Feeds

INVASION of the UNDEAD ANDROIDS: Hackers can pwn 'nearly all' devices

Keep calm, stay in the PlayPen, it'll all be fine - Google

SANS - Survey on application security programs

A four-year-old Android bug could be used to plant malware on 99 per cent of Android devices on the market, according to security researchers.

Bluebox Security CTO Jeff Forristal said the vulnerability in Android’s security model creates a means for hackers to modify an Android app's APK code without breaking its cryptographic signature.

This means that any legitimate application - even those afforded elevated privileges by the device manufacturer - could be turned into a malicious Trojan before being offered for download. The difference between the two would not be readily detectable by either the smartphone or the app store - much less an end user.

The security weakness has been around at least since the release of Android 1.6 (codename: “Donut”) in September 2009, according to Bluebox. It offers the potential for all manner of malfeasance - from data theft (due to elevated privileges of dodgy apps which the phone thinks are legitimate), up to and including the creation of a massive zombie mobile botnet.

Bluebox has worked with Google in identifying the issue, which will take a firmware update on affected devices to resolve, as a blog post by the mobile security startup explains.

The vulnerability involves discrepancies in how Android applications are cryptographically verified & installed, allowing for APK code modification without breaking the cryptographic signature.

All Android applications contain cryptographic signatures, which Android uses to determine if the app is legitimate and to verify that the app hasn’t been tampered with or modified. This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been.

Details of Android security bug 8219321 were responsibly disclosed through Bluebox Security’s close relationship with Google in February 2013. It’s up to device manufacturers to produce and release firmware updates for mobile devices (and furthermore for users to install these updates). The availability of these updates will widely vary depending upon the manufacturer and model in question.

More technical details of the issue, along with related material, are due to be released by to Bluebox as part of Forristal's upcoming presentation at Black Hat USA, which is pencilled in for 1 August.

Noted mobile security experts such as Charlie Miller are taking the issue seriously, while remaining keen to defer judgment pending the release of more information. However there doesn't seem to be an immediate need to put Android smartphones in the nearest available fridge until software updates become available.

Tech blog GigaOM notes that Google recently banned Google Play Store apps from updating outside the Play update mechanisms (see Dangerous Products section here). "It has also fixed its Play Store security mechanisms, that should keep most users safe," writes analyst David Meyer in an updated blog post on the issue.

So the vulnerability is more of a risk for users who take advantage of third-party Android app marketplaces, a widespread practice. Nonetheless, the flaw is "less dangerous than it initially seemed," Meyer concludes.

Righard Zwienenberg, senior research fellow at anti-malware firm ESET, said that getting patches onto phones even after Google pushes out an update promises to become a headache.

“The biggest problem for consumers is the enormous number of old phones running Android that are still in use, for which the operators will not release a new version," Zwienenberg said.

"I’d estimate that at least a third of phones still run the very popular, but outdated, Gingerbread Android platform. Regardless of whether Google releases patches for these versions, the phones will remain vulnerable. More recent models, like the Samsung Galaxy S3, Galaxy S4 or the HTC One, will most likely be patched. But the question is when? Even if Google is updating the stock Androids, manufacturers and operators also need to be involved to ensure all-round protection," commented Zwienenberg.

“Different obfuscation techniques can be deployed to bypass Google Security spotting it and getting malicious code via Play Store on the phone. And once downloaded onto a phone these can create havoc for the user and their phone bill,” he added. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.