By:Zuk Avraham
Follow Zuk Avraham (@ihackbanme)Joshua Drake
Follow Joshua Drake (@jduck)Yaniv Karta
Follow Yaniv Karta (@shokoluv)
Reflecting on our collective experiences in the Android ecosystem, especially recent events around Stagefright, we were reminded of several deficiencies in the way that Android security update ecosystem works. To help address these issues, we are pleased to announce Zimperium’s Handset Alliance. The creation of this coalition will serve to support our goal of improving security among all of the various parties involved with Android.
Our goal in creating this coalition is to address the following key concerns, which will be very familiar to people who work day-to-day in the smartphone security ecosystem.
We’ve learnt from several device vendors and telecom providers that they would rather receive Android security relevant notifications at the same time as Google. By now, almost everyone is aware of the long tail associated with Android updates. When the Android Security Team supplies patches to their partners, it’s only the beginning of a long process. Many vendors received the patches we submitted in April, only in June. Some vendors said they didn’t receive the patches at all. We believe notifying all relevant personnel in the ecosystem in parallel will help decrease the amount of time it takes for end-users to receive a security update.
According to our understanding of the Android ecosystem, security issues reported to Google are only shared with active partners. While we are not privy to the details, we understand that advisories and updates produced by Google are not provided to non-partners like the makers of Firephone and Blackphone. This gives such vendors zero visibility into such potential threats until the reported issues are made public. By then it could be too late. We invite such vendors to participate as we feel they deserve to be notified at the same time as other directly impacted organizations.
Finally, getting in touch with the correct point of contact at various companies within the Android ecosystem can be difficult. Creating ZHA provides a communications channel with the correct people for every specific security concern — from mobile network operators to Google itself. We encourage researchers to reach out to us if they are having trouble finding the right contact.
We fully intend for ZHA to be more open than the Open Handset Alliance (OHA). As such, we welcome participation from members of security teams directly impacted by Android security issues. Examples include organizations that have a responsibility in securing devices running Android or AOSP-derivatives, mobile network operators that host Android devices, and so on.
To kick off this initiative, we are sharing the full set of patches and proof-of-concept code with this group ahead of our upcoming appearances at Black Hat and DEFCON.
More than 16 of the largest vendors and carriers have already joined ZHA. If you’re interested in joining ZHA, apply here. Please do keep in mind, however, that we are vetting applicants in an effort to ensure that sensitive information disseminated via this alliance stays within organizations actually charged with responding to Android security issues.
Zimperium recognizes that improving Android security requires more than just improving communications between vendors. Apart from fast, regular updates, proactive research is the best way to get ahead of emerging threats. By finding and fixing latest vulnerabilities, attackers are left with an ever dwindling arsenal. From source and binary code audits to design review, more eyes means more improvement. To facilitate that goal, we are also launching a new mobile-focused public security mailing list.
Mobile security researchers, security vendors and IR and IH teams are welcome to join our Open Mobile Security Forum here: apply here.
With both of these new initiatives underway, we hope to connect the two communities so that we can push the security of the ecosystem to the next level. We encourage researchers that have specific concerns about security within the Android ecosystem to engage the alliance when they see fit. We will do our best to connect the correct people.
We are working to release both a stand-alone application to test for the presence of known Stagefright vulnerabilities and a video demonstrating a successful attack. Several organizations requested that we delay the release of our working exploit. We agreed, given the gravity of the situation. Unfortunately, because the patches are open-source [1, 2], many researchers are already working on creating an exploit. We believe it’s only a matter of time before we see attacks in the wild (assuming they are not already occurring).
Vulnerabilities such as those discovered in Stagefright can potentially be used in the creation of a network worm. This is especially true for the sixty million devices without Address Space Layout Randomization (ASLR). Assuming that each one of these devices will send around 100 MMS messages per day, we are speaking about six billion MMS messages per day. Such an event could wreak havoc on mobile network infrastructure and spam many users with unwanted MMS messages.
In the unfortunate event that someone does develop and release a worm for these vulnerabilities into the wild, we would like to offer the following guidance to mobile network operators. Employing these protective measures could make all the difference.
UPDATE: