One Billion Android Devices Vulnerable to Privilege Escalation

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> </div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCiKD_FEhu-RQVAa_lJ175vL01h9hBVKcmksZDJLCNNost1SUk2Mb4fOMJXs7a5tTxpzmB8x46z9taLlE9PjL1holFpeN3qdVlDF5z2Du49R-I_DiGlo_8J20Wi4vHFhnpZw0lswFNmGVU/s1600/android+vulnerability.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="One Billion Android Devices Vulnerable to Privilege Escalation" border="0" height="235" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCiKD_FEhu-RQVAa_lJ175vL01h9hBVKcmksZDJLCNNost1SUk2Mb4fOMJXs7a5tTxpzmB8x46z9taLlE9PjL1holFpeN3qdVlDF5z2Du49R-I_DiGlo_8J20Wi4vHFhnpZw0lswFNmGVU/s1600/android+vulnerability.png" title="One Billion Android Devices Vulnerable to Privilege Escalation" width="400" /></a></div> <br /> The first deep look into the security of the <a href="http://www.hackerschronicle.com/search/label/Android">Android</a> patch installation process, specifically its Package Management Service (PMS), has revealed a weakness that puts potentially every Android device at risk for <a href="http://www.hackerschronicle.com/search/label/Privilege%20Escalation">privilege escalation attacks</a>.<br /> <br />  Researchers from Indiana University and <a href="http://www.hackerschronicle.com/search/label/Microsoft">Microsoft</a> published a paper that describes a new set of Android vulnerabilities they call Pileup flaws, and also introduces a new scanner called SecUP that detects <a href="http://www.hackerschronicle.com/search/label/Malwares">malicious</a> apps already on a device lying in wait for elevated privileges.<br /> <br />  The vulnerability occurs in the way PMS handles updates to the myriad flavors of Android in circulation today. The researchers say PMS improperly vets apps on lower versions of Android that request OS or app privileges that may not exist on the older Android version, but are granted automatically once the system is updated.<br /> <br />  The researchers said they found a half-dozen different Pileup flaws within Android’s Package Management Service, and confirmed those vulnerabilities are present in all Android <a href="http://www.hackerschronicle.com/search/label/Open%20Source">Open Source</a> Project versions and more than <span class="highlight pop">3,500</span> customized versions of Android developed by handset makers and carriers; more than one billion Android devices are likely impacted, they said.<br /> <br />  An attacker could use a malicious application to <a href="http://www.hackerschronicle.com/search/label/Exploit">exploit</a> this situation to access data on the device such as user credentials, activity logs, SMS data. The researchers also said a successful attack could also give a hacker control of new signature and system permission, leading to a deeper level of trouble.<br /> <br />  The paper, “<a href="http://www.informatics.indiana.edu/xw7/papers/privilegescalationthroughandroidupdating.pdf" target="_blank">Upgrading Your Android, Elevating My Malware: Privilege Escalation Through Mobile OS Updating</a>,” was written by Luyi Xing, Xiaorui Pan, Kan Yuan and XiaoFeng Wang of Indiana University Bloomington and Rui Wang of Microsoft. The frequency of Android updates—estimated to be on average of every 3½ months— and the fragmentation of the Android market make it close to impossible to adequately secure devices, the researchers said. “Every few months, an update is released, which causes replacement and addition of tens of thousands of files on a live system. Each of the new apps being installed needs to be carefully configured to set its attributes within its own sandboxes and its privileges in the system, without accidentally damaging existing apps and the user data they keep,” the researchers wrote. “This complicates the program logic for installing such mobile updates, making it susceptible to security-critical flaws.”<br /> <br />  Pileup flaws, short for privilege escalation through updating, ramp up the permissions given to malicious apps once Android is updated without raising an alarm to the user. “Through the app running on a lower version of Android, the adversary can strategically claim a set of carefully selected privileges or attributes only available on the higher OS version,” the researchers wrote.<br /> <br />  The paper said customized versions of Android, such as those developed by device makers and carriers, are especially vulnerable to Pileup attacks. The researchers said manufacturers are purposely conservative with regard to updates so as not to interfere with the user experience. Users who have apps currently installed, for example, expect them to work seamlessly after OS updates and upgrades; that means data and features must transfer. An attacker can get a seemingly benign app on a device that requests privileges not present on the lower OS version. Generally, the Package Management Service must compare the privileges present between updates and will generally grandfather in existing permission requests so as not to interfere with functionality.<br /> <br />  “A third-party package attribute or property, which bears the name of its system counterpart, can be elevated to a system one during the updating shuffle-up where all apps are installed or reinstalled, and all system configurations are reset,” the paper said. “Also, when two apps from old and new systems are merged as described above, security risks can also be brought in when the one on the original system turns out to be malicious.”<br /> <br />  Upon an <a href="http://www.hackerschronicle.com/search/label/OS">OS</a> upgrade, the PMS will install new and existing system apps, including third-party apps, and will register the permissions they declare. That means for a malicious app, the PMS recognizes all the permissions it requests and those are silently granted because it supposes that permissions with an existing app have already been approved by the user.<br /> <br />  All of the issues have been reported to <a href="http://www.hackerschronicle.com/search/label/Google">Google</a>, the researchers said; Google has already patched one of the six vulnerabilities.<br /> <br />  As for the team’s SecUP scanner, it inspects Android APKs already installed on a device, identifying those that are likely to cause privilege escalations during an update, the paper said. SecUP is made up of a number of components, including a vulnerability detector, exploit opportunity analyzer and a risk database, in addition to the scanner app, the paper said.<br /> <br />  “The detector verifies the source code of PMS (from different Android versions) to identify any violation of a set of security constraints, in which we expect that the attributes, properties (name, permission, UID, etc.) and data of a third-party app will not affect the installation and configurations of system apps during an update,” the researchers wrote. “A Pileup flaw is detected once any of those constraints are breached.”<br /> <br />  The analyzer then kicks in and searches Android factory images for places where privilege escalation could happen; that information is stored in the risk database. The scanner app uses that database to check third-party apps and alerts the user to any potential risks. </div>

