We have moved to a new Sailfish OS Forum. Please start new discussions there.
1

Is Jolla vulnerable to double direct ICMP spoofing? [answered]

asked 2014-11-24 15:55:51 +0300

Nekron gravatar image

I stumbled upon a new security risk for mobile phones called "double direct". In a public network mobile devices can be vulnerable for specially crafted ICMP redirect packets that redirect e.g. your DNS query to a malicious system on your network, i.e. a classical MITM can be done.

More information and a proof of conect can be found at: http://blog.zimperium.com/doubledirect-zimperium-discovers-full-duplex-icmp-redirect-attacks-in-the-wild/

Is Jolla vulnerable to this?

edit retag flag offensive reopen delete

The question has been closed for the following reason "the question is answered, an answer was accepted" by nthn
close date 2014-11-24 17:19:57.074847

Comments

2 Answers

Sort by » oldest newest most voted
6

answered 2014-11-24 16:39:41 +0300

penpen gravatar image

updated 2014-11-24 16:42:20 +0300

ICMP redirects are disabled:

# cat /proc/sys/net/ipv4/conf/all/accept_redirects
0

Thus Jolla should not be vulnerable to double direct ICMP spoofing.

edit flag offensive delete publish link more

Comments

1

Thanks for the fast answer!

Nekron ( 2014-11-24 16:42:03 +0300 )edit
0

answered 2015-01-18 10:03:32 +0300

Tomasz gravatar image

In 1.1.1.27, Vaarainjärvi:

[root@Jolla nemo]# cat /proc/sys/net/ipv4/conf/all/accept_redirects
1

I can ask for a fix it?

edit flag offensive delete publish link more

Comments

echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects

It needs to be redone after reboot, or put in Jolla's startup scripts.

penpen ( 2015-02-04 00:07:20 +0300 )edit

Question tools

Follow
1 follower

Stats

Asked: 2014-11-24 15:55:51 +0300

Seen: 429 times

Last updated: Nov 24 '14