Quadrooter: New Vulnerabilities Affecting Over 900M Android Devices [pdf]
checkpoint.com
checkpoint.com
Edit: Furthermore, if the companies are going to lock down devices and driver blobs so nobody else can fix them, all the more reason that the security of the device is their absolute responsibility.
That being said, the FCC is a little toothless, and every time they try and do something consumer friendly the courts kick them in the shins.
More likely to see something positive come out of the EU than FCC, but in either case these companies will make changes to all markets because it is more efficient than just doing the EU.
Android in particular could learn a lot from Linux's distribution model (package managers, et al). I've been tempted to move to iOS just because of how much better updates and device lifespan are.
Google already updates their phones every month for three years which is long enough for a device most people replace or break within two years. Verizon isn't the only carrier of course.
Feature updates? Sure those can go away as the manufacturer feels like it (though they should be required to be upfront about this).
You are comparing software security updates to products recalled for safety issues? Well phones are already subject to recalls for hardware/battery problems. Let me know when a phone kills or hurts someone due to lack of security updates.
iOS 9 supports the iPhone 4S and the iPad 2, which again is a five-year span (2011 to 2016).
I have devices that are that old; the iPad 3 I have just prompted me to update to the latest 9.3 update, and it's so slow running newer apps that I gave it to my toddler to play games on instead.
So I agree, three years is good, four years is better, but Apple is already at five years and has been for a while now.
Just like desktop computers they will reach a point where, for most people, they're 'good enough', even if they're really slow.
For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise.
Cell phones are a literal lifeline device, to the point that emergency calls (at least in the US, and probably in any civilized part of the planet) //WILL// always work; without unlocking the phone, without the phone being on a payment plan, as long as the device has the power to transmit that distress need.
It is not difficult to imagine how issues with the security portion of the layer could allow anything from a computer virus to DDoS local infrastructure (jamming), to targeting specific individuals (lock out their ability to call for help, bug and track movement), to picking out individuals that are alone and in vulnerable moments. Those are attacks I thought of just typing this comment and are not an exhaustive list.
This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device: not just by it's first owner, but all the way through to it's last. Or failing that, they should be required to both release the sources and provide everything necessary in a legal sense for other entities in the community to perform the security updates they are unwilling to do. Carriers should also be liable for failing to (offer to) distribute said security updates to devices on their network (it is in the interest of everyone that they do this and do not charge for it).
What? Most phones sold today do NOT have replaceable batteries.
>For some people, particularly the elderly, the young, and the poor, they'll use it until it literally stops working at all because they literally cannot afford otherwise.
One can get a new Android phone from Amazon for $50 no contract. Landlines still exist and are almost available anywhere unlike cell coverage.
>Cell phones are a literal lifeline device...
I could live with a dumb phone as my PC is way more important. When are we going to make Microsoft start to provide security updates to XP again?
You must be like 20 years old... I hate to break it to you but no one needs a cell phone to survive.
>This is why the security updates either must be performed by the companies in question through the actual use lifetime of the device...
Well start writing Congress but personally I don't want my new phone to be another $50 more because the OEM is required to provide security updates for phones 5 or more years old.
Buying a new (crappy, what do you expect for 50 Dollars?) phone because your perfectly working one isn't supported anymore is NOT satisfying and not a solution.
Windows XP is actually a very nice example. According to Wikipedia it came out in 2001 and got constant (you can complain about the quality or bring up other complaints) updates until 2014. It's rather amusing that you bring up Windows XP as a _counter argument_ to decent updates. Most phone manufacturers have a hard time updating their devices for 1.5 to 2 years, let alone 13.
I feel that you're a bit lost. You want to save a bit of money ($50 is your example) when you purchase a new device because if it's becoming vulnerable due to a crappy manufacturer/vendor you can always .. get a different one for the same price?
