2

The BlueBox Security Scanner says that my Nexus 4 is still vulnerable to two signature exploits.

As far as I understood the exploit can circumvent the apk-signature-check so that any apk posing as an update for a system-apk will be installed as system app.

Is there a known way to install sudo/su with this exploit?

I would like to do so before my Nexus gets patched...

Update 2013-07-22:

What I am looking for is a step by step guide along these lines:

  1. get sudo-apk
  2. choose one unused system-app
  3. remove updates for this system-app
  4. download latest update for this system-app
  5. integrate sudo-apk with system-app-update-apk
  6. install
  7. have joy
| improve this question | |
  • As you correctly wrote: any apk posing as an update for a system-apk will be installed as system app. But an update requires something to be already there which it can update -- otherwise it's simply a fresh install. I might be wrong, but to me that means a clear "No". – Izzy♦ Jul 20 '13 at 22:38
  • @Izzy how about that "Google Korean keyboard" that I deactivated? This is a firmware-app with pending updates. – Nils Jul 21 '13 at 21:18
  • Try it and tell us. That might do, but I'm not sure what your SuperUser app is named then :) And being an update, it would replace that keyboard (or whatever system app you would "update"), so be careful and beware side-effects. – Izzy♦ Jul 22 '13 at 5:52
  • 1
    Anyway, the app will still require root to touch to /system and so to install the su binary. What I mean is that system app doesn't have more root access than a "normal" app. You'll still have to found a root exploit to gain temporary privilege. – Matthieu Harlé Jul 22 '13 at 9:21
  • 1
    That's exactly the point: For su to work, it must be in the $PATH. To modify that accordingly, /system must be mounted r/w -- and that doesn't happen even when a system app is updated. – Izzy♦ Jul 22 '13 at 13:50
5

The Exploit (& Fix) Android "Master Key" article describes the process of using the “Master Key” exploit to get elevated privileges with lots of technical details. The main point is that the exploit by itself does not give root privileges — only arbitrary code execution as the system user, and another privilege elevation exploit is needed to get root privileges (one well-known example shown in the article is writing ro.kernel.qemu=1 to /data/local.prop, but this attack is blocked in most Android 4.1 and later versions).

The article also provides download links for the Cydia Impactor tool which automates the “Master Key” exploit (currently only up to getting the system user rights, not all the way to root). There are versions for Windows and Mac OS X.

| improve this answer | |
1

The exploit is patched into AOSP, currently in CyanogenMod, its a matter of time before the update gets pushed out. It does not give you root privilege per se, rather it circumvents the signed key used to sign the ROM so that an apk can pose as a system app, in which the installation of the apk bypasses the said signed key.

As you have a Nexus 4, it will be a matter of time before Google pushes that out.

As for others, best to check with your manufacturer, not your carrier.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.