Android Mobile Privilege Escalation Vulnerability One Billion Android Devices Vulnerable to Privilege Escalation

The first deep look into the security of the Android patch installation process, specifically its Package Management Service (PMS), h...

Read more »

Beware of fake TOR Browser

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiBt1QSL4HNFa20maeD7wyQDw2r2V4OHLUj5f8HZFqobA9UOzm1cs5sK2XQY5LjYLr0yRTjR3rmAHmXEZgZC4M374lwKSPLPDWMAeYjI3MKtAZdb9EtYBhMOkviwmdrVFwVTWCKM5OFj-k/s1600/fake+tor+browser.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="207" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiBt1QSL4HNFa20maeD7wyQDw2r2V4OHLUj5f8HZFqobA9UOzm1cs5sK2XQY5LjYLr0yRTjR3rmAHmXEZgZC4M374lwKSPLPDWMAeYjI3MKtAZdb9EtYBhMOkviwmdrVFwVTWCKM5OFj-k/s1600/fake+tor+browser.png" width="320" /></a></div> Members of the Tor anonymity service are warning that a <a href="http://www.hackerschronicle.com/search/label/Tor">Tor</a> iOS app available in Apple's highly curated App Store since November is a fake that is laced with adware and spyware.<br /> <br /> "Tor Browser in the <a href="http://www.hackerschronicle.com/search/label/Apple">Apple</a> App Store is fake," a <a href="https://trac.torproject.org/projects/tor/ticket/10549">report ticket published two months ago</a> on the Tor website by high-ranking volunteer Phobos stated. "It's full of adware and spyware. Two users have called to complain. We should have it removed."<br /> <br /> The ticket went on to say that Tor officials notified Apple of the <a href="https://itunes.apple.com/us/app/tor-browser/id712805884?mt=8">fake Tor Browser app</a> in December. In the intervening time, the app has remained available, touching off a series of exchanges among Tor members about how to respond. Ars was unable to confirm the claims of <a href="http://www.hackerschronicle.com/search/label/Malware">adware</a> or spyware. Still, the incident highlights the lack of transparency in the way that Apple vets the reliability of security apps and responds to complaints of rogue titles.<br /> <br /> "Apple responded today with chance for author to defend their app," one volunteer wrote shortly after the ticket was opened. "Sent another email to appstorenotices@," Phobos replied a few weeks later.<br /> Early Wednesday, some two months later, yet another Tor member wrote: "I think naming and shaming is now in order. Apple has been putting users at risk for months now." Another member quickly replied: "I mailed Window Snyder and Jon Callas to see if they can get us past the bureaucracy. Otherwise I guess plan C is to get high-profile people on Twitter to ask Apple why it likes harming people who care about privacy. (I hope plan B works.)"<br /> <br /> (Window Snyder and Jon Callas are both highly respected security researchers who have worked for Apple in the past. Callas has since left the company and is an executive with Silent Circle. <strong>Update:</strong> Snyder still works for the Cupertino company. In the past, she has worked for both <a href="http://www.hackerschronicle.com/search/label/Microsoft" target="_blank">Microsoft</a> and <a href="http://www.hackerschronicle.com/search/label/Mozilla" target="_blank">Mozilla</a>.)<br /> <h3> Secret garden</h3> Apple's App Store has long been referred to by critics and fans alike as a walled garden. The metaphor is used to describe the highly controlled environment of the official iOS app bazaar. Presumably, apps submitted by third-party developers are carefully scrutinized before they become available. That's in sharp contrast to the official Google Play store for Android, which is much less selective and where rogue or malicious apps regularly slip through the vetting process.