Ignoring that this doesn't make sense, you're also hurting the 'herd immunity'. This argument of yours is comparable to anti-vaccines discussions. "I want .." vs. "The general public would benefit if this would be the case". I know what Kirk and Spock would decide, but you're entitled to have a different opinion, of course.
In my world too but most smartphones sold these days in fact do not have removable batteries by design. You don't know this?
>Buying a new (crappy, what do you expect for 50 Dollars?) phone because your perfectly working one isn't supported anymore is NOT satisfying and not a solution
That $50 phone is just as good or better than a phone sold 3 or 4 years ago.
>I feel that you're a bit lost. You want to save a bit of money
No dude... I buy a new phone every two years to have a faster one, better features (camera), and better security features (fingerprint reader). Lucky me, I can afford it. My secondary phone is a 2 1/2 year old Nexus 5 which still gets security updates and will for many more years via custom ROMs. Security updates were not the reason I bought a new phone.
Sorry, you don't really seem to be up on current smartphone technology to comment on this intelligently but philosophically I do agree with you.
I picked up one on ebay for $AU80 and the battery is still okay but the non-replaceable feature the only thing keeping me from using it indefinitely. Although the supported OS is Google abandonware, so this vulnerability may finally encourage me to upgrade to a custom ROM.
(And yes I'm currently a thrifty student and happy to accept hand-me-downs rather than spend $500 on new bling)
The Nexus 4 was a solid beautiful phone in it's time. It doesn't even officially support LTE and I can name 6 other specs were it comes up short compared to the Amazon Prime phones.
Google abandonware? Nexus devices get better official and unofficial support than any other Android OEM phones.
For 18 months actually.
Although those security updates have been out for a year now, so technically Google doesn't update their phones for three years yet and we're yet to see this commitment happening. Based on their track record, my confidence level isn't exactly high.
Microsoft distributes security updates regardless of what OEM their software is installed on. With Windows 10, this is true of mobile as well. My two year old Verizon phone runs the latest official version of Windows 10 Mobile, released direct from Microsoft, at the same time as everyone else.
Do you know how open source works? Google has no control over OEM phones or the carrier approval process. Period!
The only reason OEM Windows phones can be upgraded is that OEMs agree to that level of control by Microsoft. Have you ever noticed their are few Windows phone OEMs? LOL Google could try to assert this kind of control on OEMs but Samsung would bail as soon as possible for sure. They would fork AOSP or move to their own OS.
Samsung bails, Google and Android is screwed...
I don't know why you and others want to keep repeating yourself but that is not going to change anything. I have no idea what you said in your second sentence.
Furthermore, Samsung can't leave, Google has a backroom deal with them, it involves patents.
I suppose you can produce this document?
Common sense would dictate if Google could make OEMS provide updates they would already be doing that. Right?
Google gets to approve or veto every Android device every OEM sells. And that's just for starters. If you're an Android OEM that has access to the Play Store, Google has an incredible amount of control over your company.
These are the leaked 2011 MADA agreements, but the new ones are far more strict: https://oasis.sandstorm.io/shared/A9MKYwaMtKZ1p5xC5KQlknXDP4...
Thanks man... I hear they also keep martians at Roswell.
>Google gets to approve or veto every Android device every OEM sells.
100% Wrong... The only thing an OEM really needs to do is include certain Google apps and have them presented in a certain way to use Play services.
"Unless otherwise approved by Google in writing Company will preload all Google Applications approved in the applicable Territory or Territories on each device." under 3.4
AOSP passes the compatibility test and the second quote applies to devices with Google Services
"Company shall not Launch any Device incorporating the Google Applications until it has obtained Google's approval as set forth in (a), (b), and (c) below.", see section 4.3
OEMs can't release an open source only Android distribution. WRONG Google must approve any OEM Android phone. WRONG Samsung can't produce a forked version of AOSP. WRONG
Your only proof about any of this is quoting a clause about Google apps? LOL Yes, OEMs can only use Play services if they include certain Google apps and they need to be presented in a certain way. I already said that many comments ago. The agreement stops say Samsung from using Google Maps but naming the icon Dumbfuck Maps. Google only approves the implementation of their apps NOT the phone.
