Feeds

PacketVideo opens doorway to Android

Google fans told to down browsers for the duration

The essential guide to IT transformation

G1 owners have been warned to stop browsing immediately or risk exposing themselves to the worst of the internet, after researchers found a flaw in PacketVideo's runtime for Android.

The flaw was presented by security researcher Charlie Miller at the recent Schmoocon conference, as reported by ReadWriteWeb, and details are available at oCERT. Given the exploit allows arbitrary code execution, provided within a specially-crafted MP3 file, the security implications are serious - but not as serious as they could be thanks to Android's layered security model.

Not that the complexity of the exploit, or the robust security model, have prevented Miller from recommending that G1 users stop browsing entirely, or at least limit themselves to only visiting trusted sites using the T-Mobile network (avoiding the potential for DNS-spoofing, assuming T-Mobile's DNS' are secure).

ReadWriteWeb contacted Mocana's James Blaisdell for a second opinion, and got the same advice, though it's worth noting that James is CTO of a company that supplies security software for Android.

Google seems less concerned. Indeed the company has had a fix knocking around in its source tree since Monday this week, but T-Mobile hasn't got round to pushing it out to Android users yet.

Even if the flaw was successfully exploited, no mean feat in itself, the attacker would only have access to the browse at best, and more-likely would be restricted to the media player.

That's not to say that the flaw shouldn't be fixed, or that Charlie Miller doesn't deserve our respect for identifying the bug, but calling on Android users to stop browsing is little more than showboating and we'll continue to browse the web on out G1 for the moment, while we wait for a proper mobile-phone security issue to come up.®

Secure remote control for conventional and virtual desktops

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
So, Apple won't sell cheap kit? Prepare the iOS garden wall WRECKING BALL
It can throw the low cost race if it looks to the cloud
EE fails to apologise for HUGE T-Mobile outage that hit Brits on Friday
Customer: 'Please change your name to occasionally somewhere'
Time Warner Cable customers SQUEAL as US network goes offline
A rude awakening: North Americans greeted with outage drama
We need less U.S. in our WWW – Euro digital chief Steelie Neelie
EC moves to shift status quo at Internet Governance Forum
BT customers face broadband and landline price hikes
Poor punters won't be affected, telecoms giant claims
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.