Comments on: Hackers Release Data-Stealing Program to Push Google to Plug Holes at Security Conference

By: Messias Brazilio

Messias Brazilio — Tue, 19 Oct 2010 22:27:38 +0000

se alguem tiver eu gostaria de ter este programa obrigado

By: tknicker

tknicker — Wed, 04 Aug 2010 20:42:17 +0000

Hey guys,
I TRIED to root my Droid X with a software program called DroidX Root. I’ve seen it published all around the internet to be a “1 click solution” to rooting. I couldn’t get it past the “turn off Bluetooth” part, and it still remains unrooted today. But I’m worried, after reading this article, that I could have let the software gain access to my phone without me knowing. Here is the link I followed to access the download.
http://alldroid.org/default.aspx?g=posts&t=553

Am I being paranoid? Or should I take steps to ensure that my phone is safe?

By: Mike

Mike — Tue, 03 Aug 2010 03:44:44 +0000

@Eric :: Quite right. +1 there.

By: Deyna

Deyna — Tue, 03 Aug 2010 01:21:18 +0000

just in case someone didn’t understand i’ll recap quickly (and noticeably so this is less likely to be skipped) what the knowledgeable have said:

THE PROGRAM DOES NOT REQUIRE ROOT AND IT MAKES USE OF A FLAW IN BOTH ROOTED _AND_ NON-ROOTED PHONES

the article even said this: “The program is a “root” utility that disguises itself as a program to help easily root your phone” . . . “that’s if it even goes through the process of rooting at all”

the example given at the conference was a fake rooting program but it could be _any_program_ because it does _NOT_ require root

i hope that was clear. please forgive the caps

By: Eric

Eric — Mon, 02 Aug 2010 15:45:45 +0000

@everyone idk why there is still discussion, Extremx (19th post) said everything.

By: BetterThanEVO

BetterThanEVO — Mon, 02 Aug 2010 06:06:27 +0000

I wonder if they are referring to the Unrevoked tool?

By: squiddy20

squiddy20 — Mon, 02 Aug 2010 03:50:27 +0000

@Tad: as to your first comment, couldnt it be said that Google, and not open source, was the one that failed since this vulnerability was brought to their attention, but virtually no action was taken? Google should be taking some action in managing the Marketplace, definitely not to Apple’s extent, just a bit though to keep malware, exploits, and other crap out. Also, if you took the time to read the article you would notice “the hackers aren’t doing this with any malintent…”
@Tad comment 2: security patches such as this *should* be put though pretty quickly. i mean, no carrier wants the possibility of complaining customers. OS updates and security patches are 2 completely different things. im not even a developer and i know that the code for an OS update is vastly larger than for a security patch. think of it this way, the patch is like a bandage when you get hurt, you only put it over the affected area, not your entire body. They arent completely redoing the OS, just the small portion that is affected in the security hole. As for your last comment, I will admit, ive rooted my samsung moment, but only because i didnt want all of sprint’s stupid bloatware and to improve my battery life a bit. i dont think im better than you, or anyone else for that matter, if you last a whole day on 1 charge with moderate usage, without root, all power to ya. fyi, for most phones, there are files out there to revert your phone back to complete stock and unroot your phone. unless your carrier heavily inspects your phone when you take it in, theyll never know you “voided your warranty”.

By: Tad

Tad — Mon, 02 Aug 2010 02:25:46 +0000

This brings me to another point.

How quickly can we expect to have critical security patches sent to us OTA? With the development pipeline going from Google to the Hardware Manufacturers, to the Carriers… a simple fix could have multiple hands in the pot, all taking their sweet damn time to correct potential issues. We all know how horribly long it takes to get OS updates to our handsets after they are released by Google – how about a critical security patch?

(And for all you “I’m better than you” root users – you’re part of the problem here. I’m not going to void my warranty so that I can apply patches straight from google.)