Dude, go home. You don't know what you are talking about.
You can ship a phone running AOSP without any further agreement with Google.
You cannot ship an "Android" phone. "Android" is a trademark of Google and you can only use it with permission. Moreover, you cannot ship a phone that includes the Play Store or Google apps, nor one compatible with the increasing array of apps that require Play Services, unless you make an agreement with Google.
If you take away the name and ecosystem, you've lost the vast majority of the value of Android. Users will see your phone as if it is running its own, incompatible operating system. Why would they buy this? Why not buy a Windows phone instead?
Case in point: Amazon tried making a phone based on AOSP -- the Fire phone. They made their own apps, their own app store, etc. It was a flop. They gave up. If Amazon can't make it work, why would anyone else expect they can?
So, to realistically sell an Android phone, you have to make an agreement with Google. And that's how they keep control.
Yes. AOSP is available as 'open source'. As a giant code drop, as far as I can tell. And the steering party for Android is .. that Ad company. Even 'Nexus devices' aren't able to boot using AOSP last time I checked (Nexus 7, the ~newer~ version), so that is really bullshit. It looks like "Have fun with our current state, and really - nothing will work on your devices anyway because you need a ton of binary blobs matching our kernel".
Android is about as close to open source in my world as .Net was via 'the reference source' a couple years ago. "Source available" vs. "Open Source".
My point is AOSP being open source means any OEM could base an OS on it and be fully open sourced.
I understand there is barriers to doing that like most mobile hardware is not open but that is NOT Google's fault.
In most countries people use pre-paid devices, which get used until they die.
Ideally Google would just produce a version that was more directly update-able.
I hope this trend also eventually brings us proper no-bullshit free and open-source firmware. As long as there are organizations to request some sanity from vendors.
Automobile manufacturers are required to produce parts for a certain number of years in support of their vehicles...
Even this is problematic, you still generate the a large incentive for the manufacturer to prevent reverse engineering of the device. If no one can find the exploits because the vulnerable firmware is not readable, the drivers are heavily obfuscated, etc, then they don't have to provide any updates and only dedicated actors with access to funds will have any chance at success.
In order to prevent this you may have to make the legislation _more_ onerous and require the manufacturer releases to the owners the ability to sign updates and reverse engineer the device. Something like this needs very careful consideration not to create perverse incentives and to maintain competition and pricing.
Can I release an annual patch for 2 super-huge bugs (let's say kernel-level RCE) found in the 18-to-6 months prior to the patch release, and ignore data leakage bugs in that time frame as well as a kernel-RCE that was found only 3 months before my release and still remain compliant?
If you do modify your device in a way that it can't be guaranteed that the updates will secure the device anymore (which shouldn't be an issue for the vast majority of user modifications), then you simply lose that "warranty" for updates, or the company is no longer responsible to keep you up to date.
But there are ways in which Google and OEMs can guarantee that for instance an OS image that's clean always resides on a locked-down partition, and that users can always "restore" their devices from that, no matter what other ROMs and whatnot they install on their devices and how many times they unlock the bootloader. The only exception to that may be people that tinker with the lock-down restoration partition as well, but for most custom ROM users that shouldn't be an issue.
So this way 99.9% of the users can still be guaranteed updates, if they want them.
I'm not saying that the updates must work on modified devices, I'm more saying that the incentive changes to preventing reverse engineering so that exploits don't happen and updates don't need to happen. Preventing that sort of user level modification, combined with heavy obfuscation and locked down firmwares does prevent reverse engineering by most amateurs and many professionals without a near-unlimited budget. If you can't read the executable for the IPC service, you can't reverse engineer it and you can't find exploits in it.
It's a little more difficult with embedded hardware, yes. But Google could create a standard source-package format and cross-compiling tool-chains to simplify this process. Or they could do something like the VESA standard for x86 to ensure you'd always have a display.
