Android

99% of Android devices can be completely 'taken over' through a massive vulnerability hole

posted by Chris P. / Jul 04, 2013, 9:11 AM

99% of Android devices can be completely 'taken over' through a massive vulnerability hole

Ouch! Let us reiterate: that one ought to sting. Especially after the latest report already putting Android up there as the most compromised and targeted mobile OS.

Mobile security start-up, Bluebox, has released a statement on their blog that they have discovered a vulnerability in Android's security model, allowing hackers to slip malicious code into Android devices unnoticed by your phone's built-in defensive mechanism.

The scope of this vulnerability? 99%, or about 900 million Android devices. Nope, no typo there, according to the company, which first notified Google of the threat in February this year. Apparently, the vulnerability goes back all the way to Android 1.6 “Donut”, or any Android device released in the last 4 years.

Spooky, but in a typical horror movie fashion, we want to know more:

“The vulnerability involves discrepancies in how Android applications are cryptographically verified & installed, allowing for APK code modification without breaking the cryptographic signature.”

A screenshot by Bluebox demonstrates complete control over the OS

If mobile security isn't your strongest suit, here's a breakdown of how it works. Cryptographic signatures are a part of any and all Android apps, their use – to help your droid verify whether the app is legit and if any tampering of the code has taken place. Further spelling it out for us, Bluebox asserts that the glitch allows the not-too-nice folks out there to change app code “without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been.”

To put this into perspective, the statement claims, apart from the usual Trojan mischief (think SMS tolls), a malicious app taking massive advantage of the hole:

“Has the ability to read arbitrary application data […], retrieve all stored account & service passwords […], make arbitrary phone calls, send arbitrary SMS messages, turn on the camera, record calls,”

How serious can this get? We don't know, but it's comforting to know that Google is aware of the issue and has already updated their Google Play approval process, blocking out apps with this problem.

Bluebox CTO, Jeff Forristal, announced that he will cover the issue in technical detail in his upcoming Black Hat USA 2013 talk.

source: BlueBox via VentureBeat

FEATURED VIDEO

Options

38 Comments

1. chunk1x

Posts: 248; Member since: Jun 25, 2011

For android fans, they called this problem a YOLO.

posted on Jul 04, 2013, 9:17 AM 13

10. SuperAndroidEvo

Posts: 4888; Member since: Apr 15, 2011

There is NOTHING that is hack proof. The US Government can be hacked, Verizon, AT&T, Android, Apple & anything under the sun. I always find these articles just so pointless. Just so we know boys & girls.... if you are on the web or if you own a computer or smartphone there is a HUGE vulnerability hole to everything. That includes all the goverments of the world. It's like every week the same article is written but with different titles. lol

posted on Jul 04, 2013, 9:41 AM 19

13. chunk1x

Posts: 248; Member since: Jun 25, 2011

The problem with hardcore fans of all sides is that take a silly joke way to seriously.

posted on Jul 04, 2013, 9:49 AM 3

16. alterecho

Posts: 1106; Member since: Feb 23, 2012

Wonder what some replys would have been if it were Apple that was affected.

posted on Jul 04, 2013, 10:09 AM 2

17. chunk1x

Posts: 248; Member since: Jun 25, 2011

In that iOS camp, denial and end of the world state of mind for iFans. Then followed by angry mob with pitch forks and torches to the unlucky prankster.

posted on Jul 04, 2013, 10:17 AM 2

26. Jobayer

Posts: 167; Member since: Feb 22, 2013

Dude, if u find them pointless, dont read them . Yes nothing is hack proof .But the problem is there for 4 yrs !!!

posted on Jul 04, 2013, 12:45 PM 1

39. SuperAndroidEvo

Posts: 4888; Member since: Apr 15, 2011

The reason why I find these articles pointless is because they are CLEARLY stating the obvious. It's like saying humans die if they don't breathe air. We all know that anything computer related can be hacked yet we consistently keep reading the same article with just a different title. Tell us something we don't know. Also buddy please get a clue. lol

posted on Jul 05, 2013, 8:04 AM 0

2. RaKithAPeiRiZ

Posts: 1488; Member since: Dec 29, 2011

app data and payment records? ..if they hack mine ,all they will find is a phone full of pirated apps

posted on Jul 04, 2013, 9:19 AM 8

4. grahaman27

Posts: 364; Member since: Apr 05, 2013

Pirated apps is where malicious code can come from.