By: Tad

Tad — Mon, 02 Aug 2010 02:21:56 +0000

>>You fail to understand what Open Source is.

However, here we have a glaring example of where it FAILED. Peoples lives could potentially be ruined by this security bug. Real impact to real people trying to live their lives, conduct business, all on a phone that they think is going to, at the very least, keep their SMS messages and Email private to themselves and their respective recipients.

Open source touts its “security” manta by claiming that since there are multitudes of sets of eyes looking at the source, potential security holes are caught and corrected by the community. It didn’t happen here. The tool was released to a bunch of people at a Conference that is stacked with Federal agents to arrest *criminals*. Sets of eyes reviewing the vulnerabilities in the system is great – except with those eyes have mal-intents.

Thats not secure. The open source model didn’t work here. While you might agree with the virtues of the ideology, when put to practice, in this case it failed.

By: Last European Cavemen

Last European Cavemen — Mon, 02 Aug 2010 00:35:23 +0000

@UHF3 Get Digital Your mind was left in the garbage
@Jose G You want a truly locked phone go live in N.Korea and its analog too. You fail to understand what Open Source is.

By: Jose G.

Jose G. — Sun, 01 Aug 2010 23:26:51 +0000

We really need to re-architect our OSes to block root access 99.9 percent of the time. There are so many ways to add software and functionality without having core access to the operating systems most vulnerable systems. There needs to be a whitelist of trusted developers for that core root access. I frankly do not trust these developers because they code just for functionality & not for security.

If anything, Google needs to own more of the Android experience. Do not leave the new edition upgrades to the carriers anymore & better scrutiny of the apps. We don’t need to go to Apple extremes, but a better system of checks and verification are needed.

We need to have levels of permissions for developers based on upon their experience & earned trust. Frankly, the open season part of open source creates inherit security risk no different than closed source.

By: uprooted

uprooted — Sun, 01 Aug 2010 22:59:33 +0000

@Mac, That’s an excuse. You blame the carriers and manufacturers for lockdowns, but some of those lockdowns are there to prevent just this kind of malware. Even so, there will always be people who want the ability to root just because they don’t like anyone telling them no, you can’t. But that’s OK. The harder users work to find the exploits that let them root, the faster those exploits can get closed.

By: bigjay517

bigjay517 — Sun, 01 Aug 2010 21:45:50 +0000

@Fahad
You do realize that the application that pops up to “allow” root access is installed by the user in the first place? It is not built into the OS. So if a malicious application was able to root your phone and steal your data then they would simply steal your data without installing the application that allows you to block root access.

By: Mac

Mac — Sun, 01 Aug 2010 20:54:02 +0000

@UHF3, it *IS* about rooted phones.

Without the ability to get root, the subsequent security flaws don’t exist.

On the other hand, people wouldn’t be so interested in having the ability to get root if the carriers weren’t such complete d*cks about crapware, disabling features, and other highly valid reasons to break out of their mostly-inept lockdowns.

By: extremx

extremx — Sun, 01 Aug 2010 20:27:58 +0000

I was at the defcon presentation and live demo for this. The exploit was pushed to the phone using ADB and uses a kernel exploit to run. At this moment i do not know of a way to infect a phone with this without pushing via ADB. In all honesty, i would use this exploit on my personal phone as a security feature if my phone ever got lost or stolen. I could call my phone and find out its location and all my personal data without the thief ever knowing i was on. :)

This presentation came in two parts though, the rootkit being the second half. The first half was about apps that ask to use your data on the phone ie: contacts, network, etc. THis is much more of a concern to me than the rootkit, as developers will steal and hide data within apps we all download. One example they gave is a set of wallpapers that gathered IMEI and serial numbers off the phone and sent it back to a site in China (go figure). These wallpapers had millions of downloads. This has been sent to google and the developer is under investigation. The developer claims it uses that data to “save settings when moving to a new phone”

my 2 cents.