Supercharge your infrastructure

A four-year-old Android bug could be used to plant malware on 99 per cent of Android devices on the market, according to security researchers.

Bluebox Security CTO Jeff Forristal said the vulnerability in Android’s security model creates a means for hackers to modify an Android app's APK code without breaking its cryptographic signature.

This means that any legitimate application - even those afforded elevated privileges by the device manufacturer - could be turned into a malicious Trojan before being offered for download. The difference between the two would not be readily detectable by either the smartphone or the app store - much less an end user.

The security weakness has been around at least since the release of Android 1.6 (codename: “Donut”) in September 2009, according to Bluebox. It offers the potential for all manner of malfeasance - from data theft (due to elevated privileges of dodgy apps which the phone thinks are legitimate), up to and including the creation of a massive zombie mobile botnet.

Bluebox has worked with Google in identifying the issue, which will take a firmware update on affected devices to resolve, as a blog post by the mobile security startup explains.

The vulnerability involves discrepancies in how Android applications are cryptographically verified & installed, allowing for APK code modification without breaking the cryptographic signature.

All Android applications contain cryptographic signatures, which Android uses to determine if the app is legitimate and to verify that the app hasn’t been tampered with or modified. This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been.

Details of Android security bug 8219321 were responsibly disclosed through Bluebox Security’s close relationship with Google in February 2013. It’s up to device manufacturers to produce and release firmware updates for mobile devices (and furthermore for users to install these updates). The availability of these updates will widely vary depending upon the manufacturer and model in question.

More technical details of the issue, along with related material, are due to be released by to Bluebox as part of Forristal's upcoming presentation at Black Hat USA, which is pencilled in for 1 August.

Noted mobile security experts such as Charlie Miller are taking the issue seriously, while remaining keen to defer judgment pending the release of more information. However there doesn't seem to be an immediate need to put Android smartphones in the nearest available fridge until software updates become available.

Tech blog GigaOM notes that Google recently banned Google Play Store apps from updating outside the Play update mechanisms (see Dangerous Products section here). "It has also fixed its Play Store security mechanisms, that should keep most users safe," writes analyst David Meyer in an updated blog post on the issue.

So the vulnerability is more of a risk for users who take advantage of third-party Android app marketplaces, a widespread practice. Nonetheless, the flaw is "less dangerous than it initially seemed," Meyer concludes.

Righard Zwienenberg, senior research fellow at anti-malware firm ESET, said that getting patches onto phones even after Google pushes out an update promises to become a headache.

“The biggest problem for consumers is the enormous number of old phones running Android that are still in use, for which the operators will not release a new version," Zwienenberg said.

"I’d estimate that at least a third of phones still run the very popular, but outdated, Gingerbread Android platform. Regardless of whether Google releases patches for these versions, the phones will remain vulnerable. More recent models, like the Samsung Galaxy S3, Galaxy S4 or the HTC One, will most likely be patched. But the question is when? Even if Google is updating the stock Androids, manufacturers and operators also need to be involved to ensure all-round protection," commented Zwienenberg.

“Different obfuscation techniques can be deployed to bypass Google Security spotting it and getting malicious code via Play Store on the phone. And once downloaded onto a phone these can create havoc for the user and their phone bill,” he added. ®

5 ways to prepare your advertising infrastructure for disaster