News for hackers. Stuff that matters.
Re:Show HN: Android 'root' phones via dirtyc0w exploit by Arinerron on Wednesday October 26, 2016 @11:53PM (#12802788)
I put 'root' in quotes, because technically, it isn't rooting. However, it creates a binary called 'run-as' that can execute packages as root. Not sure what the right term would be in this case.
Re:Show HN: Android 'root' phones via dirtyc0w exploit by voltagex_ on Thursday October 27, 2016 @01:16AM (#12803074)
A (somewhat cringeworthy) thread on how to gain persistence via this exploit is at https://github.com/timwr/CVE-2016-5195/issues/9

I think this would be a "temporary root", rather than something like CF-AutoRoot that gains persistence by modifying the system itself.

Re:Show HN: Android 'root' phones via dirtyc0w exploit by cyphar on Thursday October 27, 2016 @02:02AM (#12803200)
It's painful to read. Only one person in that thread appears to know what SELinux actually does, and nobody has mentioned the fact that SELinux was explicitly designed to make a root privesc contained.

The ironic part is that since DirtyCOW is a kernel bug they could probably modify the exploit to disable SELinux from inside the kernel (or load a module that disables SELinux). But they're just trying to use the PoC as the only thing you can get from the exploit.

Re:Show HN: Android 'root' phones via dirtyc0w exploit by digi_owl on Thursday October 27, 2016 @09:31AM (#12804949)
Welcome to the world of phone firmware modding.

I suspect you got much the same back in the microcomputer era. Just look at the various phreaker stuff salvaged from BBSs.

Re:Show HN: Android 'root' phones via dirtyc0w exploit by daveloyall on Thursday October 27, 2016 @02:49PM (#12808223)
Well at least these github repos and gists are an improvement beyond "here, download this .apk from megaupload and install it!"
Re:Show HN: Android 'root' phones via dirtyc0w exploit by jmickey on Thursday October 27, 2016 @12:23AM (#12802893)
Well if you can run any executable as root, that sure counts as rooting in my book.
Re:Show HN: Android 'root' phones via dirtyc0w exploit by sdrothrock on Thursday October 27, 2016 @12:28AM (#12802916)
The advantage I see here is that you don't have to actually root your phone, which means that apps/games that check for root access would continue to work normally.
Re:Show HN: Android 'root' phones via dirtyc0w exploit by daveloyall on Thursday October 27, 2016 @02:37PM (#12808026)
I've always wondered: what exactly are they checking for?

What's the difference between "I can become the root user on my phone whenever I want" and "My phone is rooted"?

Note: I'm asking as a GNU/Linux user, not as a phone user.

Re:Show HN: Android 'root' phones via dirtyc0w exploit by sdrothrock on Thursday October 27, 2016 @10:27PM (#12812546)
Re:Show HN: Android 'root' phones via dirtyc0w exploit by daveloyall on Friday October 28, 2016 @11:32AM (#12817016)
2015-08-20. The document describes analysis performed on those apps which root your phone for you.

Thanks!

Re:Show HN: Android 'root' phones via dirtyc0w exploit by sdrothrock on Saturday October 29, 2016 @02:04AM (#12822824)
No problem! I don't do Android development of any kind and didn't trust my ability to properly explain it, but it's an interesting paper. :)
Re:Show HN: Android 'root' phones via dirtyc0w exploit by scrollaway on Thursday October 27, 2016 @01:14AM (#12803067)
Sure, but as soon as it's patched out, you're back to no root.
Re:Show HN: Android 'root' phones via dirtyc0w exploit by omribahumi on Thursday October 27, 2016 @01:56AM (#12803186)
Maybe I'm missing something here, but what stops you from putting a setuid "su" binary and keeping the root access, even if the kernel is upgraded?
Re:Show HN: Android 'root' phones via dirtyc0w exploit by therein on Thursday October 27, 2016 @03:12AM (#12803395)
You're root running in a limited selinux context.
Re:Show HN: Android 'root' phones via dirtyc0w exploit by omribahumi on Thursday October 27, 2016 @07:11AM (#12804151)
I'm assuming that's because of the Android security model, rather than a limitation of the exploit itself?

edit: Apparently SETUID is disabled on Android:

  ... using kernel features that help block privilege escalation (e.g. NOSUID, NO_NEW_PRIVS).
source: https://lwn.net/Articles/609511/

also: https://unix.stackexchange.com/a/250806/95938

Re:Show HN: Android 'root' phones via dirtyc0w exploit by daveloyall on Thursday October 27, 2016 @02:55PM (#12808351)
Are you saying that on Android, you can achieve UID=0 via this exploit, but still not write to anywhere important on the device?

What are these different "methods" listed in the table here?

https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

Can one of those methods allow me to write to some file in /etc? (Which is enough to grant me the access I want, unless selinux is just MAGIC.)

Re:Show HN: Android 'root' phones via dirtyc0w exploit by therein on Saturday October 29, 2016 @06:23PM (#12826782)
SELinux can still prevent you (even if you are `$UID=0`) from performing an operation such as writing to a file under `/etc`.

You would need to be able to `setenforce 0 `. A properly configured SELinux context can prevent you from doing that however we are starting to finally see some reports of dirtyc0w successfuly leading to `SELinux status: permissive` and permanent root.

Re:Show HN: Android 'root' phones via dirtyc0w exploit by executesorder66 on Thursday October 27, 2016 @01:44AM (#12803158)
> Not sure what the right term would be in this case.

Maybe pseudo-sudo?