Root exploit on Exynos

Re:Root exploit on Exynos by shawn-butler on Sunday December 16, 2012 @04:02PM (#4929502)

Would require further investigation. However, running the camera app via a non-priviliged account and also removing access would have the effect of removing DMA to the camera, that is why I suggested the result might be a black or green screen. I suppose it's possible they have some other way of taking stills, but I can pretty much guarantee you aren't going to record 1080p without DMA.

The proper solution is to obviously limit the DMA to regions of memory only needed by the camera. From my albeit cursory glance of the issue, it seems like you can pretty much write to any region of memory.

I have to imagine an exploit of that gaping a security hole is not very far away given the huge install base of samsung exynos devices.

[ Parent | on HN ]

Re:Root exploit on Exynos by sigkill on Sunday December 16, 2012 @04:35PM (#4929636)

I stand corrected. I tried for a fourth time, and apparently, after chmodding you need to wait for a minute or two. After that if you open the camera app, there is a black screen, exactly as you described.

EDIT - I still don't understand. The camera seems to be completely controlled by black magic. I have not recorded, but opening/closing the camera, then changing the permissions seems to allow you to continue using the camera app even with (0600).

[ Parent | on HN ]

Re:Root exploit on Exynos by rcxdude on Sunday December 16, 2012 @05:28PM (#4929834)

Probably because the camera service was still running and has already opened the file before you change the permissions. Changing permissions doesn't affect existing file descriptors.

[ Parent | on HN ]