By 
About a month ago, two Android researchers were able to find two vulnerabilities within the Android OS that have yet to be addressed or patched up by Google in the latest Android updates. What exactly are these vulnerabilities?
Well, the first bug is called a “permission-escalation vulnerability” and apparently, it affects all Android users. The exploit allows for an app to be installed without a user approving of the permissions typically required when installing an app. For instance, say you were to install a seemingly harmless (but infected) app from the Market. A hacker could then use this vulnerability in Android to gain additional malicious permission privileges after an install.
The second exploit is known as a “Linux kernel privilege escalation” and it allows for an unprivileged application to escalate or gain privileges and gain full control over a device.
Last year, Jon Oberheide, one of the researchers who discovered these 2 vulnerabilities, was able to upload an app disguised as an “Angry Birds expansion pack” into the Android Market. Once downloaded, without any user knowledge or input, the expansion pack was able to install three additional apps that monitored a phone’s contacts, location information and text messages. That data could then be transmitted to a remote server. Jon “O” had this to say,
“The Android Market ecosystem continues to be a ripe area for bugs. There are some complex interactions between the device and Google’s Market servers which has only been made more complex and dangerous by the Android Web Market.”
Both Oberheide and his fellow researcher Zach Lanier plan to speak more about these Android vulnerabilities at a two-day training course taking place at the SOURCE conference in Barcelona later this year. You can find a video from Oberheide showing off these Android bugs on his Nexus S down below.
[Via TheRegister]
So does the kernel vulnerability still work if I have the Superuser app already installed on my phone?
Probably makes it WORSE o.O
^^ nice haha
I dont think being rooted/having SU would make it any worse off. If the software were to try to run any root priveleges, SU would surely pop up asking for permission. Atleast then you’d know something fishy was going on.
It most likely will have no effect. The way SuperUser works is it controls access to SU, not the “correct” way to obtain root for things like updates. These exploits take advantage of the default way, not SU.
so how can i prevent this? and will Lookout stop this?
I don’t think this is something Lookout can prevent because it seems like it’s some pretty backdoor type stuff.
But then again.. I’m just a n00b. =/
A writer of your… “caliber”… should really learn to use the words “affects” and “effects” properly, Chris.
OMG. One typo. Chill..
http://i.imgur.com/3Ios0.jpg
More like a typo almost every post you make on here.
Wut?
CC – don’t let the haters get you down. thank you for all you do.
I was giving the other dude shit.
Oh =p
No, a typo is a mistake you made unintentionally. I fully believe you intended to use “effect” rather than “affect”, and thus it’s a not by any means a typo but a dereliction of proper grammar. And I’m being perfectly chill about it, hehe…
You can believe what ever you like, Mr. Burns. I can honestly say I’ve never made that mistake before in my life. Look on any past posts. <3
yes your grammar and spelling is usually on point.
Chris, you haven’t made any mistake. Don’t confuse being noisy with being right. :-)
Chris to please Mr. Burns I suggest you commit ritual Seppuku anything less would surely offend him.
Gotta love the “grammar police”, they don’t get laid very often. (if ever) What’s even more funny is they act like they’ve never made a typo themselves. What a sad sad life they must live.
If Phandroid is a little phone blog for phone geeks, then accepting grammatical errors and incorrect syntax is fine. However, if it intends to be a more professional site, you should strive for correct structure in the writing. Everyone slips up, or uses the vernacular now and then, but one should be thankful for corrections–especially if you have no editor.
Hold on there, son. Are you saying that the author’s phrase ” it affects all Android users” should be “it effects all Android users”? Are you kidding me? I recommend you get your butt on over to a dictionary, the sooner the better.
All right, I’ll do your work for you: “affect. v. to act on; to produce an effect or change in.” That’s from the Random House Webster’s Unabridged Dictionary”.
Effect, when used as a verb, has a very narrow use: “to produce an effect; to bring about; to make happen.” That, clearly, is not what the author meant.
Nuff said.
TROOOOOOLLLLLLLLL in the dungeon!!!
and this is exactly why I would only ever buy a nexus android device because I know as soon as there is a fix for this you are guaranteed to get it and therefore are safe, something that would be greatly delayed (or never happen) on other android phones.
Haha Chris. Don’t let the hecklers still the spotlight
Another reason to go back to my iPhone or Blackberry.
Now I wouldn’t say that… Lol
But this is something that Google needs put their top men on immediately. They have the manpower. And they definitely have the money. =p
This is not a new problem, and Google hasn’t really responded to any of this stuff. The way they took away the support forums is another reason to worry that Google ISN’T going to prioritize this. They seem to not care and as a result, I will refrain from using a more vulnerable platform like Android.
Or stop downloading crap.
Did you not read the article? Android is a lot more vulnerable to malware and viruses than other mobile platforms out today. Some people actually need to have reliable phones for communication to do business on. Just because you’re an unemployed hacker who doesn’t have job prospects and as a result doesn’t really need to call employers, doesn’t mean the majority of people using cell phones don’t need one either.
Where the hell did it say that it is more vulnerable, all it said was that there were two security vulnerabilities THAT COULD ONLY OCCUR AFTER YOU HAD INSTALLED AN APP. That means as long as you take care with what you download you’ll be fine from these vulnerabilities.
Wakko… Please go
Get a grip you turds! What the hell is wrong with you all? Some of you have completely gotten off subject. Leave the man alone, or find out the good and bad news that he informs us all about on your own!
Now to my question. How can we prevent any possible damage, or loss of data? Do I understand correctly that us root users would not be affected?
Root users may actually be at greater risk; especially those who don’t really know what having root means. Consider: You download an infected app that asks for Root permissions; you grant it because it sounds like a cool app. Now, your malicious app has root on your phone. No need for any exploits in the OS, you’ve given it permission to do what it wants.
Having root is cool; but running regular apps w/ root permissions can lead to some serious security problems. Just like your desktop, you should only run with the permissions you need to accomplish the tasks you need to do.
If we followed your logic, we may as well not have any apps on our phones at all.
The way I see it is, who cares? What do I care if somebody reads my text msgs, my contact info or my location? They’ll be pretty bored I can assure you! And I don’t pay bills, make purchases, etc over my phone, so no problem there either.
Just more fear mongering imo.
So, in other words, potentially, there could be hoards of malicious apps already in the market and no way for unsuspecting users to know what’s safe. How to screen on a mass scale or individually? I assume password protected apps and data are fair game to be hijacked as well?
Chill guys. Happens with all OS’s. Just look at iOS, but for them it was just a PDF, not even an application: http://support.apple.com/kb/DL1418