Android bug lets attackers install malware without warning
Google patch cycle puts users at risk
Customer Success Testimonial: Recovery is Everything
It's been more than a month since researchers reported two serious security vulnerabilities in Android, but so far there's no indication when they will be purged from the Google-spawned operating system that's the world's most popular smartphone platform.
The first flaw allows apps to be installed without prompting users for permission. The permission-escalation vulnerability permits attackers to surreptitiously install malware in much the way a proof-of-concept exploit researcher Jon Oberheide published last year did. In that case, an app he planted in the Android Market and disguised as an expansion pack for the Angry Birds game secretly installed three additional apps that without warning monitored a phone's contacts, location information and text messages so data could transmitted to a remote server.
“The Android Market ecosystem continues to be a ripe area for bugs,” Oberheide wrote in an email. “There are some complex interactions between the device and Google's Market servers which has only been made more complex and dangerous by the Android Web Market.”
The second bug resides in the Linux kernel where Android originates and makes it possible for installed apps with limited privileges to gain full control over the device. The vulnerability is contained in code device manufacturer have put into some of Android's most popular handsets, including the Nexus S. The bug undermines the security model Google developers created to contain the damage any one application can do to the overall phone.
Oberheide and fellow researcher Zach Lanier plan to speak more about the vulnerabilities at a two-day training course at the SOURCE conference in Barcelona in November. In the meantime, they put together a brief video showing their exploits in action.
A Google spokesman declined to comment for this post.
One of the hopes for Android a few years back was that it would be a viable alternative to Apple's iOS, both in terms of features and security. With the passage of time, the error of that view is becoming harder to ignore. By our count, Google developers have updated Android just 16 times since the OS debuted in September 2008. The number of iOS updates over the same period is 29.
It's a far cry from the approach Google takes with its Chrome browser, which is updated frequently, and has been known to release fixes for the Flash Player before they're even released by Adobe.
Even more telling, when a new version of iOS is released, it's available almost immediately to any iPhone user with the hardware to support the upgrade. Android users, by contrast, often wait years for their phone carriers to supply updates that fix code execution vulnerabilities and other serious flaws.
Owners of the Motorola Droid, for instance, are stuck running Android 2.2.2 even though that version was released in May 2010 and contains a variety of known bugs that allow attackers to steal confidential data and remotely execute code on handsets the run the outdated version.
Oberheide has more here. ®
COMMENTS
Time for liability?
There really should be a consumer protection law that would punish suppliers who fail to fix vulnerabilities in a reasonable time scale and for, say, 5 years after official "end of life" for buying a product.
Something like liability for all damages, irrespective of the license T&C, if they fail to patch within 1 month of disclosure perhaps?
I'm not just talking about Android, the "new windows" of security, but for ALL software and hardware. And no wiggle room.
Yes it would cost a little, but it would also focus suppliers on releasing decent designs, and not a "ship the crap then forget" model that seems to be today's norm.
@nyelvmark
Well he did say irrespective of the Ts&Cs.
But your license might well not be worth the paper it isn't printed on. If a Judge decides that the terms are not reasonable then they don't stand.
Companies can not right contracts, at least over here they can't, that exempt them from their legal responsibilities.
Now the licenses may well say "tough luck son, you have no rights what so ever except to bend over and take what's coming to you coz we pay mega-buck lawyers - so shut up and pay up" which is what the average licenses agreement says.
But if a judge feels differently...
Occasionally judges do.
Then the big companies get the sort of kick up the arse they normally reserve for their customers.
What a load of fuss about nothing
So he created some malware and managed to get it into Marketplace. Big deal. The problem isn't with Android it's with the verification procedures (if any) in the *Marketplace*.
Fix that and the only people who could be affected by such apps are those who have already chosen to take software from *unverified* sources and put them on their device.
This is like saying that creating a form of petrol which causes cars to explode and managing to sneak it into the storage tanks of a filling station is a "vulnerability in the internal combustion engine". It's not, it's a problem with the security of the filling station.
The same applies to the second so called vulnerability also... the software still has to somehow make it onto your phone in order to "attack" it. Address the channels by which software get's on the phone and the vulnerability disappears.
The comparison with iPhone/iOS concentrates on differences/similarities in the hardware/OS but neglects to address differences in the way the marketplace for apps for the two platforms are administered.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
