kornan / superuser Goto Github PK

What steps will reproduce the problem?
1. Install superuser on a rooted android phone
2. Open a shell and run 'su'
3. Note that you're asked if you want to give that app permission to run as 
super-user, but there 
is no password.

What is the expected output? What do you see instead?

I expect to be asked for a password before being granted su access.  As it 
stands, this looks like 
it could be used by someone who got hold of my phone to, for example, get my 
gmail password 
from the gmail app.

Now I know that with physical access they could always flash the phone anyway, 
but this changes 
the attack from 'root the phone', including multiple restarts, to 'enter a few 
shell commands'.

The fix could be something as simple as enabling the lock screen (requiring the 
user the unlock 
the phone, even if the lock screen is not normally enabled) when bringing up 
the 'allow'/'deny' 
screen.  That would add a password, but in a way that is relatively unobtrusive.

su.c has a trivially exploitable bug on lines 65-66:

char update[1024];
sprintf(update, "update whitelist set count=%d where _id='%s';", count,
argv[0]);

An attacker controls the size and values representing in argv[0]. When
argv[0] is greater than 1024, this will cause an overflow condition. This
might allow an attacker to execute arbitrary code.

This kind of stuff is all over su.c and is basically a nightmare.

This programm seems to be written by idiots.
Reading the source makes me crying.
Is there an *secure* alternative to this tool?

I've attached a quick code review that includes a dozen security issues. 

Almost all of these bugs allow any other application on the phone to gain
root privileges without user interaction. 

It appears that the AndroidManifest.xml has debugging enabled. This should
be disabled by default for security reasons.

I've attached a quick patch that makes some comments and discusses a number
of security related issues in the SuperuserActivity.java and
SuperuserRequestActivity.java files.

When I am prompted to allow an application to access su, if I press the
back button, the following error appears
ERROR/Database: Leak found

Stacktrace from LogCat attached