What is the attack vector of <= 4.3 web view vulnerability?

Question

This is in reference to the vulnerability that Google is not patching, since the WebView in 4.3 and less is part of the OS and not a separate updateable component.

Since some people will not have easy upgrade options from their phone manufacturer or cell carrier, they might consider just staying with 4.3, or some are still hoping their carrier provides an upgrade at some point. In this case it's useful to understand what one can do to mitigate the risk of the vulnerability.

Is this a vulnerability that any website can exploit just by visiting the website with the standard web browser? I.e. if I go to someverymalicioussite.example.com and it contains specific javascript that targets the vulnerability and allows remote code execution.

If so, is that risk mitigated by using a browser like Firefox or Chrome (that I am guessing does not use the WebView component).

Or does the vulnerability require installing an app that a developer has maliciously written to exploit the Web View component, to allow the app to perform actions that it wasn't permitted to?

Answer 1

While this is getting attention by the media only now there is already one exploit in Metasploit that explore this vulnerability.

The "single-click" Metasploit exploit targets a vulnerability in a WebView component that's used by the native Android browser, although the component can also be used by other apps.

According to an attack-demonstration video published by Rapid7, the bug can be exploited by tricking a user into scanning a malicious QR code that includes the attack code, which then triggers the vulnerability in the Android browser and gives the attacker command-shell access to the device.

But the vulnerability can be exploited in other ways, too. "A secondary attack vector involves the WebViews embedded inside a large number of Android applications," says an overview published by Rapid7. "Ad integrations are perhaps the worst offender here." In particular, if an attacker could gain man-in-the-middle access to a vulnerable application's HTML connection, or to the cross-site scripting code used by the application, then the attacker could inject the malicious JavaScript code and gain command-shell access to the device.

How to defend against that? As almost anything that harden android you will need root then do :

1. Completely delete the stock browser using your favorite app or delete the stock browser app and odex correspondent file (for advanced users)

2. Block all ads entirely giving no chance to an man-in-the-middle intercept and change ads displayed by apps with malicious code. Adaway is a good free open source app that can help and it's avaible via F-Droid.

3. Using firefox chrome or safari should be safe but if you want even more security and don't really care about breaking some pages make sure Javascript is disabled (no root needed for this step) this will protect you against a large quantity of attacks.