Google -> Manufacture -> Carrier is asinine. The first thing any power user does with a Windows laptop is wipe it, completely, and reinstall from his or her MSDN copy using the serial number from that laptop. Even non-power users still get all the standard Windows updates without any help from Dell, HP, etc (plus the bonus of bloat/spyware updates from said manufactures).
Even if Google didn't want to retroactively do this, they could start with Android O. It's not really in their advantage to, as it works out better for them if people have to buy new shit they don't need every two years to keep getting security updates.
It was significantly less than two years before I was left on a vulnerable version of 5 with no further updates. Well before my two year "phone agreement" or whatever term ('it's not a "contract"') Verizon was then using, was up.
Because of a special deal, I'm on a Nexus 5x right now. (That Verizon does not officially support -- whatever...) But it may well be my last Android phone. I've no confidence left in the Andriod ecosystem.
I cringe more than a bit at Apple's "walled garden". But, at least they keep it up-to-date. And increasingly, I view the cell phone as a quasi-public medium. If I want true privacy for some aspect of communication, I simply have to take it out-of-band.
For the time being, I may also trust the likes of Signal (Whisper Systems). But most other parties I communicate with have no clue and no desire to get one.
Fortunately, three letter agencies and scammers don't seem to be too interested in my semi-disfunctional relationships. And I don't do banking, shopping, etc. on the thing nor use email accounts tied to same.
P.S. Just found this comment:
https://news.ycombinator.com/item?id=12249195
http://www.androidcentral.com/quadrooter-5-things-know-about...
on this thread:
https://news.ycombinator.com/item?id=12248824
The cited article having a bit more perspective -- albeit one essentially wrapped in speculation as opposed to confirmed fact.
And yeah, save your upvotes for the user who actually posted it.
And stop buying subsidized carrier phones in the first place. They need to disappear into the annals of history like landline phones owned by AT&T.
For some of my and my family's use when traveling, Verizon is the only non-local carrier to provide coverage.
Anyway, as I said, I don't trust the Android "ecosystem". Even if and when one can, sometimes with considerable time and effort, find local maxima within it, it overall just sucks in this respect.
By contrast, even on Verizon, Apple has the muscle to tell them to fuck off and to push updates directly. On Verizon, buy an iPhone and you stay as up-to-date as everyone else.
Or, they could be nice, and allow it from the beginning... Like that's ever going to happen.
Just because you think devices should be supported for longer doesn't mean you should try to use the government as a bludgeon to screw over poor people, security-oriented people (who don't want locked-down phones in the long run), and tinkerers/open source advocates.
A vastly better approach would be to require phones to be open source in the same way as gambling machines in the US. The code isn't entirely out in the open if the company doesn't want it to be, but anyone can audit it. In the case of phones, people could also fix bugs if they wanted to.
This way it becomes part of the specs manufactures try to be competitive on and therefore creates an incentive to let that number go up. It would be clear from the start what is the lifespan i could expect of the device and makes me able to better understand price advantages which now are often hidden or not exposed.
Maybe do that, too, in the U.S., and then do something like "We guarantee warranty period +1/+2/+5 years of updates."
Smartphones aren't even the devices with the longest lifecycle. Think about all of the "smart TVs" and "smart fridges" out there that people want to use for 10+ years, but they may never get a single update. Something definitely needs to do be about this regulatory wise, and it needs to happen soon before we're already surrounded by dozens of smart electronics everywhere we go, and not one of them had received a single updated after purchase.
> The research team provided Qualcomm with information about the vulnerabilities in April 2016. The team then followed the industry-standard disclosure policy (CERT/CC policy) of allowing 90 days for patches to be produced before disclosing these vulnerabilities to the public.
> Qualcomm reviewed these vulnerabilities, classified each as high risk, and confirmed that it released patches to original equipment manufacturers (OEMs).
