SCF Advanced Search



Members
Stats
  • Total Posts: 36748
  • Total Topics: 11611
  • Online Today: 1301
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)











Author Topic: Israeli University security researchers demonstrate new exploit in Android's VPN  (Read 1782 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7501
  • KARMA: 321
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


The Ben Gurion University security researchers who tangled with Samsung over its KitKat security implementation have posted a follow-up, in which they demonstrate how a malicious app could bypass some VPN protections in Android.

Back in December, the university's Cyber Security Labs stated that Samsung's Knox implementation was insecure, but last week the mobe-maker and Google agreed that the problem lies in Android rather than being specific to one handset vendor.

The researchers now say that in a related vulnerability, they have used a malicious app to redirect a user's VPN connection to a server which is then able to capture user traffic:  http://cyber.bgu.ac.il/blog/vpn-related-vulnerability-discovered-android-device-disclosure-report

As the researchers state:

“This vulnerability enables malicious apps to bypass active VPN configuration (no ROOT permissions required) and redirect secure data communications to a different network address. These communications are captured in CLEAR TEXT (no encryption), leaving the information completely exposed. This redirection can take place while leaving the user completely oblivious, believing the data is encrypted and secure.”

The researchers haven't published the code for their exploit, but say they have notified Google of the vulnerability and will provide more detail once the problem has been patched.

While the vulnerability provides deep access to user communications that are supposed to be protected, it's important to note that it can only be exploited if a user can be tricked into installing a malicious application.

Also, SSL / TLS traffic remains encrypted: it can be captured, but not in plain text.

At this stage, the researchers have only tested their attack on Android 4.3 KitKat.

(ElReg)

Samker's Computer Forum - SCforum.info


 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising