Android vulnerability allowed for PNG files to execute malware

Android vulnerability allowed for PNG files to execute malware
With smartphones becoming a central hub for our lives and being used for financial transactions on a daily basis, hackers are always looking for ways to gain access to them so they can be used for nefarious purposes like stealing personal data, credit card numbers and so on. This is why it is so important for smartphones to receive regular security updates and for the operating system’s developers to find vulnerabilities and fix them as soon as possible.

Luckily, this was the case with a newly discovered potential point for exploits found by the Android security team. It was quite an unusual one too. According to the latest Android Security Bulletin, the vulnerability “could allow a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process”.

Now let’s break it down. PNG files, for those unfamiliar with the format, are used for images or photos and are commonly used because of the better way they handle compression compared to JPG files. This means they are easily shareable between users through various messaging apps. According to the report, it was possible for a proficient enough coder to attach code to the image file that would be executed once the user opens it. The code would also be able to access the main processes of the operating system and potentially change them in a way that is beneficial for the attacker.

If that sounds scary, it’s because it is. Unauthorized root access to a device can cause all sorts of trouble for the user. Luckily, the issue was found before any reports of the vulnerability being put to practical use came in and a fix is being provided with the latest security patch for Android. Security updates dated 2019-02-05 or later include the fix for this vulnerability.

Of course, the security team isn’t releasing any specific information about how the exploit could work, making sure owners of devices that receive security updates slower are as safe as possible.

FEATURED VIDEO

13 Comments

1. RebelwithoutaClue

Posts: 5473; Member since: Apr 05, 2013

Might want to change the PGN to PNG in the title ;)

2. Panzer

Posts: 270; Member since: May 13, 2016

Per the report "The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed." First you have unlock your bootloader to get even think about root privileges. Then you install a custom recovery, then flash a specific super user program. Then you would have to stupidly allow all root privileges without asking (default is to ask). Then you would have find one of these pngs in the wild. Unless I am reading this wrong the chances of this affecting anyone is none unless you are really stupid.

3. clarity

Posts: 49; Member since: Jun 19, 2017

You can have root privileges without unlocking the bootloader. That's the principle of "jailbreaking".

6. Panzer

Posts: 270; Member since: May 13, 2016

Curious which devices allow this. I have rooted Nexus devices LG G2 to G4, a few Samsungs, a Sony an Umi. Always had unlock bootloader to get custom recovery to the flash the SU. If the devs at XDA can't get root on carrier Samsung devices I highly doubt this bug is going to get root access.

8. clarity

Posts: 49; Member since: Jun 19, 2017

On the lg g2 and g3, you don't need to unlock the bootloader to root. LG G2 and LG G3 have a bootloader bug that allows you to run unsigned images.

9. Panzer

Posts: 270; Member since: May 13, 2016

Thank you was not aware of that exploit. Marshmallow and beyond changes to SE Linux made it much more difficult to obtain root. If the system does not warn you have root many apks check for root and will not work. My bank and Netflix are examples. You would have to hide root from them. You have a better chance of winning the lottery then this being an issue. https://www.xda-developers.com/a-look-at-marshmallow-root-verity-complications/

12. ullokey

Posts: 172; Member since: Jul 28, 2015

Jailbreaking on Android phones?

13. clarity

Posts: 49; Member since: Jun 19, 2017

the act of breaking the software security of a device is called jailbreaking.

4. tangbunna

Posts: 433; Member since: Sep 29, 2016

what is Candle Compression? new melting technology?

5. civicsr2cool

Posts: 245; Member since: Oct 19, 2016

So.. Root on US Samsung phones when???

7. 7thlvl

Posts: 33; Member since: Dec 09, 2018

Right, thats what I was thinking.

10. obedchuni

Posts: 307; Member since: Jun 16, 2014

Root on Samsung non us phone? I was thinking

11. Leo_MC

Posts: 6132; Member since: Dec 02, 2011

wicked, you understand now why I can't use an Android device without support?

Latest Stories

This copy is for your personal, non-commercial use only. You can order presentation-ready copies for distribution to your colleagues, clients or customers at https://www.parsintl.com/phonearena or use the Reprints & Permissions tool that appears at the bottom of each web page. Visit https://www.parsintl.com/ for samples and additional information.