Vulnerabilities / Threats
11/29/2010
10:46 AM
Connect Directly
RSS
E-Mail
50%
50%

Android Vulnerable To Data Theft Exploit

Google is preparing a fix for the bug that could allow attackers to use JavaScript to read files from handsets.

RockMelt Social Web Browser Revealed
(click image for larger view)
Slideshow: RockMelt Social Web Browser Revealed

Google is working to patch a new data-stealing vulnerability that affects all versions of the Android operating system.

The vulnerability was discovered by security researcher Thomas Cannon. "While doing an application security assessment one evening I found a general vulnerability in Android which allows a malicious website to get the contents of any file stored on the SD card," he said on his blog. "It would also be possible to retrieve a limited range of other data and files stored on the phone using this vulnerability." In other words, a successful exploit wouldn't provide the attacker with root access to all device data.

Cannon said that after he emailed Google about the bug, the company made contact to discuss the issue just 20 minutes later. Google also asked him to withhold some details while it works on a fix. "As my intention is to inform people about the risk, not about how to exploit users, I've agreed," he said.

The vulnerability stems from the way Android saves downloaded files -- it always saves them in the same location. Using JavaScript, however, an attacker could automatically open any downloaded file, as well as read the contents of the file, or related files, albeit only inside the Android sandbox. While the attacker would need to know the name of the file she wanted to exploit, many applications, including the built-in camera, always save files with the same name.

Relaying any purloined files back to the attacker is likewise apparently easy. "Once the JavaScript has the contents of a file it can post it back to the malicious website," said Cannon. "This is a simple exploit involving JavaScript and redirects, meaning it should also work on multiple handsets and multiple Android versions without any effort."

Google said it will patch the issue as part of its forthcoming Gingerbread (2.3) maintenance release of Android.

But Chester Wisniewski, senior security advisor at Sophos Canada, warned about older devices that, because of memory limitations, can't run the latest version of Android, such as the HTC Dream (G1) or Motorola Devour. Accordingly, they could be "vulnerable in perpetuity" to the attack, while even the latest devices will be vulnerable for at least the next couple of weeks.

As a workaround, he said, don't use the built-in Android browser. "For now the only option is to choose third-party applications that are updated through the Android Market instead of using the embedded applications." In particular, he recommended Opera Mobile or Firefox 4 portable (currently in beta).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5316
Published: 2014-09-21
Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page.

CVE-2014-5320
Published: 2014-09-21
The Bump application for Android does not properly handle implicit intents, which allows attackers to obtain sensitive owner-name information via a crafted application.

CVE-2014-5321
Published: 2014-09-21
FileMaker Pro before 13 and Pro Advanced before 13 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2319...

CVE-2014-5322
Published: 2014-09-21
Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 13 and Pro Advanced before 13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-3640.

CVE-2014-6602
Published: 2014-09-21
Microsoft Asha OS on the Microsoft Mobile Nokia Asha 501 phone 14.0.4 allows physically proximate attackers to bypass the lock-screen protection mechanism, and read or modify contact information or dial arbitrary telephone numbers, by tapping the SOS Option and then tapping the Green Call Option.

Best of the Web
Dark Reading Radio