[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FD] CVE-2014-8610 Android < 5.0 SMS resend vulnerability

> On Nov 25, 2014, at 9:55 PM, Wang,Tao(Scloud) <wangtao12@xxxxxxxxx> wrote:
> 
> INTRODUCTION
> ==================================
> In Android <5.0, an unprivileged app can resend all the SMS stored in the 
> user's phone to their corresponding recipients or senders (without user 
> interaction).
> No matter whether these SMS are sent to or received from other people. This 
> may leads to undesired cost to user.
> Even the worse, since Android also allow unprivileged app to create draft 
> SMS, combined with this trick, bad app can send any SMS without privilege 
> requirement.

I put together a Drozer module to leverage this flaw:

https://github.com/joswr1ght/drozer-modules/blob/master/whfs/smsdraftsend.py

Note that this flaw can be used for SMS premium message (short code) delivery, 
but does not bypass the Android 4.2 and later verification dialog box prior to 
delivery.  Normal SMS message delivery works fine without the SEND_SMS 
privilege.

-Josh 

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/