A security researcher has released proof-of-concept code that exploits a vulnerability in most versions of Google's Android operating system for smartphones.
M.J. Keith of Alert Logic said he released the attack code<http://www.exploit-db.com/exploits/15423/>to expose what he characterized as inadequate patching practices for the open-source mobile platform. Rather than find the underlying bug himself, he searched through a list of documented security flaws for Apple's Safari, which relies on the same Webkit browser engine <http://webkit.org/> used in Android. In short order, he had an attack that exploits about two-thirds of the handsets that rely on the OS. “They need a better patching system,” Keith told *The Register*. “They do a good job of repairing future releases, but I think a better patching system needs to be set up for Android.” The bug Keith's code exploits was fixed in Android 2.2, but according to figures supplied by Google<http://developer.android.com/resources/dashboard/platform-versions.html>, only 36 percent of users have the most recent version. That means the remainder are susceptible to the attack. What's more, Keith said he had no trouble finding other documented Webkit vulnerabilities that have yet to be fixed in version 2.2. “I found about four or five and I wasn't trying to [do] an exhaustive search,” he said. A Google spokesman declined to comment for this post. To be fair, Android's design does a good job of segregating the functions of one application from those of another. That would make it hard for someone exploiting the bug Keith demonstrated to gain root privileges or access to many of the targeted handset's resources. But it still would allow an attacker to access anything the browser can read, including a phone's Secure Digital memory card. The bigger point, Keith said, is that most users have no idea their devices are vulnerable to bugs that were patched long ago on other platforms. “I wanted to demonstrate that nobody's being notified that their Android phone is vulnerable to this stuff,” he explained. Google “wants to pretend it's not there.” ® -- You received this message because you are subscribed to the Google Groups "nforceit" group. To post to this group, send an email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/nforceit?hl=en-GB.
