Data Security

Android phones rooted by “most serious” Linux escalation bug ever

By root

Posted on October 25, 2016

New rooting technique is believed to work against every version. There’s a new method for rooting Android devices that’s believed to work reliably on every version of the mobile operating system and a wide array of hardware. Individuals can use it to bypass limitations imposed by manufacturers or carriers, but it could also be snuck into apps for malicious purposes.

The technique comes courtesy of a Linux privilege-escalation bug that, as came to light last week,attackers are actively exploiting to hack Web servers and other machines. Dirty Cow, as some people are calling the vulnerability, was introduced into the core Linux kernel in 2007. It’s extremely easy to exploit, making it one of the worst privilege-elevation flaws ever to hit the open-source OS.Independent security researcher David Manouchehri told Ars that this proof-of-concept code that exploits Dirty Cow on Android gets devices close to root. With a few additional lines, Manouchehri’s code provides persistent root access on all five of the Android devices he has tested.

“It’s very easy for someone who’s somewhat familiar with the Android filesystem,” Manouchehri said of the exploit. “From what I can tell, in theory it should be able to root every device since Android 1.0. Android 1.0 started on [Linux] kernel [version] 2.6.25, and this exploit has been around since [Linux kernel version] 2.6.22.”

A separate security researcher who asked to not be identified said he and several other people developed a separate rooting exploit. It’s based on this publicly available Dirty Cow exploit that they modified to make work on Android and to give it additional capabilities.

“We are using a rather unique route on it that we can use elsewhere in the future as well,” the researcher said when asked why he didn’t want to disclose the code or want his name published. “I don’t want Google or anyone shutting down that route.”

The video below shows the researcher using his app to root an Android-powered HTC phone, which is connected to a computer by a USB cable. The first ID and su commands show that the device is unrooted. After running “moo”—the name of the file containing the exploit code—and then running the su and ID commands again, it’s clear that the device has been rooted.

Double-edge blade

Both of the exploits allow end users to root Android phones so they have capabilities such as tethering that are often restricted by individual manufacturers or carriers. By gaining access to the core parts of the Android OS, owners can bypass such limitations and vastly expand the things their devices can do. The darker side of rooting is that it’s sometimes done surreptitiously so that malicious apps can spy on users by circumventing application sandboxing and other security measures built into Android.

Just as Dirty Cow has allowed untrusted users or attackers with only limited access to a Linux server to dramatically elevate their control, the flaw can allow shady app developers to evade Android defenses that cordon off apps from other apps and from core OS functions. The reliability of Dirty Cow exploits and the ubiquity of the underlying flaw makes it an ideal malicious root trigger, especially against newer devices running the most recent versions of Android.

“I would be surprised if someone hasn’t already done that this past weekend,” Manouchehri said.

Related Items:Android phones root, Dirty Cow, most serious

MrHacker

Android phones rooted by “most serious” Linux escalation bug ever

Latest News

Microsoft Outlook Flaw Exploited by Russia’s APT28 to Hack Czech, German Entities

Popular Android Apps Like Xiaomi, WPS Office Vulnerable to File Overwrite Flaw

Dropbox Discloses Breach of Digital Signature Service Affecting All Users

CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

New Cuttlefish Malware Hijacks Router Connections, Sniffs for Cloud Credentials

Links

Pin It on Pinterest