The complexity of this is really a problem for security updates.
It's bad enough for Android updates: the OEM packages it and adds their stuff, then the carrier packages it and adds their stuff. A firmware update like this is yet another layer..
While Checkpoint did the right disclosure thing here, I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today.
There were a handful of "Critical" Qualcomm specific bugs fixed in the July [0] and August [1] Android security updates.
I can tell you that my Nexus 5X, which is on the July patch level, is still vulnerable to 2 of the bugs according the checkpoint security scanner. One is listed as being fixed in the August update, the other isn't.
[0] https://source.android.com/security/bulletin/2016-07-01.html
[1] https://source.android.com/security/bulletin/2016-08-01.html
A someone which has been proved to be unreliable again and again.
I have the source for the firmware to patch that manually, too?
You are still proposing I run proprietary software that can be abandoned at any time, and where I have no way to continue fixing it if it is abandoned.
We’ve seen that with several Nexus devices before, the chipmaker abandoned the SoC, Google couldn’t fix issues because of that, and we didn’t get OTAs from anyone to fix things.
There’s a reason we modularized drivers on other systems, which allows people to customize the OS however they want it, because the firmware, drivers, main OS, UI layer of OS, and applications are all properly seperated.
The issue is the interdependence between those modules, and that they can’t be updated seperately.
Why can’t the OEM customizations be pre-installed apps updated through a third-party app store?
Why can’t the OS be split into parts, with a driver part where the drivers can be updated, and a higher level part being updated by Google or Amazon?
Such a seperation would solve all these issues, without anyone – except Google – losing.
In their blog post they say [1]:
* "Use known, trusted Wi-Fi networks or while traveling use only those that you can verify are provided by a trustworthy source." What's that supposed to mean? Is a Wifi trustworthy if it's named Starbucks, because I just bought a coffee there?
* "End users and enterprises should consider using mobile security solutions designed to detect suspicious behavior on a device, including malware that could be obfuscated within installed apps." I call bullshit.
* And then further on [2]: "ZoneAlarm® Mobile Security for Android™ keeps your mobile devices fully protected from malicious apps and Wi-Fi attacks." Oh really? Can they explain how they overcame the theoretical limits (halting problem) that prevent something like this from being possible?
A lot of it reminds me to the Misfortune Cookie vuln a while ago. Also a good find from Check Point in DSL routers, yet they claimed Zone Alarm can protect you, which was outright nonsense.
[1] http://blog.checkpoint.com/2016/08/07/quadrooter/
[2] https://www.checkpoint.com/resources/quadrooter-vulnerabilit...
YES!
i bought this phone only to "vote with my wallet" that more companies should make android phones with keyboards. It is pure garbage in any other aspect. It is the lame phablet size. The keyboard doesn't even have a DOT or COMMA key, let alone numbers, tab, etc.
The only redeeming features is the OLED screen and keyboard. But then they made the software for the keyboard pure garbage, and filled the OS with bloatware.
I've been waiting for root on this phone so i can start to hack away for months. But blackberry with its cave man corporate mentality, thinks that giving out root will scare the 5 old men still buying their products. I can't even buy a developer version like motorola (which have the same mentality) allowed before.
So, thank you for the sloppy coding, Qualcomm! Thank you for not doing your homework, Blackberry! and thank you AT&T for holding OS updates until you can bother to patch your bloatware!
:(
In the same way I never intend to get "free phone with contract" ever again, I hope to never again buy a device that is subject to vendor "enhancements."
Dedicated Comma, dot, numbers keys? Buy a laptop. Or stay with priv, double-click alt and voila! Use all those buttons you named - write numbers and put comma in between without doing anything else.
I regret accidently upvoting your unsubstantiated rant
But as soon as you close the physical keyboard, and get the blackberry soft keyboard, it is pure garbage! years behind the most basic free keyboard. The top 3 softkeyboards for me (swype, google, hacker) have zero support for anything on the hardware keyboard. I can't navigate the cursor, i can't double click alt, i can't swype up, heck i can't even get a word prediction/correction band to show up!
