October just released the latest version of Android 5.0, a few days ago to repair a high-risk vulnerabilities, malicious applications can take advantage of the vulnerability, forgery any content, SMS from any source, which leads to death when the phone restarts, users can even delete all information. This vulnerability is the official definition of Android ID for Bug 17356824, and users are called broad Anywhere.
The news from friends REME found, the users find that the same person before LaunchAnywhere vulnerability. He studied Lollipop source code found on google 5.0 fixes a high-risk Lollipop vulnerabilities, and exploit this vulnerability can send any broadcast: not only the level of protection of broadcasting transmission system, you can also send scam disguised newsletter, simply broadcast version vulnerabilities before LaunchAnywhere Therefore, temporarily called broadAnywhere.
The reason for this vulnerability results because Settings system application will pass their PendingIntent untrusted third equation, the equation can be modified PendingIntent third parameter, and then returned to the system to perform. Exploit this vulnerability, the third equation can send any broadcast, you can also call the internal functions of other applications, resulting in a comprehensive threat to the system and user applications.
Although the Android 5.0 version has been patched this vulnerability, but the phone still will affect all versions of Android 5.0 outside. On the technical principles vulnerabilities are interested can go to his website related analytical point of view, where a brief description of this vulnerability will cause harm:
The push system vulnerabilities can cause denial of service phone system, the equivalent of full-time push the message out that others can not enter, mobile phone users can not normally access memory, or no Internet access, and ultimately cause the phone to crash, can not be used.
Newsletters attacker exploit the vulnerability of this system will push fake arbitrary content in the phone, most likely take advantage of this loophole spread a lot of scams newsletter.
Exploit the vulnerability, a malicious program can be transferred com.google.android.c2dm.intent.RECEIVE push, Android system will be restored to the factory settings, including important information phone photos, videos, contacts, newsletters, etc. may be completely removed .
Google has for this vulnerability is described , but the average user can only wait for Google to launch a security update, and do not download from the store to install any third equation of unknown origin App.
Source: Retme.net
The reason for this vulnerability results because Settings system application will pass their PendingIntent untrusted third equation, the equation can be modified PendingIntent third parameter, and then returned to the system to perform. Exploit this vulnerability, the third equation can send any broadcast, you can also call the internal functions of other applications, resulting in a comprehensive threat to the system and user applications.
Although the Android 5.0 version has been patched this vulnerability, but the phone still will affect all versions of Android 5.0 outside. On the technical principles vulnerabilities are interested can go to his website related analytical point of view, where a brief description of this vulnerability will cause harm:
1. DoS attacks end of the phone (make phone crashes)
The push system vulnerabilities can cause denial of service phone system, the equivalent of full-time push the message out that others can not enter, mobile phone users can not normally access memory, or no Internet access, and ultimately cause the phone to crash, can not be used.
2. Forge any source and content of the newsletter
Newsletters attacker exploit the vulnerability of this system will push fake arbitrary content in the phone, most likely take advantage of this loophole spread a lot of scams newsletter.
3. Clear mobile data
Exploit the vulnerability, a malicious program can be transferred com.google.android.c2dm.intent.RECEIVE push, Android system will be restored to the factory settings, including important information phone photos, videos, contacts, newsletters, etc. may be completely removed .
Google has for this vulnerability is described , but the average user can only wait for Google to launch a security update, and do not download from the store to install any third equation of unknown origin App.
Source: Retme.net
Comments
Post a Comment
Please leave your comments and suggestions here.