80% of Android phones also susceptible to the Linux TCP bug

[Bob]

Another issue hits Android - phones and tablets - a TCP flaw in which the way the RFC 5961 standard is implemented in the Linux kernel. Mitigating against the flaw for unpatched Android devices includes encrypting communications, and using virtual private networks (VPNs)

https://projectavalon.net/forum4/show...=1#post1088979

See the above post for the writeup by Herve' on the Linux computer issue. This post is covering the Linux bug and how it affects Android users running Android 4.4 KitKat and later.

Android OS which uses the affected Linux kernel 3.6 or newer can be potentially compromised.

According to recent statistics, the number of devices affected might run past 1.4 billion phones and tablets -- including devices running the Android Nougat developer preview. Windows and Mac (iPhones/iPad) phones are not affected.

If an attacker can pull off an exploit, they could inject malicious code into unencrypted web traffic from "anywhere". However, the source and destination IP address would need to be known in order to intercept the traffic, adding to the complexity of carrying out a successful attack.

This kind of attack could be used to degrade a privacy and anonymity service, like Tor.

A patch for Linux was issued on July 11, but was not available in time for the latest Android monthly patching schedule.

ZDNet - http://www.zdnet.com/article/linux-t...hones-tablets/

ArsTechnica - http://arstechnica.com/security/2016...cking-attacks/

Off-path attack means malicious hackers can be located anywhere on the Internet.

To make the attack work, the adversary must first spend about 10 seconds to test whether two specific parties—say a known Android user and USA Today—are connected. It then takes another 45 seconds or so to inject malicious content into their traffic.

The time required probably makes it impractical to carry out opportunistic attacks that hit large numbers of people.

Still, the technique appears well suited for targeted attacks, in which the adversary—say, a stalker or a nation-backed surveillance agency—is attempting to infect or spy on a specific individual, especially when the hacker knows some of the sites frequented by the target.

A Google representative said company engineers are already aware of the vulnerability and are "taking the appropriate actions.

Be sure to UPDATE your ANDROID OS PHONE when the patch becomes available.