Hacker News Reader

Comment by Macha | Hacker News Reader

It's good to get some more info, but it is a little disconcerting that they only mention patching Chrome. What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability.

Also in this case the attack vector was MITM of http and one time links as it was a targeted campaign, but it feels there's nothing preventing someone putting this in an ad campaign or sms/discord/matrix/whatever spam and spraying it everywhere to build a botnet or steal user credentials or whatever.

View on HN

> What was the sandbox escape on Android? Even if you had code execution inside the Chrome process on Android, that shouldn't be enough to enable persistence, so clearly there's another vulnerability.

This is such a crucial point. Forced to read between the lines of the blog post (because the above information is missing), it sounds like there are currently unpatched issues in Android revolving around this?

Likely yes, they were unable to capture the following stages so they don’t know what was exploited after gaining initial execution within the chrome sandbox.

Likely there’s a chrome sandbox escape and a kernel exploit remaining “unknown and unpatched”.

> Likely there’s a chrome sandbox escape and a kernel exploit remaining “unknown and unpatched”.

There is certainly many of those that we don't know about, if this was done in Egypt, imagine what a 3 letters agency have

Wouldn't be a stretch to assume this is forced by 3 letter agencies and it's details leaked for sale on an exclusive dark web.

Think of all the insidious corruption we find out about via declassification 50 years later. It's not like human nature has changed.

Every government with money has exploits for every device imaginable.

The going price was $1m for a full exploit chain on iPhone a while ago, and I’m sure it’s gone up, but I’m also sure it is minuscule compared to the amount of money governments have.

Everyone should assume this is fact, and not imagine some secret spy world. If you ever become interesting enough to hack, you will be, and there is little recourse (currently)

Kinda surprising that Apple wouldn't be the highest bidder for a full exploit chain. They've been known to give out $100,000 bug bounties, but you'd think one million would be a pretty good deal for closing a vulnerability vs having it sold to companies that professionally surveil people.

One million dollars is what some states pay _per target_.

Every major black hat group operates with the blessing of some state. It’s about more than just money. Actual exploits are probably traded for “favours” (e.g. votes in international bodies, collaboration on thorny dossiers, extraditions, etc.). The infiltration of electronic communication is a major aspect in determining a state’s level of “soft power” and - in a software-run world - its weight only increases.

>Every major black hat group operates with the blessing of some state.

Citation needed. As far as I know that's true. Yes, some groups cooperate with the state (true in Russia after the escalation of the war in Ukraine, for example). But that's certainly not true for everyone - not every group has uses as an APT unit, most are just common criminals.

I'd go a step further and state: everybody is interesting enough to fully automatically hack.

I have 0 doubt that literally everybody is being scraped by 1 or more governments and/or companies.

Because if they can, why not?

Because every time you do it, you run the risk of discovery. This can be expensive (you burn your exploit) and politically embarrassing.

The answer to “why not” is this blog post. Lots of people are likely very unhappy that their expensive exploit has been patched. This is what The Citizen Lab does!

Poignant, not really. Prescient, maybe.

Is it possible that it was detected but without a sandbox escape? would it still be described as "an exploit" if so?

Yes.

Read it again, no sandbox attack on Android MITM and one time link attack only .

That’s all they were able to gather.

I mean there are always unpatched issues in everything... There's nothing you can do, whether you know about it or not. You have to just assume you're always actively being exploited at some level

Can be multiple vendor specific exploits.

They state that they were unable to capture the follow-on stages of the Android chain, they only got the initial execution component.

Which means there’s missing a sandbox escape and privilege elevation bug.

Also yes while delivery here was apparently ISP level MiTM using lawful intercept capabilities, there’s no reason the exploit couldn’t be delivered as a 1click via a phishing link.

There are millions of android devices out there that have been abandoned by their manufacturers, so they might be omitting those details because the flaw hasn't yet been patched (and likely never will be.)

