1. Android WebKit browser exploit 報告者：劉旭哲

2. Nov, Alert Logic Researcher M.J.Keith show a exploit in the Webkit in the Android. This exploit could lead to remote code execution or software crashes. Attacker can use it to install Trojan or other malicious software that could allow full access to the handset.

3. Users simple need to load a web page with specially crafted HTML. Android OS version 2.0-2.1 Mobile OS ： – BlackBerry 、 Palm WebOS and Apple iOS Browser are built on the same platform ： – Safari 、 Chrome 、 Firefox Mobile 、 Skyfire

4. 36.2% 40.8%7.9% 15%

5. Port IP \uae08 \u000a\u0202 2222 10.0.2.2 Port IP \uae08 \u000a\u0202 2222 10.0.2.2 trigger use-after-free

6. This current exploit is not the “attack code” itself but rather the “malware” the code may download. An input validation issue exists in WebKit's handling of floating point data types. Solution ： – Use other browser and update to Android 2.2

7. Demo Video

8. Reference http://www.zdnet.co.uk/news/security- threats/2010/11/08/researchers-expose-android-webkit-browser- exploit-40090787/ http://www.zdnet.co.uk/news/security- threats/2010/11/08/researchers-expose-android-webkit-browser- exploit-40090787/ http://www.informationsecurity.com.tw/article/article_detail.aspx? tv=11&aid=5946 http://www.informationsecurity.com.tw/article/article_detail.aspx? tv=11&aid=5946 http://adkz.blogspot.com/2010/11/android-exploits.html http://imthezuk.blogspot.com/2010/11/remote-code-execution- on-android-20-21.html http://imthezuk.blogspot.com/2010/11/remote-code-execution- on-android-20-21.html http://imthezuk.blogspot.com/2010/11/float-parsing-use-after- free.html http://imthezuk.blogspot.com/2010/11/float-parsing-use-after- free.html http://developer.android.com/resources/dashboard/platform- versions.html http://developer.android.com/resources/dashboard/platform- versions.html http://www.youtube.com/watch?v=czx_AKdj8ug http://www.exploit-db.com/exploits/15423/