posted on Jul 04, 2013, 9:23 AM 11

12. SuperAndroidEvo

Posts: 4888; Member since: Apr 15, 2011

Yeah that phone of his is the dirtiest virus/malware phone on Earth. I hope he at least practices safe sex. lol +1

posted on Jul 04, 2013, 9:45 AM 2

5. amansingal14

Posts: 309; Member since: Sep 08, 2012

lol +1

posted on Jul 04, 2013, 9:23 AM 3

8. SonyXperiaNexus

Posts: 374; Member since: Oct 01, 2012

lol, but they can still get your passwords, record your phonecalls, read and send sms and use the camera to see what ur doing, pretty scary if u ask me

posted on Jul 04, 2013, 9:31 AM 3

18. feres13

Posts: 307; Member since: Dec 23, 2011

I hope that by "pirated apps" you mean apps that aren't from the Play store, not paid apps from the Play store that you got for free

posted on Jul 04, 2013, 10:17 AM 0

28. Shatter

Posts: 2036; Member since: May 29, 2013

By pirated he means he downloaded paid apps for free.

posted on Jul 04, 2013, 1:05 PM 4

3. grahaman27

Posts: 364; Member since: Apr 05, 2013

As of right now there is no reason to fear getting malware on your phone if you use your phone like 99% of people do.

posted on Jul 04, 2013, 9:21 AM 5

6. RaKithAPeiRiZ

Posts: 1488; Member since: Dec 29, 2011

there is nothing to worry because the NSA's already taking care of it

posted on Jul 04, 2013, 9:27 AM 2

7. boosook

Posts: 1442; Member since: Nov 19, 2012

Come on... this happens only if you install malicious apps downloaded from outside the market, so it will affect only a minority of users which implicitly accept the risk. That's not 99% of Android users. Anyway I agree that this is a nasty bug.

posted on Jul 04, 2013, 9:30 AM 7

9. SonyXperiaNexus

Posts: 374; Member since: Oct 01, 2012

http://cdn.meme.li/instances/300x300/39412914.jpg

posted on Jul 04, 2013, 9:38 AM 1

11. Samsomesh

Posts: 195; Member since: Jun 11, 2012

Google should introduce it's own antivirus that will have access to all the system..:

posted on Jul 04, 2013, 9:43 AM 0

14. medicci37

Posts: 1361; Member since: Nov 19, 2011

Every time I play wwf last 2 days a very annoying add 4 a new movie keeps playing. & sometimes when I'm not. Anyone know how 2 stop this?

posted on Jul 04, 2013, 9:55 AM 0

15. darkkjedii

Posts: 30875; Member since: Feb 05, 2011

Android fanboys call this innovation. Android users realize this is an issue.

posted on Jul 04, 2013, 9:57 AM 8

22. grahaman27

Posts: 364; Member since: Apr 05, 2013

Its not an issue, its an exploit. to say its an issue is like someone saying that being able to jailbreak an iphone is an issue. this is not a virus, this is one exploit. iOS can have the same problem just an FYI.

posted on Jul 04, 2013, 10:42 AM 11

25. darkkjedii

Posts: 30875; Member since: Feb 05, 2011

It has had it. FYI

posted on Jul 04, 2013, 11:34 AM 2

36. blingblingthing

Posts: 912; Member since: Oct 23, 2012

It isn't an issue for any tech savvy person, stick to legit sources and stay safe.

posted on Jul 04, 2013, 9:28 PM 2

19. ama3654

Posts: 295; Member since: Nov 27, 2012

You forgot to mention Galaxy S4 is immune to it. "Bluebox claims that it notified Google of the exploit in February. According to CIO, Bluebox CTO Jeff Forristal has named the Galaxy S 4 as the only device that's currently immune to the exploit " .http://www.engadget.com/2013/07/04/bluebox-reveals-android-security-vulnerability/

posted on Jul 04, 2013, 10:20 AM 3

21. FISTFLY

Posts: 27; Member since: Jul 03, 2013

Does it mention why only Galaxy 4?? Just curious

posted on Jul 04, 2013, 10:29 AM 0

32. tedkord

Posts: 17181; Member since: Jun 17, 2009

Its a known issue. Samsung patched it prior to release.

posted on Jul 04, 2013, 3:54 PM 2

20. vickygamit

Posts: 51; Member since: Aug 16, 2012

google will fix it.

posted on Jul 04, 2013, 10:29 AM 0

23. Kjayhawk

Posts: 294; Member since: Oct 07, 2010

This MASSIVE vulnerability is just the security companies trying to scare you. It can't be found on the play store only through apps that you download from a third party source. Which google tells you specifically that downloading from third party stores can greatly increase your chance of malware. No News here