<br /> <br /> Apple has never described exactly what its process is for ensuring the titles in its App Store are safe. Although the comparatively fewer reports of rogue apps for iOS suggest that the review process is more stringent than Google's, the report ticket from Tor's high-ranking members suggests that Apple may not be doing everything it can or should do to protect iPhone and iPad users.<br /> <br /> Fortunately, the <a href="http://www.hackerschronicle.com/search/label/Tor%20Browser">Tor Browser</a> app at issue has been downloaded a relatively small number of times, and so far there are no reports one way or the other that its behavior represents a serious threat to the people who have installed it. Still, its availability raises questions about exactly what Apple does to ensure the security and authenticity of other apps it hosts on its own servers. This article will be updated if Apple officials, who are routinely silent on such matters, respond to our request for comment.</div>

Fake Tools Tor Tor Browser Beware of fake TOR Browser

Members of the Tor anonymity service are warning that a Tor iOS app available in Apple's highly curated App Store since November is ...

Read more »

Remote Code Execution vulnerability in Yahoo

<div dir="ltr" style="text-align: left;" trbidi="on"> <div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgypjQ4r7519iMUDXnRvxtq7XEu98Xs0kfpGwGcz8Xu-QsyVVSFJeEZJKw_d7Mkpn2K8Fgr_BV2c1QQejY8V9GFjS27VbysAvv7XoT_byjQQL01LKupnpin3qMovIsapjS8HuxWSJqcabQU/s1600/rce+in+yahoo.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="210" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgypjQ4r7519iMUDXnRvxtq7XEu98Xs0kfpGwGcz8Xu-QsyVVSFJeEZJKw_d7Mkpn2K8Fgr_BV2c1QQejY8V9GFjS27VbysAvv7XoT_byjQQL01LKupnpin3qMovIsapjS8HuxWSJqcabQU/s320/rce+in+yahoo.PNG" width="400" /></a></div> <br /> Security researcher Behrouz Sadeghipour has identified a number of <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerabilities</a> on a Hong Kong subdomain of Yahoo (<a href="http://hk.yahoo.net/" target="_blank">hk.yahoo.net</a>). Fortunately, Yahoo has rushed to address the security holes reported by the expert.<br /> According to Sadeghipour, he came across the vulnerabilities while analyzing a <a href="https://www.blogger.com/www.hackerschronicle.com/search/label/XSS" target="_blank">cross-site scripting</a> (XSS) issue. While looking at the HTTP headers, he came across an administrator login page for the hk.yahoo.net domain.<br /> He simply tried to log in with the “<span class="highlight pop">admin</span>” username and “<span class="highlight pop">admin</span>” password and it worked. Once he gained access to the administrator panel, he found a page where he could upload images. <br /> There was an upload restriction, but the expert managed to bypass it by naming his file <span class="highlight pop">shell.php.jpg</span>. Once the file was uploaded, he simply renamed it to <span class="highlight pop">shell.php</span>.<br /> “I had read/write/execute permissions in /home which contains few more subdomains and website. Also, Linux kernel is VERY old and is a rootable. Not to mention I was able to read most DIRs and Files but NOT including /etc/shadow),” the researcher explained in a blog post.<br /> The vulnerability was reported to Yahoo on February 20 and it was patched the next day. However, so far, the company hasn’t rewarded <span class="highlight pop">Sadeghipour</span> for his findings.<br /> For additional details on these Yahoo vulnerabilities, check out the video proof-of-concept and the expert’s blog. </div> <iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/ymG00fiKU6o" width="560"></iframe></div>

