Feeds

Single NFC bonk subjugated Samsung Galaxy SIII and slurped it out

Attackers groped about until they had total dominance

Protecting against web application threats using SSL

A Galaxy SIII running Android 4.0.4 was infected with malware over an NFC connection at a hacking contest in Amsterdam using nothing more than a bump in the dark.

Full details of the vulnerabilities exploited haven't been revealed by the team, who came from MWR InfoSecurity and were showing off at Mobile Pwn2Own this week, as they are giving Samsung and Google time to issue a patch. An iPhone 4S was also compromised via a WebKit bug during the competition between security bods.

The Galaxy SIII infection was accomplished using Android's Beam application to send a file, which is executed thanks to a buffer overflow attack, allowing the hackers to escalate privileges to superuser level and establish a network connection to a remote server. The assault hands over complete control of the device and allows the data within to be siphoned off.

Android devices with NFC use Beam as a simple file exchange mechanism, but they're not supposed to execute received files. The vulnerability probably extends to any other Android device running Ice Cream Sandwich with NFC enabled, and might well extend to Jelly Bean as well although the team admits that might be harder.

The attack is a two-stage process: one vulnerability is used to get the received file to execute, and a second tool is then used to escalate privileges and gain access to private data. The randomised positioning of critical software components in memory - a security technique employed by Android and many other operating systems - makes that escalation challenging; over a hundred attempts were required during the demonstration, but those attempts can be made after the infection and took less than a minute anyway.

Jelly Bean apparently has more memory locations at which components are stored, decreasing the chance of finding the exact data or instruction address needed to further an exploit, but the team doesn't know how much that helps, or isn't saying.

The details are promised later, once the vendors involved have had a chance to fix it. The NFC execution should be an easy fix, one would hope, but the other part of the attack may prove harder to mitigate against. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.