lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 29 Nov 2014 15:38:30 -0500
From: Joshua Wright <jwright@...borg.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>,
	"Wang,Tao(Scloud)" <wangtao12@...du.com>
Subject: Re: [FD] CVE-2014-8610 Android < 5.0 SMS resend vulnerability

> On Nov 25, 2014, at 9:55 PM, Wang,Tao(Scloud) <wangtao12@...du.com> wrote:
> 
> INTRODUCTION
> ==================================
> In Android <5.0, an unprivileged app can resend all the SMS stored in the user's phone to their corresponding recipients or senders (without user interaction).
> No matter whether these SMS are sent to or received from other people. This may leads to undesired cost to user.
> Even the worse, since Android also allow unprivileged app to create draft SMS, combined with this trick, bad app can send any SMS without privilege requirement.

I put together a Drozer module to leverage this flaw:

https://github.com/joswr1ght/drozer-modules/blob/master/whfs/smsdraftsend.py

Note that this flaw can be used for SMS premium message (short code) delivery, but does not bypass the Android 4.2 and later verification dialog box prior to delivery.  Normal SMS message delivery works fine without the SEND_SMS privilege.

-Josh 

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists