SoylentNews

upstart writes:

Submitted via IRC for SoyCow9088

Attackers exploit 0-day vulnerability that gives full control of Android phones

Attackers are exploiting a zero-day vulnerability in Google's Android mobile operating system that can give them full control of at least 18 different phone models, including four different Pixel models, a member of Google's Project Zero research group said on Thursday night.

There's evidence the vulnerability is being actively exploited, either by exploit developer NSO Group or one of its customers, Project Zero member Maddie Stone said in a post. NSO representatives, meanwhile, said the "exploit has nothing to do with NSO." Exploits require little or no customization to fully root vulnerable phones. The vulnerability can be exploited two ways: (1) when a target installs an untrusted app or (2) for online attacks, by combining the exploit with a second exploit targeting a vulnerability in code the Chrome browser uses to render content.

"The bug is a local privilege escalation vulnerability that allows for a full compromise of a vulnerable device," Stone wrote. "If the exploit is delivered via the Web, it only needs to be paired with a renderer exploit, as this vulnerability is accessible through the sandbox."

[...] "This issue is rated as high severity on Android and by itself requires installation of a malicious application for potential exploitation," Tim Willis, another Project Zero member, wrote, citing Android team members. "Any other vectors, such as via web browser, require chaining with an additional exploit."

[...] While the vulnerability reported on Thursday is serious, vulnerable Android users shouldn't panic. The chances of being exploited by attacks as expensive and targeted as the one described by Project Zero are extremely slim. Just the same, it may make sense to hold off installing non-essential apps and to use a non-Chrome browser until after the patch is installed.

[Editor's Note: The link pointing to the comment made by Maddie Stone (2nd Para) has broken and now points to an empty page. We will try to find a replacement for it. The problem might be browser-specific, I am still investigating. --JR 13:08 UTC 8 Oct]

Original Submission