Another exploit that affects the Android web browser has been uncovered -- this time it affects all versions, including Froyo. What happens is the user clicks a link, a file is downloaded, and it runs from the SD card -- allowing an attacker to possibly download a file on the SD card. The good news: No root exploiting, no changes can be made, and the attacker needs to know the file name and location.
The fellow who found the exploit has contacted Google, which said the issue will be addressed in an updated after Android 2.3 Gingerbread is released. And in the meantime, those concerned can unmount their SD card while browsing the internet. (The good news? It appears that Gingerbread is done, frozen, and waiting to be released!)
Or, like every other computer operating system on the planet, you could just not randomly click links from websites you don't trust. This exploit is something that should be addressed -- especially the bit where your browser will run an .html file after it's downloaded without warning you first, but the sky isn't falling, provided you use common sense. As Mr. Cannon notes, you can use Opera Mobile, which allows you to change your mind if you clicked to download a file.
Why I'm not worried: The exploit likely is a one-off (at least as it's currently explained), meaning it has to be written explicitly for a known folder and file on your SD card. OK, so pictures are pretty easy to get at, but it's still one at a time, and you have to know the exact file name. Seeing as how I don't advertise the full path to the items on my SD card, I'm not too concerned about this one. [thomascannon.net via Android Police]
Another browser exploit that we're not worried about is uncovered posted originally by Android Central
Sponsored by Android Cases and Accessories
Source: http://feedproxy.google.com/~r/androidcentral/~3/VTAxbzOYTYk/another-browser-exploit-uncovered
No comments:
Post a Comment