Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #389 > unrolled thread

New Metasploit module gets a shell using just a QR code; affects 70% of android devices.

Back to article view | Back to comp.misc

Contents

  New Metasploit module gets a shell using just a QR code; affects 70% of android devices. cykros@devio.us - 2014-02-13 21:04 +0000
    Re: New Metasploit module gets a shell using just a QR code; affects 70% of android devices. RS Wood <rsw@therandymon.com> - 2014-02-14 11:12 +0000

#389 — New Metasploit module gets a shell using just a QR code; affects 70% of android devices.

cykros writes: New "WebView" exploit module for Rapid7's Metasploit
creates QR codes that, when scanned by any Android device running 
version 4.2 or earlier (70% of Android devices) return the creator 
of the QR code with a shell for remote code execution. Questions
arise as to who should be leaned on to provide a fix for this, as 
Google already has fixed the code in the most recent version of
Android.

https://community.rapid7.com/community/metasploit/blog/2014/02/13/weekly-metasploit-update?et=watches.email.blog

[toc] | [next] | [standalone]

#400

cykros@devio.us wrote:
> cykros writes: New "WebView" exploit module for Rapid7's Metasploit
> creates QR codes that, when scanned by any Android device running
> version 4.2 or earlier (70% of Android devices) return the creator
> of the QR code with a shell for remote code execution. Questions
> arise as to who should be leaned on to provide a fix for this, as
> Google already has fixed the code in the most recent version of
> Android.
>
> https://community.rapid7.com/community/metasploit/blog/2014/02/13/weekly-metasploit-update?et=watches.email.blog
>
>
>

Those QR codes always seemed like a bad idea to me.  Shortened URLs are 
bad enough (though I sometimes use them), but a graphic image provides 
no clear information, almost like it's binary.

Seems like QR codes and goat.se links would be a match made in heaven. 
Kind of the iphone version of chatroulet: click on the link with your 
smartphone camera, and if you're unlucky, you're face to face with a 
brown-eye seconds later ...

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web