Researcher warns of critical Google bug in G1 phone
Noted iPhone flaw finder fingers Android OS for vulnerability
Computerworld - A noted security researcher today warned users of T-Mobile's G1 smart phone that a critical vulnerability in Google's Inc.'s Android operating system could be used to hack their phones.
Led by Charlie Miller, a researcher who has rooted out high-profile bugs in Apple Inc.'s Mac OS X and iPhone, a team from Independent Security Evaluators identified the bug and reported it to Google last week. ISE, where Miller works, is a Baltimore-based security consultancy.
Miller, who declined to get specific about the vulnerability, said only that it is a buffer overflow bug that could be exploited by tricking G1 users into visiting malicious sites. "There's a chance that the attacker could execute malicious code remotely" by accessing the same privileges as the user of the phone's browser, Miller said.
T-Mobile started shipping the G1 shortly before the Oct. 22 launch date; the phone is the first powered by Google's open-source mobile phone operating system, Android.
Miller said that after alerting Google, a security researcher from its Android team contacted him to get more information and to ask that he withhold the information from the public until a patch was in place. Miller refused to wait but promised not to disclose any details or technical information that could be used by hackers.
"People should know that there's a problem with the G1 before they buy it," Miller said, defending his actions. "I don't want to help the bad guys either, but people should have all the information before they make a decision to buy [the phone]. I think I'm totally in the right here."
Google did not respond to a request for comment or to questions about the status of any patch for Android and the G1.
Miller also said that he and others at ISE had crafted a working exploit but would not release it until a patch was in hand.
According to a more detailed warning on the ISE site, the flaw is within one of the more than 80 open-source packages used by Google to assemble Android. Miller blamed the bug on Google's use of outdated code. "This particular security vulnerability that affects the G1 phone was known and fixed in the relevant software package, but Google used an older, still vulnerable version," said the ISE alert.
Miller declined to name the specific open-source package at fault.
Google has been caught in the same bind before. Because it used an older version of WebKit, the open-source rendering engine that also powers Apple Inc.'s Safari, for the foundation of its own Chrome Web browser, users were at risk from attacks based on a months-old flaw that had been dubbed the "carpet bomb" bug.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts