Feeds

Single NFC bonk subjugated Samsung Galaxy SIII and slurped it out

Attackers groped about until they had total dominance

Next gen security for virtualised datacentres

A Galaxy SIII running Android 4.0.4 was infected with malware over an NFC connection at a hacking contest in Amsterdam using nothing more than a bump in the dark.

Full details of the vulnerabilities exploited haven't been revealed by the team, who came from MWR InfoSecurity and were showing off at Mobile Pwn2Own this week, as they are giving Samsung and Google time to issue a patch. An iPhone 4S was also compromised via a WebKit bug during the competition between security bods.

The Galaxy SIII infection was accomplished using Android's Beam application to send a file, which is executed thanks to a buffer overflow attack, allowing the hackers to escalate privileges to superuser level and establish a network connection to a remote server. The assault hands over complete control of the device and allows the data within to be siphoned off.

Android devices with NFC use Beam as a simple file exchange mechanism, but they're not supposed to execute received files. The vulnerability probably extends to any other Android device running Ice Cream Sandwich with NFC enabled, and might well extend to Jelly Bean as well although the team admits that might be harder.

The attack is a two-stage process: one vulnerability is used to get the received file to execute, and a second tool is then used to escalate privileges and gain access to private data. The randomised positioning of critical software components in memory - a security technique employed by Android and many other operating systems - makes that escalation challenging; over a hundred attempts were required during the demonstration, but those attempts can be made after the infection and took less than a minute anyway.

Jelly Bean apparently has more memory locations at which components are stored, decreasing the chance of finding the exact data or instruction address needed to further an exploit, but the team doesn't know how much that helps, or isn't saying.

The details are promised later, once the vendors involved have had a chance to fix it. The NFC execution should be an easy fix, one would hope, but the other part of the attack may prove harder to mitigate against. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.