Tip Us

Android Police
Prev
Posts in the last
24 Hours
sorted by
Hottest
Next
Articles Tagged:

vulnerabilites

...

Two major vulnerabilities found in OnePlus 3 bootloader - OP has patched one, working on the other

Michael Crider

OnePlus is something of a darling among Android power users, shipping phones that can be bootloader unlocked without any special permissions or codes. But security researcher Roee Hay found that the OnePlus 3 (and the revised OnePlus 3T) are rather more open than was probably intended. With two native fastboot commands, Hay found he could install unverified boot images and disable the verified boot feature, all without actually unlocking the bootloader with the familiar user-accessible command. Which is, well, bad: it basically means anyone can run malicious code on the phone without resetting the user's data.

Read More
...

Google's Project Zero starts its own Android hacking contest with a top prize of $200,000

Michael Crider

Calling all hackers and security researchers: Google wants to pay you money. Quite a lot, in fact. The top prize for finding a new critical flaw in Android in the new Project Zero Prize competition is a whopping $200,000, with the second prize at $100,000 and $50,000 split among additional entrants. The contest is being run by Project Zero, the company's own internal team of security researchers that documents critical flaws and bugs in wide-reaching software.

Read More
...

Google Promises A Stagefright Security Update For Nexus Devices Starting Next Week

Michael Crider

So you might have heard about the Stagefright vulnerability that was published yesterday. While there's no evidence of a widely-used hack, the potential for malicious MMS attacks via Android's built-in media handling system (which could theoretically affect the majority of Android devices currently in operation) is certainly cause for concern. As reported on our original post, Google has known about the vulnerability since April and has been working on patches to fix the problem.

We've received a statement attributed to a Google spokesperson [emphasis ours]:

This vulnerability was identified in a laboratory setting on older Android devices, and as far as we know, no one has been affected.

Read More
...

[New App] Bluebox Heartbleed Scanner Can Help You Discover An OpenSSL Vulnerability On Your Device

Cody Toombs

The Internet has been abuzz over the recently discovered Heartbleed bug. If you're not already familiar, Heartbleed is a vulnerability in the OpenSSL software library that allows an attacker to steal data directly from the memory space of an application and learn the private keys used to keep data securely encrypted as it travels over the Internet. The implications of this kind of leak are certainly severe, and it has everybody rushing to either install updates that fix the bug or implement workarounds to disable it.

As users, there's not a lot you can do to close this security hole on your device, but you might still want to know if you're vulnerable.

Read More
...

SuperSU Security Advisory: Update To Version 1.69 (Available Now) To Avoid Potential Exploits

Cameron Summerson

If you're a root user, listen up. Chainfire updated SuperSU to v1.69 as of last night, which fixes two exploits that could allow an attacker to leverage root privileges without first prompting the user. Probably nothing to get overly anxious about, but it's definitely a good idea to make sure you're running the latest. Details of these exploits will be released next Monday, so you'll want to grab the update before then.

Screenshot_2013-11-13-09-24-12

Fortunately, this one's pretty easy – just install the update from the Play Store and you're covered; no need to flash anything.

This update also includes a handful of other fixes and things:

Changelog
- XBIN mode (some new roots need this)
- Slightly adjusted binary installer
- Backup script installation now available for all backuptool-capable ROMs
- Fixed su-ing to a non-root user not working on some 4.3+ firmwares
- Fixed BOOTCLASSPATH vulnerability (CVE-2013-6774) - Fixed notification sanitization vulnerability (CVE-2013-6775) - Fixed possible closed special files vulnerability
- Updated language files

The update is already live in the Play Store, so make sure to pull it down as soon as you can.

Read More
...

[Security] Vulnerability In Firefox For Android Discovered That Allows Hackers To Steal Files From The SD Card And Firefox's Privately Stored Data [Update]

Cody Toombs

The security of our mobile apps and private data is a very serious matter. This is particularly true for high value targets like web browsers, which often store login credentials that can be used to access many of the websites we use on a regular basis. Unfortunately, browsers are also very complicated applications with an extensive set of features that are difficult to lock down completely. Sebastián Guerrero Selma of viaForensics recently posted a video demonstrating a newly discovered vulnerability in Firefox for Android which would allow hackers to access both the contents of the SD card and the browser's private data.

Read More
...

CyanogenMod 10.1.2 Is Another Small Security Update, Patches Second Master Key APK Vulnerability

Jeremiah Rice

Second verse, same as the first. Two days ago the CyanogenMod ROM team announced a security update to the CM 10.1 platform, incorporating the "Master Key" security patch that Google had already issued back in February. Yesterday another, more intricate exploit in the same vein was posted by a Chinese blog, and again, Google has rapidly moved to patch the problem in Android... which won't be much comfort to those running an older release. Being the security-minded folks that they are, the CyanogenMod team has already patched the vulnerability in an even newer version of the ROM, CyanogenMod 10.1.2.

Untitled-4

It's an easy fix if you know what you're doing: nine lines of code prevent malicious apps from skipping the signature verification built into Android.

Read More
...

Second "Master Key" Style APK Exploit Is Revealed Just Two Days After Original Goes Public, Already Patched By Google

Cody Toombs

Hot on the heels of Bluebox's disclosure of the "Master Key" exploit, a Chinese blog has posted details of a similar vulnerability. This attack also sidesteps a bug in the signature verification step and allows seemingly innocent APKs to include a potentially dangerous payload; and like its brethren, Google has already patched the flaw and posted it to the Android Open Source Project (AOSP). The information comes to us from a China-based group (or possibly individual) calling itself the Android Security Squad. The original post is in Chinese, but a vaguely comprehensible translation can be had thanks to Google.

Read More

The Best Of AP

72
Unlimited power: ASUS ROG Phone charges when plugged into itself, solves world's battery problems
136
Google Photos will no longer provide unlimited storage for unsupported video files
111
Pixel Sounds updated to v2.0, and it actually works now [APK Download]
58
Metro by T-Mobile reverses $15 SIM-swap fee after public outcry
...

CyanogenMod 10.1.1 Stable Rolling Out Now With Security Fixes For Master Key And More

Ryan Whitwam

While most Android users are waiting on updaters that might patch some of the recently reported security holes, CyanogenMod is already getting a bug fix update out the door. CyanogenMod 10.1.1 is now hitting the stable channel for all supported devices.

cm

The Master Key exploit will be presented by Jeff Forristal at Black Hat 2013 as "One Root To Own Them All." It's essentially a bug in signature verification which can be used to insert malicious code into an APK. Google patched the bug back in February, but the new code hasn't made it into most official ROMs – even Nexus devices have yet to receive the fix.

Read More
...

Dan Rosenberg: 'I See This As The End Of An Era For Motorola Rooting And Modding'

Cameron Summerson

When it comes to root and mod action on Motorola devices from the last couple of years, all eyes turn to brilliant Android hacker Dan Rosenberg. Since the Droid 3 was released two years ago, Rosenberg has successfully found root exploits for every Motorola device, including the D3, Bionic, RAZR, Droid 4, Xoom 2, Atrix HD, RAZR HD, and RAZR M. Add to that the fact he just released a tool that unlocks the bootloaders on the most modern Moto phones (RAZR HD, M, and Atrix HD), and it's not hard to see why he's such an important part of the Motorola modding community.

Read More

What's Hot