Hackers can pwn your Android in 10 seconds, if you use Bing App in Starbucks

Re:Hackers can pwn your Android in 10 seconds, if you use Bi... by 0x0 on Friday January 24, 2014 @09:28PM (#7119581)

So it seems the story here is that in older versions of android, if you export a Java class to a webview with "addJavascriptInterface", the js code can get arbitrary code exec by calling exportedObject.getClass().forName("java.lang.Runtime").exec() or similar? And if you can mitm/spoof on public wifis, you can inject js to exploit this in apps that export to their webviews?

[ Parent | on HN ]

Re:Hackers can pwn your Android in 10 seconds, if you use Bi... by zhongjiewu on Friday January 24, 2014 @10:24PM (#7119707)

This is exactly how it works. And a lot of apps use this JS bridging technic to make their app easy to maintain. Dirty hack becomes technical debt

[ Parent | on HN ]

Re:Hackers can pwn your Android in 10 seconds, if you use Bi... by majiaguan on Saturday January 25, 2014 @02:08AM (#7120136)

Please disclose more technical detail

[ Parent | on HN ]

Re:Hackers can pwn your Android in 10 seconds, if you use Bi... by trustlook on Saturday January 25, 2014 @02:44AM (#7120195)

It's a vulnerability on Android Webview component, which supports a "addJavascriptInterface" method. This method allows you to call the Java native method by using a Javascript object inside the webpage. And, there is a trick that can bypass the restriction on classes that JSInterface object could access. You can call any method in any Java class. Such as Java.lang.Runtime.exec. You can google "addJavascriptInterface vulnerability". It's not a new vulnerability, but lots of app haven't fix it yet.

[ Parent | on HN ]