{"id":2990,"date":"2010-11-08T07:07:13","date_gmt":"2010-11-08T07:07:13","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=2990"},"modified":"2015-09-09T19:37:23","modified_gmt":"2015-09-09T11:37:23","slug":"researcher-releases-android-exploit-in-webkit-browser-engine","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2010\/11\/researcher-releases-android-exploit-in-webkit-browser-engine\/","title":{"rendered":"Researcher Releases Android Exploit In Webkit Browser Engine"},"content":{"rendered":"

And Android<\/a> security hits the news once again, it’s not a vulnerability in the OS per-say but rather in the browser based on the Webkit engine. It does highlight the inherent fragmentation problems with the Android platform and the security concerns that come with running old OS and software versions.<\/p>\n

It’s a problem that is plaguing Android right now with different phones running different core OS versions (from 1.5 to 2.2) – on top of that 3rd party skins for the OS from Samsung, Motorola and more. This makes updating the OS slow and many users are stuck with old versions and no news regarding updates.<\/p>\n

A security researcher has released proof-of-concept code that exploits a vulnerability in most versions of Google’s Android operating system for smartphones.<\/p>\n

M.J. Keith of Alert Logic said he released the attack code to expose what he characterized as inadequate patching practices for the open-source mobile platform. Rather than find the underlying bug himself, he searched through a list of documented security flaws for Apple’s Safari, which relies on the same Webkit browser engine used in Android. In short order, he had an attack that exploits about two-thirds of the handsets that rely on the OS.<\/p>\n

\u201cThey need a better patching system,\u201d Keith told The Register. \u201cThey do a good job of repairing future releases, but I think a better patching system needs to be set up for Android.\u201d<\/p>\n

The bug Keith’s code exploits was fixed in Android 2.2, but according to figures supplied by Google, only 36 percent of users have the most recent version. That means the remainder are susceptible to the attack.<\/p><\/blockquote>\n

Google has claimed that they are changing the architecture with the upcoming release of Gingerbread, many of the system apps will be pushed to the Marketplace – meaning they can push out updates much faster and easier than if everything is integrated in the OS image.<\/p>\n

Of course core problems with the kernel or underlying OS will still have to be addressed via firmware updates, but still like this – which effects the browser – could be negated if a new browser version could be pushed out from the Android Marketplace.<\/p>\n

The same goes for the recent Critical Zero Day Abobe Flash Flaw Which Put Android Phones At Risk<\/a>.<\/p>\n