
Autopwn every Android device on your network using BetterCap - wolframio
http://www.evilsocket.net/2016/01/18/autopwn-every-android-device-on-your-network-using-bettercap-the-and-addjavascriptinterface-vulnerability/
======
alternize
the title should say "every _vulnerable_ Android device":

    
    
      One of the most interesting ones is the addJavascriptInterface vulnerability ( CVE-2012-6636 ) which affects every device running a version older than Android 4.2
    

the exploit is from march 2012 and affects devices running android < 4.2.
which according to latest platform usage [0] numbers is around 14.9% of all
active android devices.

[0]
[https://en.wikipedia.org/wiki/Android_(operating_system)#Pla...](https://en.wikipedia.org/wiki/Android_\(operating_system\)#Platform_usage)

~~~
jacquesm
With 1.4 billion active android devices out there that still translates into a
whopping 200M or so devices.

~~~
ocdtrekkie
Unfortunately, Google has stated no intention to support or secure any device
running an OS released more than 18 months ago. There's many dozens of CVEs
that involve owning devices pre-5.1 that will never be fixed by Google or the
OEMs.

~~~
amlgsmsn
Does the open source nature of Android help here for a fix?

200M devices sounds like a lot, is it not possible for the community to fix
it?

~~~
ikeboy
I'm writing this from a Samsung device that never had a supported lollipop
release. If I'd be on stock, I'd be vulnerable to many vulnerabilities
including stagefright.

But I'm using an open source ROM called cyanogenmod, currently on Android 5.1
(cm 12.1). I upgraded to a newer nightly after patches were made to fix
stagefright, and now I'm not vulnerable. I could also have installed a version
of cyanogenmod from KitKat that back ported the patch.

So yes, open source can and has addressed this. If your device is supported by
cyanogenmod, you can fix it.

Note that marshmallow cm builds are expected to be released soon, and afaik my
device (S3) will still be supported: this would make my device upgradable 2
entire major releases after the manufacturer dropped support.

~~~
pjmlp
That doesn't work for the common user.

~~~
ikeboy
No open source solution can. Even if it was a patch downloaded on top of
stock, you can't get people to upgrade if it's not automatic/promoting them.

------
matt_wulfeck
Ugh this type of commoditization of exploits is downright scary. Google needs
to do something about the OEMs dragging their feet on updates and do it FAST.
I can't see any other solution for people other than to move to Nexus or iOS
phone.

~~~
xenadu02
Google doesn't much power in the relationship. They have announced several
efforts to make OEMs and carriers provide a better update experience. So far
it hasn't helped.

The OEM's customer is the carrier because the carrier determines whether or
not the handset even appears for sale in the stores or on the website. For
both the OEM and the carrier, updates are a pure cost center for which there
is little-to-no benefit.

Google can't roll out updates on its own because the OEMs customize for their
CPU, platform, baseband, etc. Google doesn't have the drivers, licenses,
testing capacity, or configuration details to deal with the various bits of
hardware.

Presumably Google could make regular updates a requirement for using Google
services on Android. At that point we'd find out whether the tail wags the dog
and I think Google might not like the answer; getting the data on Android
users is quite valuable for building advertising profiles. I doubt a few
Googlers desire to have timely updates would survive contact with the money-
making ad side of the house but I could be wrong.

~~~
ocdtrekkie
Google needs to actually develop Android as a platform where drivers and their
software can be distributed separately. Like Windows. Even Windows Phone lets
Microsoft push the OS directly (first tested in the Dev Preview feature)
separate from the firmware updates from the carrier or OEM.

------
mnip
If you want to help and inform people, as I guess it was your goal with this
article, why use this awfully wrong title?

------
tempodox
So this is how Reese and Mr. Finch do it. I was wondering.

------
mahouse
bettercap can't be recommended enough. A very very friendly developer too.
It's a spectacular piece of software that will only improve.

~~~
evilsocket
wow thanks! :)

------
2np
I don't want to be evil, just mischievous. Can I just make everyone's phones
ring?