Remote Code Execution Vulnerability XSS Yahoo Remote Code Execution vulnerability in Yahoo

Security researcher Behrouz Sadeghipour has identified a number of vulnerabilities on a Hong Kong subdomain of Yahoo ( hk.yahoo.net )....

Read more »

Now Test your eyesight with your smatphone

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBpZPEs_4lySm95h_0ctfxcFyp0sypCOg5m8ZKYau_UDhgAvyXKuVmOZM1h3KXZ4tsOChZRMWRJk2si7O38spTIa08M6OKiWXZJuWSRHq4EpD2-wJrLGFdZ73y0iaZcIrc7s8GkZXS0IeT/s1600/smartphone+eye+testing.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBpZPEs_4lySm95h_0ctfxcFyp0sypCOg5m8ZKYau_UDhgAvyXKuVmOZM1h3KXZ4tsOChZRMWRJk2si7O38spTIa08M6OKiWXZJuWSRHq4EpD2-wJrLGFdZ73y0iaZcIrc7s8GkZXS0IeT/s1600/smartphone+eye+testing.jpg" width="252" /></a></div> Apps and downloads are old hat. The <a href="http://www.hackerschronicle.com/search/label/Mobile">smartphone</a> can now be adapted to test a person's eyes, and is claimed to be India's first mobile phone <a href="http://en.wikipedia.org/wiki/Ophthalmoscopy">ophthalmoscope</a>.<br /> <br /> The phone-cum-scope can capture high-quality photographs of the retina in the eye to detect defects. Converting the smartphone to an ophthalmoscope is quick and easy: fix an LED bulb near the camera of the mobile, a connecting wire and battery. It costs not more than Rs 35-50. The device was invented by ophthalmologists of <a href="http://www.sankaraeye.com/">Sankara Eye Hospital</a>. These pictures can then be sent to doctors for diagnosis.<br /> <br /> "We aren't sure if patients can use it themselves. But it helps eye specialists in rural areas who probably don't have high-end ophthalmoscopes. We are networking with doctors in rural areas who can send us photographs of patients' eyes taken through a mobile phone, that can help evaluate the disorder. We've had cases of eye tumours, glaucoma and other disorders related to the optic nerve, detected through photos taken from mobile phones with a minimum 5-mega pixel camera," said <span class="highlight pop">Dr Divyansh K Mishra</span>, retina fellow, Sankara Eye Hospital, who was one among the doctors who invented the new technique.<br /> <br /> A team of ophthalmologists consisting of <span class="highlight pop">Dr Mishra</span>, <span class="highlight pop">Dr Madhu Kumar</span>, <span class="highlight pop">Dr Rajesh R</span> , <span class="highlight pop">Dr Srinivasulu Reddy</span> and <span class="highlight pop">Dr Gladys Rodregues</span>, led by <span class="highlight pop">Dr Mahesh P Shanmugam</span>, is the think-tank behind this innovation.<br /> <br /> Back in 2002, <span class="highlight pop">Dr Shanmugam</span> had tried taking pictures of eyes through a handycam. "Technology is now advanced and some cell phones have 21 pixels. We won't stop using ophthalmoscopes but this is an added advantage. Eye care field technicians can now immediately diagnose a serious eye condition as they're able to instantly send images of the patient's retina to doctors in the city, via social networking sites," said Dr Mishra.<br /> <h3> MIT's mobile gadget</h3> In 2010, a team of students from <a href="http://web.mit.edu/" target="_blank">Massachusetts Institute of Technology</a> came up with a device to be attached to a mobile phone that can test the visibility of eyes and find out the refractive errors. It was called <a href="http://en.wikipedia.org/wiki/DRDO_Netra" target="_blank">NETRA</a> (Near-Eye Tool for Refractive Assessment). The user has to place the device in front of the eye and look into the lens attached to the phone. While pressing the arrow keys, the user can see green and red lines which overlap. The same process is repeated eight times, with the formation of green and red lines on the screen at different angles. The assessment of the eyes is done based on the visual index and prescriptions are made based on the same. <br /> Source: <a href="http://timesofindia.indiatimes.com/" rel="nofollow" target="_blank">TOI</a></div>

