Hackers can pwn 'nearly all' Android devices

[Woofiee]

INVASION of the UNDEAD ANDROIDS: Hackers can pwn 'nearly all' devices

Keep calm, stay in the Playpen, it'll all be fine - Google

 

From today's Register.co.uk: 

 

A four-year-old Android bug could be used to plant malware on 99 per cent of Android devices on the market, according to security researchers.

Bluebox Security CTO Jeff Forristal said the vulnerability in Android’s security model creates a means for hackers to modify an Android app's APK code without breaking its cryptographic signature.

 

This means that any legitimate application - even those afforded elevated privileges by the device manufacturer - could be turned into a malicious Trojan before being offered for download. The difference between the two would not be readily detectable by either the smartphone or the app store - much less an end user.

 

The security weakness has been around at least since the release of Android 1.6 (codename: “Donut”) in September 2009, according to Bluebox. It offers the potential for all manner of malfeasance - from data theft (due to elevated privileges of dodgy apps which the phone thinks are legitimate), up to and including the creation of a massive zombie mobile botnet.

 

Bluebox has worked with Google in identifying the issue, which will take a firmware update on affected devices to resolve, as a blog post by the mobile security startup explains.

 

The vulnerability involves discrepancies in how Android applications are cryptographically verified & installed, allowing for APK code modification without breaking the cryptographic signature.

All Android applications contain cryptographic signatures, which Android uses to determine if the app is legitimate and to verify that the app hasn’t been tampered with or modified. This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been.
 

Details of Android security bug 8219321 were responsibly disclosed through Bluebox Security’s close relationship with Google in February 2013. It’s up to device manufacturers to produce and release firmware updates for mobile devices (and furthermore for users to install these updates). The availability of these updates will widely vary depending upon the manufacturer and model in question.

More technical details of the issue, along with related material, are due to be released by to Bluebox as part of Forristal's upcoming presentation at Black Hat USA, which is pencilled in for 1 August.

 

 

 

Noted mobile security experts such as Charlie Miller are taking the issue seriously, while remaining keen to defer judgment pending the release of more information. However there doesn't seem to be an immediate need to put Android smartphones in the nearest available fridge until software updates become available.

 

Tech blog GigaOM notes that Google recently banned Google Play Store apps from updating outside the Play update mechanisms (see Dangerous Products section here). "It has also fixed its Play Store security mechanisms, that should keep most users safe," writes analyst David Meyer in an updated blog post on the issue.

 

So the vulnerability is more of a risk for users who take advantage of third-party Android app marketplaces, a widespread practice. Nonetheless, the flaw is "less dangerous than it initially seemed," Meyer concludes.

 

Righard Zwienenberg, senior research fellow at anti-malware firm ESET, said that getting patches onto phones even after Google pushes out an update promises to become a headache.

 

“The biggest problem for consumers is the enormous number of old phones running Android that are still in use, for which the operators will not release a new version," Zwienenberg said.

 

"I’d estimate that at least a third of phones still run the very popular, but outdated, Gingerbread Android platform. Regardless of whether Google releases patches for these versions, the phones will remain vulnerable. More recent models, like the Samsung Galaxy S3, Galaxy S4 or the HTC One, will most likely be patched. But the question is when? Even if Google is updating the stock Androids, manufacturers and operators also need to be involved to ensure all-round protection," commented Zwienenberg.

 

“Different obfuscation techniques can be deployed to bypass Google Security spotting it and getting malicious code via Play Store on the phone. And once downloaded onto a phone these can create havoc for the user and their phone bill,” he added. ®

 

####

 

So as not to freak anyone out, as long as you don't download pirated apps and get your software right from Google's store, you're likely to be fine. While this exploit is Android specific, all mobile devices have ways of being compromised. Check with the manufacturer of your device for a specific fix, and make sure you're always updated to the latest version of your device's OS. 

[Little Evil]

Sounds like people should be safe as long as you don't install APK's outside of the official Play Store.  Easy enough....although, I was eyeballing the Japanese SSFIV APK that I found online outside of the Play Store. 

 

Edited to say that this type of problem has existed in PC's and Mac for as long as there have been people writing malicious code.  You go install something dodgy, and you run the risk of getting compromised.  Just install from good sources.  

[999Baht]

Lucky for me I only use iOS and possibly windows OS in the future if the Nokia Lumina 1020 that is to be announced in a few days is all I hope it to be.

[Buddy Edgewood]

This not a bug 

 

It is actually a feature within the OS. 

 

Requested by the NSA.

 

[Little Evil]

Looks like it has finally been patched in the more recent versions of Android.  You can check your phone out by downloading this app from the Play store: https://play.google.com/store/apps/details?id=com.bluebox.labs.onerootscanner&feature=search_result#?t=W251bGwsMSwxLDEsImNvbS5ibHVlYm94LmxhYnMub25lcm9vdHNjYW5uZXIiXQ..

[Woofiee]

Looks like it has finally been patched in the more recent versions of Android.  You can check your phone out by downloading this app from the Play store: https://play.google.com/store/apps/details?id=com.bluebox.labs.onerootscanner&feature=search_result#?t=W251bGwsMSwxLDEsImNvbS5ibHVlYm94LmxhYnMub25lcm9vdHNjYW5uZXIiXQ..

 

Just a note: the above link only points to a scanner to see if your phone is affected, but it's not a patch. I don't know Bluebox - does anyone have an idea if they're reputable? 

 

Your patches will only come from the vendor of your phone - not a third party and likely not via the store. Check your Samsung, HTC, Huwai, Nexus, etc site for updates. 

[Little Evil]

Just a note: the above link only points to a scanner to see if your phone is affected, but it's not a patch. I don't know Bluebox - does anyone have an idea if they're reputable? 

 

Your patches will only come from the vendor of your phone - not a third party and likely not via the store. Check your Samsung, HTC, Huwai, Nexus, etc site for updates. 

 

Bluebox was the security firm that brought this flaw to light.  They are a trusted source--nothing shady.  

 

My Nexus 4 & 7 are both still listed as "Unpatched", so I would assume that Samsung, HTC, Moto and others that run skins will also still be unpatched.  Still worth checking for updates via your OEM's website or via Kies with Samsung.  

 

Bottom line is that this is just like any other potential software risk.  Just don't download and install anything shady and you'll have nothing to worry about.  It is a huge security hole, but one that requires the user to trigger the issue by installing malware.