Flaw makes Android phones open to hijacking

Powered by SC Magazine
 

Signatures silently modified.

Researchers say they have found a cryptographic flaw that could allow almost any Android phone to be hijacked.

The undisclosed vulnerabilities allow attackers to silently turn legitimate applications malicious by modifying the apk code without breaking the app's cryptographic signature.

Attackers could exploit the flaw to gain full access to an Android device allowing data theft, access to enterprise networks, or the ability to form a botnet from mobile devices.  

Baseband modified
Baseband modified

 

“The [trojan] application then not only has the ability to read arbitrary application data on the device, retrieve all stored account and service passwords, [but] can essentially take over the normal functioning of the phone and control any function thereof,” BlueBox chief technology office Jeff Forristal said.

“Finally, and most unsettling, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving [and] therefore hard-to-detect nature of these zombie mobile devices to create a botnet.”

Most at risk were devices that ran applications such as Cisco's AnyConnect VPN which were granted special privileges like access to System UID by device manufacturers.

The bug could affect any Android phone released in the last four years or operating firmware above version 1.6 (Donut), Forristal said, declaring 99 percent of devices vulnerable. Google has activated 900 million phones to date.

Forristal said discrepancies in how Android applications were cryptographically verified and installed meant APK code could be modified without breaking the cryptographic signature that checked the legitimacy of Android apps.

“This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been,” Forristal said.

BlueBox reported the bug to Google in February but it would be left to device manufacturers to push out firmware updates, a feat they were notoriously lax in.

He said enterprises should force users to update their phones connected to the corporate network and should move to focus on deep device integrity checking. Individual users should be “extra cautious” in identifying app publishers.

Forristal will release more details at BlackHat Las Vegas this month.

Copyright © SC Magazine, Australia


Flaw makes Android phones open to hijacking
 
 
 
Top Stories
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
What InfoSec can learn from the insurance industry
[Blog post] Another way data breach laws could help manage risk.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  27%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  21%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1051

Vote