Gadgets Mobile NETRA ophthalmoscope Technology Now Test your eyesight with your smatphone

Apps and downloads are old hat. The smartphone can now be adapted to test a person's eyes, and is claimed to be India's first mo...

Read more »

Toyota, Renault and Chevrolet Hacked by Pakistani Hackers

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLm9kPncC30uf-n5pYPDb6Ub7tND2BmIeLKF9N69iYIY1FpKrSdsx76uKYg-dPLG1lwaf1Nf3XbG4yWyS3FdmMyLnRHS9_CwOy524PJ7hSUi-5uUOj6bC_eZYwJkFu2-NXuug907s7Gxmr/s1600/Toyota+hacked.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="131" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLm9kPncC30uf-n5pYPDb6Ub7tND2BmIeLKF9N69iYIY1FpKrSdsx76uKYg-dPLG1lwaf1Nf3XbG4yWyS3FdmMyLnRHS9_CwOy524PJ7hSUi-5uUOj6bC_eZYwJkFu2-NXuug907s7Gxmr/s1600/Toyota+hacked.PNG" width="320" /></a></div> <em><a href="http://zone-h.com/archive/notifier=Algeriano" target="_blank">Algeriano</a></em> a hacker from Team Cyber Criminals a group of <a href="http://www.hackerschronicle.com/search/label/Pakistani%20Hackers" target="_blank">Pakistani hackers</a> hacked worlds leading automobile companies domains reserved for Guatemala including <a href="http://www.toyota.com.gt/" target="_blank">Toyota</a> , <a href="http://www.renault.com.gt/" target="_blank">Renault</a> and <a href="http://www.chevrolet.com.gt/" target="_blank">Chevrolet</a> , Attacker didn't mention any reason to deface websites. <br /> <br /> “Hacked by Algeriano. TOYOTA & RENAULT & CHEVROLET Guatemala hacked. Cyber Criminals Was Here,” the attacker wrote on the defaced websites.<br /> <br /> This message indicates that the hacker simply wanted to show off. The sites don’t appear to be storing any sensitive customer information. However, such an attack can still impact a company’s image.<br /> <br /> At the time of writing, all of the websites have been restored. They appear to have been restored within 24 hours after the breach took place. <a href="http://zone-h.com/mirror/id/22028173" target="_blank">Mirrors of the defacements</a> are available on Algeriano’s zone-h.org page. <br /> In this case, all of the three websites appear to have been developed by the same company for a car distributor. The most likely scenario is that the sites have been plagued by the same <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerability</a>, which the hacker easily exploited to deface them. <br /> <br /> Hopefully, the company that manages the sites has addressed the security holes, but it’s unlikely. The <a href="http://zone-h.com/archive/domain=www.toyota.com.gt" target="_blank">Toyota Guatemala website was previously defaced</a> back in 2009, 2011 and 2013 by various hackers. </div>

Defacement Hacking News News Pakistani Hackers Toyota, Renault and Chevrolet Hacked by Pakistani Hackers

Algeriano a hacker from Team Cyber Criminals a group of Pakistani hackers hacked worlds leading automobile companies domains reserved f...

Read more »