TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

A Hidden Flaw that Will Crash Apps on Android M

22 点作者 ontoillogical将近 10 年前

1 comment

NateLawson将近 10 年前
Hi, I&#x27;m the founder of SourceDNA. We&#x27;ve built an index of the code in iOS and Android apps to quickly answer questions like this about how they were built.<p>TLDR; we created a tool that lets you just search for an app and see if it&#x27;s affected.<p><a href="https:&#x2F;&#x2F;searchlight.sourcedna.com&#x2F;search" rel="nofollow">https:&#x2F;&#x2F;searchlight.sourcedna.com&#x2F;search</a><p>In this case, the Android NDK does not include OpenSSL and considers it a private API, so developers have had to come up with their own approach. The correct one is to statically link your native extension with your own copy of OpenSSL or include a dynamic (.so) copy of it in your APK. But some developers were retrieving the library from a random Android device to link against, but then relying on the OS to provide exactly those same symbols.<p>Even more painful is that native libraries that were pulled into your project by some <i>other</i> dependency can also cause the same issue. For example, Baidu&#x27;s push messaging plugin depends on OpenSSL for crypto, so you wouldn&#x27;t even know you were affected by this problem just by using it.<p>Affected apps will continue to work fine until run on the newest Android devices with Android M, such as the Galaxy S6, Note 4, and Nexus.<p>We scanned our index for apps that had native code, matched each app&#x27;s binaries against libcrypto.so and libssl.so, and built a graph of each dependency linkage. Then we could trace the graph to find apps that had this flaw and exactly which of their libraries was at fault.