[h1]Android Bug Opens Memory Card to Remote Access[/h1]
File under: News
By: Stephen Schenck | 7:42 PM 23-Nov-10 |
0 Comments
A recently-discovered Android vulnerability, affecting all current versions operating system, has the potential to let a malicious website access your phone's memory card, reading any information that may be stored.
The bug is the result of several vulnerabilities in how the Android browser handles downloads to an external memory card. Someone exploiting these conditions could trigger the browser to automatically save a file containing JavaScript code to the card. Once that's in place, the browser can be directed to open that local copy of the file, where the embedded JavaScript has open-access to other files stored on the memory card, able to read them as it pleases.
While personal documents and confidential business info are probably the most valuable targets to a ne'er-do-well using this avenue of attack, they're thankfully also harder to get at. The JavaScript code needs to know just what it's looking for; common files that are stored in the same places on many phones are the most vulnerable, whereas any personalization of the memory card's directory structure will stymie the exploit.
Google is aware of the bug, and is expected to lock it down with the
release of Gingerbread. Devices that don't receive an Android 2.3 update or a specific patch for this bug will continue to remain vulnerable.
Source:
Thomas Cannon
Via:
Android Police