Active Topics

 


Reply
Thread Tools
Posts: 31 | Thanked: 31 times | Joined on Jan 2013 @ USA
#11
Well, it looks like kernel 3.10 and later are the "easy to exploit" so it sounds like we might be semi-safe on Maemo. Still worrysome.

I have yet to try this on my android phone, then again I don't use my android phone that much.

In any case you don't need permissions to run the dirty cow exploit, it's just regular code (but it looks like you may need multithreading enabled as well as being able to write to your own address space through /proc.)

In android I wish it were possible to fine grain control all the functions that they say on those "XYZ needs access to ABC"...

Just let them install, but the user gets to control whether XYZ actually gets to use feature ABC.

Even better, return garbage information.

Now that's what I wish could be done.
 

The Following 2 Users Say Thank You to eccerr0r For This Useful Post:
Guest | Posts: n/a | Thanked: 0 times | Joined on
#12
Malware and exploits on Darwin/OS X, Windows... well, being Windows and now this.

Not a one system is without exploits.
 

The Following 4 Users Say Thank You to For This Useful Post:
Posts: 1,288 | Thanked: 4,316 times | Joined on Oct 2014
#13
In case you want to experiment, this PoC can help identify if vulnerable.

https://github.com/dirtycow/dirtycow...ter/dirtyc0w.c
 

The Following 3 Users Say Thank You to nieldk For This Useful Post:
ibrakalifa's Avatar
Posts: 1,583 | Thanked: 1,203 times | Joined on Dec 2011 @ Everywhere
#14
9 years? seriously, and some of members talk about security like God himself recently...
__________________
~$
~#
 

The Following 3 Users Say Thank You to ibrakalifa For This Useful Post:
kinggo's Avatar
Posts: 943 | Thanked: 3,228 times | Joined on Jun 2010 @ Zagreb
#15
hmmmmmm......... so that's why turing phone isn't out yet
 

The Following 2 Users Say Thank You to kinggo For This Useful Post:
ste-phan's Avatar
Posts: 1,195 | Thanked: 2,708 times | Joined on Jan 2010 @ Hanoi
#16
Originally Posted by eccerr0r View Post
Well, it looks like kernel 3.10 and later are the "easy to exploit" so it sounds like we might be semi-safe on Maemo. Still worrysome.

I have yet to try this on my android phone, then again I don't use my android phone that much.

In any case you don't need permissions to run the dirty cow exploit, it's just regular code (but it looks like you may need multithreading enabled as well as being able to write to your own address space through /proc.)

In android I wish it were possible to fine grain control all the functions that they say on those "XYZ needs access to ABC"...

Just let them install, but the user gets to control whether XYZ actually gets to use feature ABC.

Even better, return garbage information.

Now that's what I wish could be done.
About your wish, I once "secured" a Note 2 where I have installed XPrivacy.
It does exactly what you say: let stuff install, pop up with questions after install allowing you to decide for yourself
A.nd to leave things working as they should, it reportedly feed garbage dummy information to the agressor app.

So I get Viber running without address book access.

If I remember correctly, the thing had to be rooted and something called Exposed framework had to be installed. It is not my favorite activity and I hope one day this becomes much easier and straight forward to install.
But once you get Xprivacy running, you feel a big relief, I can tell you that
 

The Following User Says Thank You to ste-phan For This Useful Post:
Community Council | Posts: 4,920 | Thanked: 12,867 times | Joined on May 2012 @ Southerrn Finland
#17
Originally Posted by nieldk View Post
In case you want to experiment, this PoC can help identify if vulnerable.

https://github.com/dirtycow/dirtycow...ter/dirtyc0w.c
Thanks.

I just quickly tested it on my main workstation running 4.4.0-36, Jolla sbj1 running 3.4.0 and a fedora cloud image running 4.6.4-301 kernels using the above demo exploit.

On all of those devices the result was as expected, the user process was able to gain root using the leaking CoW.

Same thing applies as always; do not run unknown binaries in your system. Fortunately this is an exploit not easily used remotely.
 

The Following 6 Users Say Thank You to juiceme For This Useful Post:
coderus's Avatar
Posts: 6,436 | Thanked: 12,699 times | Joined on Nov 2011 @ Ängelholm, Sweden
#18
 

The Following 3 Users Say Thank You to coderus For This Useful Post:
bandora's Avatar
Posts: 1,338 | Thanked: 1,055 times | Joined on Oct 2009 @ California, USA / Jordan
#19
On the other hand maybe it also makes it easier for a person to "root" their Android phones without actually going through the process..
__________________
FarahFa.com
 

The Following 3 Users Say Thank You to bandora For This Useful Post:
Reply

Thread Tools

 
Forum Jump


All times are GMT. The time now is 04:33.