Flaw makes Android phones open to hijacking

Powered by SC Magazine
 

Signatures silently modified.

Researchers say they have found a cryptographic flaw that could allow almost any Android phone to be hijacked.

The undisclosed vulnerabilities allow attackers to silently turn legitimate applications malicious by modifying the apk code without breaking the app's cryptographic signature.

Attackers could exploit the flaw to gain full access to an Android device allowing data theft, access to enterprise networks, or the ability to form a botnet from mobile devices.  

Baseband modified
Baseband modified

 

“The [trojan] application then not only has the ability to read arbitrary application data on the device, retrieve all stored account and service passwords, [but] can essentially take over the normal functioning of the phone and control any function thereof,” BlueBox chief technology office Jeff Forristal said.

“Finally, and most unsettling, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving [and] therefore hard-to-detect nature of these zombie mobile devices to create a botnet.”

Most at risk were devices that ran applications such as Cisco's AnyConnect VPN which were granted special privileges like access to System UID by device manufacturers.

The bug could affect any Android phone released in the last four years or operating firmware above version 1.6 (Donut), Forristal said, declaring 99 percent of devices vulnerable. Google has activated 900 million phones to date.

Forristal said discrepancies in how Android applications were cryptographically verified and installed meant APK code could be modified without breaking the cryptographic signature that checked the legitimacy of Android apps.

“This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been,” Forristal said.

BlueBox reported the bug to Google in February but it would be left to device manufacturers to push out firmware updates, a feat they were notoriously lax in.

He said enterprises should force users to update their phones connected to the corporate network and should move to focus on deep device integrity checking. Individual users should be “extra cautious” in identifying app publishers.

Forristal will release more details at BlackHat Las Vegas this month.

Copyright © SC Magazine, Australia


Flaw makes Android phones open to hijacking
 
 
 
Top Stories
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
A call for timely reporting
[Blog post] Businesses need incentives to keep customer data secure.
 
Doubts cast on Queensland's ICT Dashboard
Opposition, former Govt CIO say it can't be trusted.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  26%
 
Application integration concerns
  3%
 
Security and compliance concerns
  29%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  5%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 865

Vote