Slashdot Log In
Security Holes In Google's Android SDK
Posted by
Zonk
on Wed Mar 05, 2008 12:28 AM
from the patchy-the-leaky-robot dept.
from the patchy-the-leaky-robot dept.
Redon Buckeye writes "Google's Android software development kit is using several outdated and vulnerable open-source image processing libraries, some of which can be exploited to take complete control of mobile devices running the Android platform. From the article: 'Several vulnerabilities have been found in Android's core libraries for processing graphic content in some of the most used image formats (PNG, GIF, and BMP). While some of these vulnerabilities stem from the use of outdated and vulnerable open source image-processing libraries, other were introduced by native Android code that uses them or that implements new functionality.'"
Related Stories
Submission: Security Holes in Google's Android SDK by Anonymous Coward
[+]
Mobile: Android Phones Delayed 167 comments
CommanderData writes "PC World reports that Google's Android phone rollout is facing delays. Originally expected to have handsets on the market and in consumers' hands this summer, it appears that Q4 2008 or even sometime in 2009 is more likely. Software developers are also complaining that programming is difficult on the Android platform due to regular changes being made by Google." Update 21:14 GMT by SM: Google has (via Google Watch) refuted widespread claims that Android will be late, so I guess only time will tell.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
yawn (Score:5, Insightful)
Re:yawn (Score:5, Insightful)
That would be a valid retort if it weren't for Google's perpetual beta mentality.
Parent
Re: (Score:2, Insightful)
Re:yawn (Score:5, Insightful)
Really, in the hands of Google, the 'beta' tag is only a way to keep things sounding 'hip and new' and to avoid liability when something screws up.
Parent
Re:yawn (Score:5, Insightful)
Parent
Re: (Score:2)
Re: (Score:2)
I disagree with the assumption that security holes in beta software aren't serious. Beta -- in software at least -- means that real live users are using it.
However, at this point the software is not available to users; if the problem is that the system uses obsolete implementations for some of its APIs, the open source process has worked the way its supposed to. If the problem is inherent in some important APIs, that's a different kettle of fish.
Still, I expect Android to be a
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:1)
Outdated software != beta software Please RTFSummary before posting
Tell yourself that.
This SDK hasn't been completed. Nothing to read here.
Re: (Score:2)
Also probably planned.
Google is practically a subcontractor for the NSA. Expect a Google phone to be a hotline to the datamine.
I'm not exactly sure how phone software works... (Score:3, Interesting)
Re:I'm not exactly sure how phone software works.. (Score:3, Insightful)
Re: (Score:3, Interesting)
the point being? (Score:1)
Re: (Score:1)
IMHO Google has done a fairly good job in its software development (which is to say, I have personally had few issues). Being open source at least lets people know there is a problem. T
Re: (Score:2)
I can't wait until telemarketers start using exploits to take over mobile phones to make mass calls. I can see the phone bills now...
Re: (Score:2)
The exciting thing to me is that this Google project will introduce not only open source software, but open source thinking and open source culture to the masses.
And knowing Google, it will be successful, and being successful it will clear up many of the uninformed stigmas that cling to open source software - hopefully beginning with the kind of FUD that MS spouts.
Who The Hell Is Still Using BMP? (Score:5, Funny)
Having had the ignominious privilege of writing a BMP image parser some years ago, I can state without fear of meaningful contradiction that it's one of the worst image file formats ever devised by creatures claiming to be Man, and that it needs to die die die!
PNG does everything BMP does, and does it better. Just throw away the BMP library and save yourself the maintenance headache. No one will miss it.
Schwab
Re:Who The Hell Is Still Using BMP? (Score:4, Funny)
But then we couldn't have fun watching images load from the bottom up! It looks so cool and is totally worth a few extra (mega)bytes!
Parent
People who need uncompressed images. (Score:2)
Sometimes you just don't want your data to be compressed; you want to be able to tell the OS to load the data from storage and have it right there, ready for you to use. Sometimes you just can't afford the overhead of decompression. But PNG, reasonably enough (I suppose) for network graphics, requires all images to be compressed; you can't say "no compression".(*) BMP, on the other hand, is uncompressed by default; aside from the line order problems (which are easily solved by pre-flipping the image), th
Re: (Score:2)
But heck if you must use an uncompress format then just us IFF and be done with it
Re: (Score:3, Funny)
Re: (Score:2)
Already fixed (Score:5, Informative)
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:1)
Hoorah for google and open source software.
Re: (Score:3, Insightful)
Re: (Score:1)
Dumb (Score:1)
Re: (Score:2, Informative)
They also pointed out that this iss not BETA code, but merely a release of propsed code to allow potential devlopers to add their insights to the project on which direction the code should go on various portions.
The libraries have now been replaced (evidently) with the newer o
This... (Score:1)
Oh noes! (Score:2, Funny)
that's why it's open source (Score:5, Interesting)
I think the only thing that bothers me about Android is that the full source code has not been released yet, although Google claims they will be making that available.
you know what this means... (Score:1)
I'm going to call it "Gaolbreak"
Re:Re-using, Re-using, Not re-inventing the wheel, (Score:4, Insightful)
Parent
Re:Re-using, Re-using, Not re-inventing the wheel, (Score:5, Insightful)
I've heard it said, as an example, that only 20% of the code in Gecko is to implement a reliable, standards-compliant rendering engine, and the other 80% is to implement workarounds for (sometimes horribly) broken HTML, and recover from what should rightfully be critical errors. I'm not sure if this statistic is accurate (or, if it was when I heard it, if it still is now); however, at a previous position, our (large-scale) software product, developed over the course of the last decade, large, complex, and convoluted, had a similar statistic. Over 80% of the code that we had in our core product was there to deal with bugs in previous code, bugs in other people's products, bugs in how different vendors implemented the standards (i.e. poorly), bugs with corrupted images, and so on.
Think about that for a second; anyone can re-implement a PNG library by reading the specifications and learning how to do the math on the algorithms; there are probably people at Google who could write a complete PNG library in C inside of a week (they DO have some pretty brilliant people working for them). What they CAN'T do is go out and feed into that library all of the broken, corrupted, or just-a-little-bit-off PNG images that are out there on the web that require little tweaks and adjustments (or horrific workarounds) to process, and find all the fixes to all the glitches that end-users might see.
The extensive experience that the libpng developers have had over the lifetime of the project cannot be simply re-implemented from a textbook. THAT is why simply re-writing it is impractical, and THAT is why code re-use is a good thing. Expand that from PNG images out to every other shared library in the project, and 'not invented here' syndrome turns simple and straightforward bllet-point requirements for Android into a large-scale programming project, and makes the whole thing impractical.
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
While it's neither here nor there in relation to this story (and wouldn't perform very well, anyway), I just thought it was an interesting observation. Perhaps one day developers will stop looking at Java as a nice sandbox environment for tiny applications and start realizing that there are real benefits to deploying a high-performance JVM. Especially when HotSpot [sun.com] has already been ported to mobile devices...
Re: (Score:2)
Re:Re-using, Re-using, Not re-inventing the wheel, (Score:4, Informative)
Parent
Re: (Score:2)
The grandparent was right: People should stop thinking that somehow interpreted languages (Java,
Re: (Score:3, Interesting)
Bull. Java will overflow the integer, but how exactly will it result in an underflow or an overflow of a memory buffer if Java does not have pointers? All you have is a negative value. At best you'll cause an IndexArrayOutOfBoundsException when you attempt to access an invalid array location. At worst, the code will detect it as an invalid value and move on.