The Androids Crooks Are Looking For

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Researchers at the University of Ulm say that anyone running older versions of Android on their phones are vulnerable to attack.

We wanted to know if it is really possible to launch an impersonation attack against Google services and started our own analysis. The short answer is: Yes, it is possible, and it is quite easy to do so. Further, the attack is not limited to Google Calendar and Contacts, but is theoretically feasible with all Google services using the ClientLogin authentication protocol for access to its data APIs.
Click to expand...
 
This really sucks for people who haven't rooted their phone, because the carriers in the US suck about getting updates to the phones. Of course, some phones, such as my OG Droid, won't officially get to 2.3.4, but that is one of the reasons why we root.
 
This is why Android phone manufacturers need to start updating their phones. It's stupid that they're allowed to get away this far.
 
sigvoror said:
This really sucks for people who haven't rooted their phone, because the carriers in the US suck about getting updates to the phones. Of course, some phones, such as my OG Droid, won't officially get to 2.3.4, but that is one of the reasons why we root.
Click to expand...

Unfortunately for Motorola owners, Motorola decided to lock the kernel, which makes it very hard to update the phones OS. The original Droid isn't effected by this, but newer ones are. Being a Motorola Cliq 2 owner, I found this out the hard way. This doesn't mean you can't update the Android OS, you just gotta do it around an older kernel. Which I hear is a big pain in the ass.

There is good news, Motorola is planning on unlocking the kernels on phones, but they have yet to announce what phones will be unlocked. Most likely, older phones.
 
In other news, PSN was hacked because of an old version of Apache and Windows XP is more vulnerable than Windows 7...
 
WhiteZero said:
In other news, PSN was hacked because of an old version of Apache and Windows XP is more vulnerable than Windows 7...
Click to expand...

But those scenarios are fixable by the user.. certain android phones are restricted by the manufacturer to shitty old versions. Apples Oranges Pears Lemons
 
Ashbringer said:
Unfortunately for Motorola owners, Motorola decided to lock the kernel, which makes it very hard to update the phones OS. The original Droid isn't effected by this, but newer ones are. Being a Motorola Cliq 2 owner, I found this out the hard way. This doesn't mean you can't update the Android OS, you just gotta do it around an older kernel. Which I hear is a big pain in the ass.

There is good news, Motorola is planning on unlocking the kernels on phones, but they have yet to announce what phones will be unlocked. Most likely, older phones.
Click to expand...

Not the Kernel, but the Bootloader they lock.
 
hamm3rhead said:
But those scenarios are fixable by the user.. certain android phones are restricted by the manufacturer to shitty old versions. Apples Oranges Pears Lemons
Click to expand...

Well if you don't connect to an open WiFi network it's not an issue to begin with. ;)
 
Vermillion said:
Well if you don't connect to an open WiFi network it's not an issue to begin with. ;)
Click to expand...

Now compare this, an exploit on virtually all Android devices by merely connecting to an open Wifi network (which are being increasingly used) vs the Apple PDF exploit which got updated and fixed for all iOS devices. Or even the many holes in IE over the years.

This is a huge hole and Android's OS fragmentation will make sure there is a proliferation of susceptible devices for a long time. And unlike the other problems listed, it's nearly impossible for the non-tech person to fix via a patch.
 
Ashbringer said:
This is why Android phone manufacturers need to start updating their phones. It's stupid that they're allowed to get away this far.
Click to expand...

Most are.

It's just that Verizon, AT&T and the other criminal communications corporations don't want to do anything about it, they want to sell new phones instead of giving out new updates making phones safer.
 
MrLonghair said:
Most are.

It's just that Verizon, AT&T and the other criminal communications corporations don't want to do anything about it, they want to sell new phones instead of giving out new updates making phones safer.
Click to expand...
^This
 
I think with Ice cream vendors are mandated to provide updates for hardware that can support it for at least 18 months. Google recognizes fragmentation and is working to alleviate that concern.
 
obs said:
Now compare this, an exploit on virtually all Android devices by merely connecting to an open Wifi network (which are being increasingly used) vs the Apple PDF exploit which got updated and fixed for all iOS devices. Or even the many holes in IE over the years.

This is a huge hole and Android's OS fragmentation will make sure there is a proliferation of susceptible devices for a long time. And unlike the other problems listed, it's nearly impossible for the non-tech person to fix via a patch.
Click to expand...

True. I never said it wasn't an issue. There is a third part to this issue though. Why are these apps not using the HTTPS versions of all these sites to begin with?

MrLonghair said:
Most are.

It's just that Verizon, AT&T and the other criminal communications corporations don't want to do anything about it, they want to sell new phones instead of giving out new updates making phones safer.
Click to expand...

Exactly. Second part to that thought pattern though is why are they continually releasing old versions of the OS in the first place? To date no phone has been released with Android 2.3.x on it.
 
Vermillion said:
Exactly. Second part to that thought pattern though is why are they continually releasing old versions of the OS in the first place? To date no phone has been released with Android 2.3.x on it.
Click to expand...

What on earth are you talking about? 2.3 was released with a new phone, the Nexus S. The nexus one has since been updated to 2.3.4 (newest version, same as Nexus S). Furthermore, the new hotness Galaxy S2 launched with 2.3.

So there are at least two phones that shipped with 2.3 and nothing else, and one that has been updated so far.
 
kllrnohj said:
What on earth are you talking about? 2.3 was released with a new phone, the Nexus S. The nexus one has since been updated to 2.3.4 (newest version, same as Nexus S). Furthermore, the new hotness Galaxy S2 launched with 2.3.

So there are at least two phones that shipped with 2.3 and nothing else, and one that has been updated so far.
Click to expand...

Sorry, long day so I didn't proofread. I forgot to say other then Nexus S and S2, but that's still pathetic considering how long 2.3.x source has been out. I don't hold Samsung in high regard so even with 2.3 I don't expect them to update shit. Hopefully, they prove me (and everybody else) wrong.

Moto and HTC have yet to release anything with 2.3.x on it. DX has had leaked GB ROMs for weeks and nothing. Even DX2 is still rumored to possibly launch with 2.2.2 instead of 2.3.x. TBolt had a leaked 2.3.4 RUU yesterday. Unfortunately, the new radio kills 4G speeds. :(
 
You must log in or register to reply here.
Back
Top