Even with Google's own flagship device, the latest security patches date from August while this announcement is much newer, so it seems unlikely _any_ Android devices have been patched.

Updates occur all the time, what do mean there's none since August?

Apps get updated but what I'm worried about is that the android image view uses libwebp which means all the apps that just ask the OS to display untrusted images are vulnerable to an update.

I'm not sure the image view has been seperated out into any of the play store updated components. None of the ones name and description suggest they'll have OS UI widgets like that.

I got a September security update for my Pixel 5, I think 2 days ago.

Huh, Pixel 7 Pro here and the last update, even after a manual check, is 5 August

I belive you are mistaken.

Firat of all, some part of Android is updated via the store. So the Chrome vulnerability and system libraries were probably updated without you noticing.

Also, this started in May. Before it went public both Apple and Google had already patched some vulnerabilities. Latest round was in August/September.

LineageOS on OnePlus Nord, last security update: September 5

Ride public transport in Eastern Europe and you'll see Androids running versions as old as 4; such devices are cheap, and ubiquitous phone repair shops will fix or replace components, such as batteries, speakers, and more. If the situation in Egypt is similar among less-affluent users, then there are many Android phones just waiting to be exploited.

The article is mainly about the iphone exploit chain: Safari exploit -> PAC bypass -> kernel exploit.

Android version was pretty similar but I think needed two more exploits to bypass Linux kernel mitigations.

PZ has a good technical writeup.

Who is PZ?

Google's Project Zero.

The only Project Zero write up recently about android sandbox escapes appears to be on a different, ALSA based and Samsung specific vulnerability.

Im not well versed in mobile environments. Presumedly breaking out of the Chrome sandbox would land you within the underlying OS. Can you not build persistence there without abusing further vulns?

There's nested sandboxes for browsers in mobile environments. There's the inner layer which the web content is running in, but then the browser itself is sandboxed so it can't do things like access OS APIs it doesn't have permission for, install apps that run in the background, etc. This is why the iOS example needed 3 exploits chained. The fact that a similar example worked on Android, which also has app sandboxing, implies there should be an exploit chain but we've only been told of the first.

Gotcha, thank you.

There's also SELinux on Android.

that sounds like terrible joke

sandbox in sandbox in sandbox in sandbox in sandbox in sandbox in sandbox

and stuff still manages to escape

That’s the thing about sand. It’s course and rough and irritating and it gets everywhere.

But there is always time for a glass of good wine!

The Buffalo buffalo buffalo... thing

https://en.m.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buff...

Defence in depth. Now you need a working chain of 3 exploits instead of one. It's about raising the bar, perfect security is impossible.

But browsers, especially Chrome, have lots of permissions (including geolocation, accessing SD card, accessing user's personal data, camera and microphone etc.). You don't need to do anything if you can run under browser's privileges.

None of the mentioned privileges should net you a persistence though, so there's clearly still another vulnerability.

Above says access to SD card. I think that means write ability. Which means persistence.

Persistence means you can write to something that'll cause your malware to run again after reboot, but external storage isn't enough to do that without another exploit in the boot path, right?

Android has clamped down hard on access to the SD card. Chrome certainly doesn't have the special All Files Access, and on my device it doesn't even have Photos or Music, since I never use those permissions with Chrome, and Android regularly turns off permissions that haven't been used recently

But smartphones are rarely rebooted so maybe you don't need persistence that much?

You still want priv escalation if you're trying to spy on someone. The content process can't see anything you're doing in other apps, and the browser can only access a very restricted view of the storage

Living in memory or living off the land is generally a good idea, but you still want a chain of exploits anyways

On Android, you usually need three exploits.

1. Chrome code execution (gain foothold inside Chrome process).

2. Sandbox escape (gain code execution outside the Chrome sandbox, with the privileges of the Chrome process, which aren’t very useful except to stage another exploit).

3. Local privilege escalation, usually a kernel bug or similar, to elevate to root where you can break the process “sandbox” and establish persistence.

Reply on news.ycombinator.com