Don't downplay the 'master key' Android bug, researcher says

The CTO who disclosed the "master key" Android vulnerability which allows miscreants to quietly infect legitimate apps has presented follow-up research that reinforced how exposed users are to the threat.

At last week's Black Hat conference in Las Vegas, Jeff Forristal, CTO of Bluebox Security, warned that the bug impacting 99 percent of Android devices shouldn't be downplayed under the assumption that users know better than to download apps from untrusted sources. 

He revealed that 69 percent of Android users, drawn from a sample of those in Bluebox's network, permitted app downloads from unofficial online sites. According to Forristal, the users didn't employ an Android setting on their phones that blocked app downloads from “untrusted sources.”

The finding was particularly relevant because the master key vulnerability, which was disclosed last month, allows an attacker to weaponize any clean app without altering its cryptographic signature. Modifying this digital signature serves as a red flag that an app has been tampered with.

And last Friday, Trend Micro spotted the master key flaw leveraged in a trojan banking app distributed by the popular South Korean NH Nonghyup Bank. 

Criminals had produced a trojanised update for the app hosted on third party websites and also delivered a malicious version for those users seeking to install the app for the first time. 

"Should the user comply, their information would be sent to a remote malicious server controlled by the cybercriminal," mobile security engineer Peter Van said.

"This particular finding shows just how dangerous the abuse of the master key vulnerability is to Android users. The fact that it was used to 'trojanise' a banking app makes the risk comparable to the online banking threats we know today, as it poses not just the risk of personal information leakage, but financial loss as well."

In late July, Symantec researchers discovered the first signs of the bug being exploited in the wild when attacker infected popular games and other apps found in third-party marketplaces in China.

The flaw allowed attackers to remotely control victims' phones, send premium SMS messages and disable security software on the device, all by implanting legitimate apps with malicious code.

Forristal said Bluebox's poll, which analyzed around 250,000 Android devices in its network, showcased how prevalent the threat still is to users.

"This is an even bigger problem than those Android experts think it is,” Forristal told Black Hat attendees on Thursday.

Further, Forristal said other flaws exist that give attackers similar “master key” privileges. He has noted other members of the master key vulnerability “family,” including findings from other researchers who discovered additional bugs.

Google currently has patches for the vulnerability discovered by Bluebox, along with two others said to achieve similar app takeovers (#9695860 and #8219321).

- With Darren Pauli.