UCR Todayreader comments 21
Share this story
There’s a new method for rooting Android devices that’s believed to work reliably on every version of the mobile operating system and a wide array of hardware.
Individuals can use it to bypass limitations imposed by manufacturers or carriers, but it could also be snuck into apps for malicious purposes.
The technique comes courtesy of a Linux privilege-escalation bug that, as came to light last week, attackers are actively exploiting to hack Web servers and other machines.
Dirty Cow, as some people are calling the vulnerability, was introduced into the core Linux kernel in 2007.
It’s extremely easy to exploit, making it one of the worst privilege-elevation flaws ever to hit the open-source OS.
Independent security researcher David Manouchehri told Ars that this proof-of-concept code that exploits Dirty Cow on Android gets devices close to root. With a few additional lines, Manouchehri’s code provides persistent root access on all five of the Android devices he has tested.
“It’s very easy for someone who’s somewhat familiar with the Android filesystem,” Manouchehri said of the exploit. “From what I can tell, in theory it should be able to root every device since Android 1.0.
Android 1.0 started on [Linux] kernel [version] 2.6.25, and this exploit has been around since [Linux kernel version] 2.6.22.”
A separate security researcher who asked to not be identified said he and several other people developed a separate rooting exploit.
It’s based on this publicly available Dirty Cow exploit that they modified to make work on Android and to give it additional capabilities.
“We are using a rather unique route on it that we can use elsewhere in the future as well,” the researcher said when asked why he didn’t want to disclose the code or want his name published. “I don’t want Google or anyone shutting down that route.”
The video below shows the researcher using his app to root an Android-powered HTC phone, which is connected to a computer by a USB cable.
The first ID and su commands show that the device is unrooted.
After running “moo”—the name of the file containing the exploit code—and then running the su and ID commands again, it’s clear that the device has been rooted.
Android root based on Dirty Cow exploit
Both of the exploits allow end users to root Android phones so they have capabilities such as tethering that are often restricted by individual manufacturers or carriers.
By gaining access to the core parts of the Android OS, owners can bypass such limitations and vastly expand the things their devices can do.
The darker side of rooting is that it’s sometimes done surreptitiously so that malicious apps can spy on users by circumventing application sandboxing and other security measures built into Android.
Just as Dirty Cow has allowed untrusted users or attackers with only limited access to a Linux server to dramatically elevate their control, the flaw can allow shady app developers to evade Android defenses that cordon off apps from other apps and from core OS functions.
The reliability of Dirty Cow exploits and the ubiquity of the underlying flaw makes it an ideal malicious root trigger, especially against newer devices running the most recent versions of Android.
“I would be surprised if someone hasn’t already done that this past weekend,” Manouchehri said.
Dirty Cow came to light a few days before the release of a separate rooting method for Android devices. “Drammer,” as the latter exploit has been dubbed, is significant because it targets the “Rowhammer” bitflipping hardware bug, which allows attackers to modify data stored in device memory.
Google plans to release a patch in November that makes Rowhammer much harder to exploit.
Now that the Dirty Cow hole has been patched in the Linux kernel, it’s only a matter of time until the fix makes its way into Android, too.
But the soonest it will be available is with the release of next month’s Android patch batch. Of course, that’s not available for a large number of devices, mostly because of limitations set by manufacturers and carriers.