So it is a futile fight with which keyboard you have selected. Then add two languages and now every time you want to switch the language, you also risk switching the keyboard you have selected. It is brain damaging to try to use it.
now, if i have root and can hook up to keyboard open activities on all keyboards (or if blackberry released the source to their keyboard i wouldn't need to do that) i can check if the physical keyboard is open and change it or something.
Then start a class-action lawsuit, with the stated outcome of forcing carriers to allow, at no cost to all users of no-longer-security-patched phones still being paid off on their plan, a switch to newer phone that are still being patched.
While it'd likely result in a settlement, this may be a way to get the ball rolling, and turning our multi-year outrage into actual (if underwhelming) results.
So If I understand correctly, it does require you to side-load an app. Can I assume Google Play apps are "safe", at least from this type of vulnerabilities?
This said, it is not clear that their analysis would catch apps that try to exploit these vulnerabilities.
I would hazard a guess that right now there a bunch of people at Google making sure that it does.
Looking at the crap that is on the play store, I wouldn't count on it.
Google now has Android Security Annual reports [0]. From that you can see that if you only use the Play Store (no sideloading), only 0.15% of devices got a potentially harmful app.
On top of Play Store's security features, if there were a malicious app that began causing trouble, Google has other mechanisms to shut down PHAs. As this vulnerability shows there are issues that are outside AOSP, Android has been shoring up more defenses in depth.
[0] https://security.googleblog.com/2016/04/android-security-201...
https://www.engadget.com/2016/03/19/ftc-issues-warning-to-ap...
This is one of the key reasons the world didn't end when the stagefright series of bugs was released.
Cool bugs nonetheless..
More likely that they would focus on the largest subset, hence leading to security through variety.
They are exploiting a series of gpu bugs, and a IPC driver:
https://android.googlesource.com/kernel/msm.git/+/e8408e6dca...
https://www.codeaurora.org/invalid-path-check-ashmem-memory-...
https://www.codeaurora.org/use-after-free-due-race-condition...
https://www.codeaurora.org/projects/security-advisories/linu...
Which is now blocked by SELinux. The android security team has started killing off IOCTL calls which aren't necessary for normal apps. They are also nuking access to weird socket types. Including some Wifi related socket closures, which nukes a huge attack surface on the wlan side of things:
http://kernsec.org/files/lss2015/vanderstoep.pdf
https://security.googleblog.com/2016/07/protecting-android-w...
What we need is an open source phone, metal to screen, so to speak. Oh wait, the cell radio firmwares are all proprietary too?
I blame carriers and their bullshit first, google for not allowing more granular ACL's natively, and consumers for accepting android because they were so ready for anything different.
What would be the alternative for those who can't afford premium phones?
Apps that use exploits like this can still gain root with no need for user permission. However, exploits like this can also be used for users to root their phone and install SuperSU or similar, allowing them to take advantage of the root-only apps on phones with locked down bootloaders and similar issues. This may also allow patching of devices which don't get official updates in similar fashion to "fixer" worms.
It's only a matter of time.
That's how it is by default. You have to enable the ability to install third-party applications
Though apps should still be run in a sandbox...
They are.
All these exploits are sandbox breakouts, in this case, by exploiting the IPC system
It can't be rooted because it will be detected at boot
Just thought that pointing out it's Qualcomm-specific issue should make other chipset phone users feel somewhat at ease. (I have an Intel SoC-based one and got nervous upon seeing the title.)
Also, while this may just be my experience with cyanogenmod and the devices that I have managed to root, one can often end up not having access to the necessary blobs to make the phone run as well as it did under the bloated rom. That actually is very similar to Linux and the Win-modems and a ton of Win-printers that followed: sure, you can run a FLOSS setup, you'll just need to be very, very choosy about the hardware that goes into it.