ShmooCon 2011: Your Android’s dirty little secret

WASHINGTON, D.C. — Presenters at the ShmooCon security conference have spent much attention on mobile vulnerabilities in the last couple years, and several attendees this year say it’s a topic of major importance to them.

Last year, a talk focused on weaknesses in the iPhone. This year, two researchers have targeted all their firepower on the Android.

In this morning’s presentation, Jon Oberheide, CTO of DUO Security, and Zach Lanier, a senior consultant with the Intrepidus Group who specializes in network and web application penetration testing, walked attendees at ShmooCon 2011 through a series of weaknesses they discovered in the device at the kernel, platform and application levels.

Among their findings:

• By building “fun-looking” games and applications and getting users to download them onto their phones, an attacker could hit the kernel with a malicious payload once the appropriate flaws are identified.
• The platform is full of complicated “goo” that can be taken advantage of.
• Application source code is easy to obtain and exploit.

Android gives third-party applications permissions that are easy to hijack, they said. Writing a proof-of-concept disguised as the increasingly popular Angry Birds game, they were able to bypass the permission approval process and steal the authentication token from the Android AccountManager.

The talk was a sequel of sorts to one Lanier and fellow Intrepidus researcher Mike Zusman gave at the SecTor conference in Toronto last fall.

During that talk they explained the following weaknesses in the Android as well as other smart phones like the BlackBerry:

• Intercepting one’s credentials on an app like Foursquare is pretty easy.
• Storage apps — popular among those who like to store and easily retrieve music and video on their phones — contain security holes an attacker could exploit to cause a denial of service or bypass digital rights management controls.
• Carrier-based apps tend to trust you just because you happen to be on the carrier network.
• Third-party apps are sometimes better than carrier-based apps in this regard, but there’s still incomplete support for open standards.
• Man-in-the-middle attacks are fairly trivial across the board.

They also noted the presence of old-school vulnerabilities left behind by developers in the rush to bring new apps to market. In fact, developers are making the same mistakes they made in the PC world a decade ago.

“We’re forgetting the lessons we already learned,” Lanier said.