Linux za Sve forum

bertone je napisao/la:Pa to je zapravo super... ne kako kažeš za mobitel ali recimo raditi u GiMP-u na tabletu od 10" (ili većem) sa stylusom vrlo korisno i praktično

A security vulnerability has been discovered on the Ubuntu Phone. We take security very seriously, and want to provide clear information as to what happened; and what steps have been taken to rectify the issue and protect against future similar incidents.

At this point, we believe that the core issue has been addressed. An app which exploited the issue has been removed; the 15 people who installed that app have been contacted; and a fix for all Ubuntu Phone users will be released shortly. Users of Ubuntu on the desktop, server, cloud and snappy Ubuntu Core devices are not affected.

Summary

At 2015 Oct 14 22:50 UTC a member of the Ubuntu App Developer Community published a post about an app named “test.mmrow” in the Ubuntu Phone’s Software Store that exploited a previously unknown bug in the application installation system. Upon clicking the “Tap me” button in the app, a script was created that modified the boot splash screen, and gave the intruder root access. This could happen only on Ubuntu Phones; users of Ubuntu on the desktop, server, cloud and snappy Ubuntu Core devices are not affected.

Canonical engineers started investigating and taking preventative actions shortly after. Specifically, a root cause analysis was started to understand the exploit, and by 2015 Oct 15 00:50 UTC uploads and downloads from the store were temporarily disabled while the team addressed the issue. A fix was issued for the core issue was available by 2015 Oct 15 04:23 UTC, all the apps in the store have been scanned to ensure that no other apps exploited the same security hole. The store has been re-enabled. Additionally, a full update is being prepared for all Ubuntu Phone users to address the underlying issue.

Users that have downloaded and installed the “test.mmrow” app and triggered a “Tap me!” button could have been affected. A total of 15 users, two of which are Canonical employees involved in the early investigation stages, downloaded the “test.mmrow” app from the store. These 15 users have been alerted via email that the “test.mmrow” app may be malicious and they were advised to uninstall the app immediately. We continue to follow up individually with those individuals to ensure their phones are protected.

Analysis

The app used flaws in the click installation code to generate unconfined security policy for the app on end user devices. The offending app was then able to create a shell script that has the ability to elevate its privileges to the root user and extract a tar file that contains images that are flashed when the phone is rebooted into recovery mode.

The Ubuntu App Store uses automated review tools to determine if apps are safe for automatic upload. If apps attempt to use a non-standard confinement template, they are marked for manual review. The offending app was constructed in a way that made it look like it used a standard confinement template, but it specified an unconfined template in the alternate directory, and it passed the automated review checks.

The exploit used should have been detected in two places. The click app review tools should detect that the click app includes files that are only meant to be generated as part of the click app installation process. In addition, the click program should have ignored those files, even if present during installation. Both of these have now been addressed and updates will be pushed to all Ubuntu phone devices soon.

Canonical will provide further information on this issue as and when it is available.

Ubuntu device convergence is now starting to happen as we move closer to bringing the first smartphones to market carrying a full Ubuntu desktop interface.

The real test for a smartphone which can double up as a PC is to give users the same experience from their smartphone as they get from their primary PC. This is our starting point for real smartphone convergence – to deliver an Ubuntu PC experience that embodies everything already familiar to the millions of Ubuntu desktop PC users worldwide. Quite simply, this means everything that a user expects from a PC experience has to be available from their smartphone including:

Effortless multitasking and window management

Full range of desktop applications and thin client support for mobility and productivity

Integrated services with desktop notifications

Ability to manage applications and easily organise favoured ones for fast access

Simple file browsing, file and folder creation and management

Responsive applications developed for both touch and point/click input and which re-shape to whichever UI is being displayed

Comprehensive system control and access to the underlying OS if required

Single application store with a range of compatible 3rd party services

Communication from the desktop interface using the phone’s telephony and messaging applications

Our journey towards OS convergence first begins with Unity 8, Ubuntu’s User Interface and display framework, envisioned to run on all Ubuntu devices with the same underlying codebase, supporting a common infrastructure for application and service development. The goal for Unity 8 is to run as the primary display on any type of Ubuntu smart product.

This means applications have something no other OS can provide: a single, visual framework and set of tools for applications to run on any type of Ubuntu smart device. Applications developed for mobile will easily scale and run on a desktop display, with support for point and click input. Our SDK will provide tools for developers of mobile applications to build desktop contexts for these apps. Similarly, developers of desktop applications can use our SDK to extend and enhance their application for mobile use. Convergence brings a whole new set of contexts for developers and our SDK will provide the fundamental tools developers need to make their apps easy to adapt and run on any display.

When you see your application on the phone and then use that application on the desktop, it is the exact same code running each application. Ubuntu does not need to know if the app is coded for a mobile or desktop display rather it is the application that surfaces the appropriate interface depending on which display is required. Third party developers will be able to easily create new Ubuntu applications which only need to be developed once but which can be available and used across all Ubuntu interfaces.

We have been saying for some time that the evolution of the smartphone into a convergent form factor, delivering a PC experience, is a real and relevant industry need. However a truly converged smartphone or tablet designed with the combination of mobility and desktop productivity is only really achieved using an OS built on a single, fully contained codebase.