{"id":3858,"date":"2015-01-15T02:21:20","date_gmt":"2015-01-14T18:21:20","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3858"},"modified":"2015-09-09T19:36:41","modified_gmt":"2015-09-09T11:36:41","slug":"google-leaves-android-users-vulnerable-webview-exploit","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/01\/google-leaves-android-users-vulnerable-webview-exploit\/","title":{"rendered":"Google Leaves Android Users Vulnerable To WebView Exploit"},"content":{"rendered":"<p>So it seems the Google corporate motto\/slogan &#8220;Don&#8217;t be evil&#8221; is falling down again, Google is adopting a very Microsoft-esque approach and orphaning users of older version of Android (basically anything before the current production version 4.4 AKA Kit Kat).<\/p>\n<p>Which is the majority of Android users right now, especially those using lower end devices are unlikely to get 4.4 updates and even less likely to get the upcoming Android 5.x version which is coming to most providers early this year.<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/farm8.staticflickr.com\/7568\/15658031344_b54cef4011.jpg\" alt=\"Google Leaves Android Users Vulnerable To WebView Exploit\" \/><\/p>\n<p>WebView vulnerabilities aren&#8217;t unheard of, and they only effect Android 4.3 (Jelly Bean) and below &#8211; because the newer version uses a much newer Chromium version of WebView &#8211; which is not susceptible to the current crop of exploits.<\/p>\n<blockquote><p>Over the past year, independent researcher Rafay Baloch (of &#8220;Rafay&#8217;s Hacking Articles&#8221;) and Rapid7&#8217;s Joe Vennix have been knocking out Android WebView exploits somewhat routinely, based both on published research and original findings. Today, Metasploit ships with 11 such exploits, thanks to Rafay, Joe, and the rest of the open source security community. Generally speaking, these exploits affect &#8220;only&#8221; Android 4.3 and prior &#8212; either native Android 4.3, or apps built with 4.3 WebView compatibility.<\/p>\n<p>WebView is the core component used to render web pages on an Android device. It was replaced in Android KitKat (4.4) with a more recent Chromium-based version of WebView, used by the popular Chrome browser.<\/p>\n<p>Despite this change, though, it\u2019s likely there will be no slow-down of these Android security bugs, and they will probably last a long time due to a new and under-reported policy from Google&#8217;s Android security team: Google will no longer be providing security patches for vulnerabilities reported to affect only versions of Android&#8217;s native WebView prior to 4.4. In other words, Google is now only supporting the current named version of Android (Lollipop, or 5.0) and the prior named version (KitKat, or 4.4). Jelly Bean (versions 4.0 through 4.3) and earlier will no longer see security patches for WebView from Google, according to incident handlers at security@android.com. <\/p>\n<p>Up until recently, when there&#8217;s a newly discovered vulnerability with Android 4.3, the folks at Google were pretty quick with a fix. After all, most people were on the &#8220;Jelly Bean&#8221; version of Android until December of 2013. Jelly Bean&#8217;s final release was just over a year ago in October of 2013. This is why this universal cross-site scripting bug was fixed, as seen in the Android changelog and Rafay&#8217;s blog, Rafay Hacking Articles.<\/p><\/blockquote>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>The sad part is Google seems to acknowledge this situation and isn&#8217;t really willing to do anything about it, basically it seems like Android 4.3 has reached EOL (End of Life) and is being orphaned, Google will not be providing patches any more &#8211; even for critical security issues like this.<\/p>\n<p>Perhaps it&#8217;s a forking issue and the fact the core of WebView is different now, because other components of Android 4.3 will be receiving back-ported patches.<\/p>\n<blockquote><p>However, after receiving a report of a new vulnerability in pre-4.4 WebView, the incident handlers at security@android.com responded with this:<\/p>\n<p><em>If the affected version [of WebView] is before 4.4, we generally do not develop the patches ourselves, but welcome patches with the report for consideration. Other than notifying OEMs, we will not be able to take action on any report that is affecting versions before 4.4 that are not accompanied with a patch.<br \/>\n<\/em><\/p>\n<p>So, Google is no longer going to be providing patches for 4.3. This is some eyebrow-raising news.<\/p>\n<p>I&#8217;ve never seen a vulnerability response program that was gated on the reporter providing his own patch, yet that seems to be Google&#8217;s position. This change in security policy seemed so bizarre, in fact, that I couldn&#8217;t believe that it was actually official Google policy. So, I followed up and asked for confirmation on what was told to the vulnerability reporter. In response, I got a nearly identical statement from security@android.com: <\/p>\n<p><em>If the affected version [of WebView] is before 4.4, we generally do not develop the patches ourselves but do notify partners of the issue[&#8230;] If patches are provided with the report or put into AOSP we are happy to provide them to partners as well.<br \/>\n<\/em><\/p>\n<p>When asked for further clarification, the Android security team did confirm that other pre-KitKat components, such as the multi-media players, will continue to receive back-ported patches.<\/p><\/blockquote>\n<p>Knowing Google, I don&#8217;t foresee them changing their stance on this &#8211; they might because of community\/media pressue &#8211; but honestly I find that unlikely.<\/p>\n<p>Either way, we shall keep an eye out &#8211; because if they don&#8217;t patch these kind of issues we could be looking at some large-scale Android worm\/malware infections popping up on the back of this.<\/p>\n<p>Source: <a href=\"https:\/\/community.rapid7.com\/community\/metasploit\/blog\/2015\/01\/11\/google-no-longer-provides-patches-for-webview-jelly-bean-and-prior\">Rapid7<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>So it seems the Google corporate motto\/slogan &#8220;Don&#8217;t be evil&#8221; is falling down again, Google is adopting a very Microsoft-esque approach and orphaning users of older version of Android (basically anything before the current production version 4.4 AKA Kit Kat). Which is the majority of Android users right now, especially those using lower end devices [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"So Google has decided it no longer wants to support Android Jelly Bean or below and is leaving users vulnerable to a WebView Exploit.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[10],"tags":[5986,5982,6070,6068],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3858"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3858"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3858\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3858"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3858"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3858"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}