Will Verduzco · Dec 11, 2013 at 11:30 pm

Source Code Commits in Android 4.4.2 KOT49H Reveal Flash SMS Attack Fix and App Ops Removal

Just a few hours ago, we talked about how the source code for Android 4.4.2 had made its way into the AOSP. Now, the fine folks over at FunkyAndroid have once again created an exhaustive change log detailing all of the commits made between 4.4.1 and 4.4.2.

Nexus device owners who upgraded from 4.4.1 to 4.4.2 will attest to the small size of the incremental OTA. Accordingly, only four source code commits differentiate the two versions. But never fear, as these changes are actually significant. And if you haven’t already updated, they definitely warrant a few minutes of your time.

Chief among the fixes, 4.4.2 brings a solution to the previously covered low risk Flash SMS vulnerability. Although they went about “fixing” the problem the wrong way initially, we’re glad to see a legitimate solution appear. There is also a fix for the OOBE Denial-of-Service crash after receiving 0-byte WAP push messages, as well as reduced camera logging.

In addition to the fixes, the much loved App Ops program that we covered not too long ago has been further hidden away. As such, it is no longer accessible through the previous means. This change is entirely intentional, as Google always meant to keep the program for internal debugging. As stated by Google Framework Engineer Dianne Hackborn:

 That UI is (and it should be quite clear) not an end-user UI.  It was there for development purposes.  It wasn’t intended to be available.  The architecture is used for a growing number of things, but it is not intended to be exposed as a big low-level UI of a big bunch of undifferentiated knobs you can twiddle.  For example, it is used now for the per-app notification control, for keeping track of when location was accessed in the new location UI, for some aspects of the new current SMS app control, etc.

To get started, make your way over to the FunkyAndroid KOT49E Changelog and check out those commits. The complete (and miniscule) changelog can be found in its entirety at the bottom of this post. What are your thoughts on the update to 4.4.2? Are you glad that Google finally fixed the SMS and OOBE crash bugs? Despite Dianne’s explanation, are you still a little peeved about the further hiding of App Ops? Let us know in the comments below.

[Source FunkyAndroid | Via AndroidPolice]

Full Changelog, as reported by FunkyAndroid:

Project: platform/build

986567d : “KOT49H”
d470407 : “KOT49G”
5de4753 : .1 becomes .2
a7e544d : KOT49F

 

Project: platform/frameworks/opt/telephony

567ea11 : Fix OOBE crash/DoS after receiving 0-byte WAP push.

 

Project: platform/packages/apps/Camera2

3574026 : Reduce logging of flattened Preferences

 

Project: platform/packages/apps/Mms

d00f7cd : Android denial of service attack using class 0 SMS messages

 

Project: platform/packages/apps/Settings

37f06a4 : Put fragment in specific activity’s whitelist


_________
Want something on the XDA Portal? Send us a tip!
Pulser_G2 · Feb 1, 2015 at 11:30 am · no comments

ITaaS – Identity Theft as a Service with FileThis

It's not often I look at a product or service and say "I really really hope this isn't real, and it's an elaborate fake". Alas, this day has come. It's time for a look at something which cropped up on my radar today, namely a service called FileThis. I won't do them the search-engine-ranking honor of providing a direct link to their site, but a quick search will find them, and their app on the Play Store and iTunes store....

XDA NEWS
Emil Kako · Jan 31, 2015 at 02:59 pm · 2 comments

Do You Prefer Physical or on Screen Buttons?

More and more smartphone manufacturers have been moving towards on-screen buttons, with Google really pushing for it over the physical button alternative. However, there are still a few OEMs (we're looking at you, Samsung) that have preferred to keep things a bit more traditional. Tell us which way you prefer and why.

DISCUSS
Pulser_G2 · Jan 31, 2015 at 02:08 pm · 1 comment

New AOSP Branch Details Potential Build System Upgrades?

While there are frequent unexplained changes and pushes to Google's AOSP repositories, an interesting-looking new branch has been pushed out recently, called "master-soong". Taking a look at the changes made to the manifest repository (which is used to specify the repositories to be downloaded when building Android), it appears there are some new repositories making an appearance. Of note here are new prebuilt repositories for Go, and Ninja. Go is a programming language, created by Google, which compiles to produce...

XDA NEWS