32

The "Heartbleed" vulnerability in particular versions of OpenSSL is a serious security issue which allows malicious servers or clients to undetectably obtain unauthorized data from the other end of an SSL/TLS connection.

My Android device has a copy of OpenSSL installed in /system/lib. Its version number is 1.0.1c, which appears to make it vulnerable to this attack.

shell@vanquish:/ $ grep ^OpenSSL\  /system/lib/libssl.so                       
OpenSSL 1.0.1c 10 May 2012
  • How does this affect me? Do Android apps use OpenSSL? If not, why is it there?
  • Can I expect a firmware update from my carrier? If I root my phone, can I update it myself?
Improve this question
2
  • I think it's not vulnerable, as long as it's not offering a service using openssl? It should only affect you, if you run an https server or openssh, for example. Actually I wanted to post this as comment to discuss, don't blame me if I'm wrong...
    – davidbaumann
    Apr 8, 2014 at 19:03
  • 2
    Clients, such as web browsers, are affected.
    – Bob
    Apr 8, 2014 at 19:19

2 Answers 2

Reset to default
15

There is now a new attack that targets wireless networks and devices connected to them. Simply connecting to a corporate wireless network (one that uses EAP for security) is enough, if you are running a vulnerable version of Android. However, it is unlikely (don't quote me on this!) that they will be able to retrieve anything particularly sensitive from your Android device with this method. Maybe your wireless connection password.

You can use a detection tool (more info) to check if you have a vulnerable system OpenSSL lib on your device. Note that, as lars.duesing mentions, it's possible that specific apps are statically linked against vulnerable versions different from the system library.

According to this comment on Reddit, certain versions of Android are affected by this bug. Worse still, some browsers, especially the built-in one and Chrome, possibly use it and are therefore vulnerable.

Android 4.1.1_r1 upgraded OpenSSL to version 1.0.1: https://android.googlesource.com/platform/external/openssl.git/+/android-4.1.1_r1

Android 4.1.2_r1 switched off heartbeats: https://android.googlesource.com/platform/external/openssl.git/+/android-4.1.2_r1

That leaves Android 4.1.1 vulnerable! A quick grep on my access logs reveal there is a lot of devices still running 4.1.1.

Some other sources indicate that 4.1.0 is also vulnerable.

It seems the easiest way to fix it is to upgrade off that version, if possible. If you're lucky, your carrier will release a new version - but I wouldn't count on it. If not, you may have to investigate custom ROMs, possibly a downgrade, or rooting and manually replacing the library.

It is highly recommended that you resolve this issue. This bug can result in the theft of data, including usernames and passwords, from your browser by a malicious server.

Improve this answer
2
  • 1
    So if I understand this correctly, only 4.1.1 was vulnerable; older and newer versions are not?
    – Michael Hampton
    Apr 8, 2014 at 17:48
  • 2
    @MichaelHampton That's what it looks like, yes. Unless a vendor-specific ROM has decided to ship a different library.
    – Bob
    Apr 8, 2014 at 17:49
7

Short hint: MAYBE some apps use their own openssl-libs (or parts thereof). That MAY open problems on any OS-version.

And: Google is aware of the problem. Their official statement says that only Android 4.1.1 was vulnerable.

All versions of Android are immune to CVE-2014-0160 (with the limited exception of Android 4.1.1; patching information for Android 4.1.1 is being distributed to Android partners).

Improve this answer
1
  • It is nice to hear the official response from Google. But I accepted the other answer because it explains why 4.1.1 is vulnerable and 4.1.2 is not vulnerable anymore.
    – Michael Hampton
    Apr 10, 2014 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .