News for hackers. Stuff that matters.

A comment on Major Flaw in Android Phones Would Let Hackers in with Just a Text. Parent comment

Re:Major Flaw in Android Phones Would Let Hackers in with Ju... by Florin_Andrei on Monday July 27, 2015 @03:41PM (#9957531)
> And it's reasonably sandboxed in recent Android versions using selinux.

Is it safe to assume that this attack vector is not a concern with Android 5.1? (or later)

[ Parent | on HN ]
Re:Major Flaw in Android Phones Would Let Hackers in with Ju... by ajross on Monday July 27, 2015 @04:25PM (#9957777)
Certainly not, because the plausible kernel bugs in those open driver descriptors (I'm serious: vendor media drivers are not pretty things) would obviously not be subject to selinux controls.

But at least there is some sandboxing in place; the security architecture was designed to admit the possibility of a breach of the mediaserver.

[ Parent | on HN ]
Re:Major Flaw in Android Phones Would Let Hackers in with Ju... by fluidcruft on Monday July 27, 2015 @04:46PM (#9957890)
According to the reddit discussion, 5.1.1 is demonstrated to be vulnerable (so it affects everything 2.2 and later).
[ Parent | on HN ]
Re:Major Flaw in Android Phones Would Let Hackers in with Ju... by ajross on Monday July 27, 2015 @06:06PM (#9958340)
Link to that reddit thread? AFAICT, all current claims are for a crash exploit into libstagefright, not a breakout of the mediaserver to (for example) persistently write a payload/rootkit.
[ Parent | on HN ]