Feeds

Using Android 4.3? Don't let malware snatch your private login keys

Bad news: One in ten devices suffer KeyStore flaw. Good news: It's hard to exploit

Providing a secure and efficient Helpdesk

If you're one of the 10.3 per cent of Android users running version 4.3, aka Jelly Bean, your login keys are at risk of theft – thanks to a vulnerability in the operating system's KeyStore software.

KeyStore, as the name suggests, stores a user's cryptographic keys, which are used by apps to log into services without the user having to retype their password.

But IBM researchers have found that the program is vulnerable to a classic stack-based buffer overflow by an attacker who is able to get a dodgy app running on a device. By borking KeyStore, some secure login functions could be accessed and master keys obtained.

The team notes that Google's KeyStore source code contains this harbinger of the vulnerability in the comments: "To keep things simple, buffers are always larger than the maximum space we needed, so boundary checks on buffers are omitted."

Unfortunately, applications can set the size of the data processed, meaning the buffers are not always large enough, and malicious software can therefore inject bytes into the KeyStore app's memory where it shouldn't. From there, the attacking code will try to hijack the flow of execution in KeyStore.

However, before people panic, the IBM advisory does explain that the flaw is a particularly tricky one to exploit.

An attacker would need to write an app that contained malware, convince the user to download and install it, and then evade multiple security defenses – DEP, ASLR and stack cookies – to exploit the buffer overflow and execute code within the KeyStore process. And even then some of the KeyStore information is still protected.

The IBM researchers found the flaw last September and alerted the Android security team privately about the issue. By November a fix was developed for Android 4.4, but not the Jelly Bean build, so the team sat on the problem a while longer before disclosing it.

"Considering Android’s fragmented nature and the fact that this was a code-execution vulnerability, we decided to wait a bit with the public disclosure," said Roee Hay, IBM's application security research team lead, in a blog post about the hole. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.