
Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser.