Show HN: Android 'root' phones via dirtyc0w exploit

Re:Show HN: Android 'root' phones via dirtyc0w exploit by bastijn on Thursday October 27, 2016 @02:48AM (#12803314)

I think it all starts with educating the careless. Remind them of the risks so in due time they learn to think before they act. Do you have a responsibility as the provider of the script? I do not know, as a true hero you could put a statement on the top of your readme. Like a warning message. One step ahead you can become an even greater hero and host the zip yourself on a secure source. However, this places the burden of maintenance to you which is something which you might not like. In addition it brings the question of ownership.\

I think there is no real answer here. Warn them, and warn them often might be the mitigation.

[ Parent | on HN ]

Re:Show HN: Android 'root' phones via dirtyc0w exploit by Arinerron on Thursday October 27, 2016 @02:54AM (#12803338)

Thanks! What kind of warning message would you suggest? A "the exploit might be compromised" message, a "verify your download with this hash" message, or something else?

[ Parent | on HN ]

Re:Show HN: Android 'root' phones via dirtyc0w exploit by anilgulecha on Thursday October 27, 2016 @03:02AM (#12803367)

One thing you can do is simply fork the repo, and use your repo as the path in the script. So you're not at the mercy of upstream author's changes.

[ Parent | on HN ]

Re:Show HN: Android 'root' phones via dirtyc0w exploit by Arinerron on Thursday October 27, 2016 @03:20AM (#12803417)

Thanks, I'll do that. One problem though is that I've already published the script here, and migrating to a new repository would leave everyone with a dead link, etc. I could post the script in the fork too, though.

[ Parent | on HN ]

Re:Show HN: Android 'root' phones via dirtyc0w exploit by bastijn on Thursday October 27, 2016 @10:17AM (#12805268)

"Careful. Running scripts from unidentified sources can comprimise your device. Never copy and paste something directly from an untrusted source to an executable context. Never ever."

That should do the job.

More good reads on why you don't want to do this: http://www.ush.it/team/ascii/hack-tricks_253C_CCC2008/wysinw...

[ Parent | on HN ]