Feeds

INVASION of the UNDEAD ANDROIDS: Hackers can pwn 'nearly all' devices

Keep calm, stay in the PlayPen, it'll all be fine - Google

Beginner's guide to SSL certificates

A four-year-old Android bug could be used to plant malware on 99 per cent of Android devices on the market, according to security researchers.

Bluebox Security CTO Jeff Forristal said the vulnerability in Android’s security model creates a means for hackers to modify an Android app's APK code without breaking its cryptographic signature.

This means that any legitimate application - even those afforded elevated privileges by the device manufacturer - could be turned into a malicious Trojan before being offered for download. The difference between the two would not be readily detectable by either the smartphone or the app store - much less an end user.

The security weakness has been around at least since the release of Android 1.6 (codename: “Donut”) in September 2009, according to Bluebox. It offers the potential for all manner of malfeasance - from data theft (due to elevated privileges of dodgy apps which the phone thinks are legitimate), up to and including the creation of a massive zombie mobile botnet.

Bluebox has worked with Google in identifying the issue, which will take a firmware update on affected devices to resolve, as a blog post by the mobile security startup explains.

The vulnerability involves discrepancies in how Android applications are cryptographically verified & installed, allowing for APK code modification without breaking the cryptographic signature.

All Android applications contain cryptographic signatures, which Android uses to determine if the app is legitimate and to verify that the app hasn’t been tampered with or modified. This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been.

Details of Android security bug 8219321 were responsibly disclosed through Bluebox Security’s close relationship with Google in February 2013. It’s up to device manufacturers to produce and release firmware updates for mobile devices (and furthermore for users to install these updates). The availability of these updates will widely vary depending upon the manufacturer and model in question.

More technical details of the issue, along with related material, are due to be released by to Bluebox as part of Forristal's upcoming presentation at Black Hat USA, which is pencilled in for 1 August.

Noted mobile security experts such as Charlie Miller are taking the issue seriously, while remaining keen to defer judgment pending the release of more information. However there doesn't seem to be an immediate need to put Android smartphones in the nearest available fridge until software updates become available.

Tech blog GigaOM notes that Google recently banned Google Play Store apps from updating outside the Play update mechanisms (see Dangerous Products section here). "It has also fixed its Play Store security mechanisms, that should keep most users safe," writes analyst David Meyer in an updated blog post on the issue.

So the vulnerability is more of a risk for users who take advantage of third-party Android app marketplaces, a widespread practice. Nonetheless, the flaw is "less dangerous than it initially seemed," Meyer concludes.

Righard Zwienenberg, senior research fellow at anti-malware firm ESET, said that getting patches onto phones even after Google pushes out an update promises to become a headache.

“The biggest problem for consumers is the enormous number of old phones running Android that are still in use, for which the operators will not release a new version," Zwienenberg said.

"I’d estimate that at least a third of phones still run the very popular, but outdated, Gingerbread Android platform. Regardless of whether Google releases patches for these versions, the phones will remain vulnerable. More recent models, like the Samsung Galaxy S3, Galaxy S4 or the HTC One, will most likely be patched. But the question is when? Even if Google is updating the stock Androids, manufacturers and operators also need to be involved to ensure all-round protection," commented Zwienenberg.

“Different obfuscation techniques can be deployed to bypass Google Security spotting it and getting malicious code via Play Store on the phone. And once downloaded onto a phone these can create havoc for the user and their phone bill,” he added. ®

Internet Security Threat Report 2014

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.