Google's Android Has a Fake-ID Problem
By Dune Lawrence July 29, 2014
Google’s Android operating system has a security flaw
that could allow hackers to impersonate trusted applications and potentially
hijack your phone or tablet, according to research released today.
The basic issue is the way in which Android checks—or
rather, does not check—that certain applications are what they say they are,
according to Bluebox Security, the company that identified the vulnerability.
Hence the catchy name, “Fake ID.”
Verifying identity is one of the most fundamental issues
online. Is someone logging into a bank account the owner of that account? Is an
application what it claims to be? San Francisco-based Bluebox helps companies
secure their data on mobile devices, and its staff members work to research and
understand the architecture of the mobile operating systems that Bluebox builds
onto, says Jeff Forristal, chief technology officer.
Each Android application has its own digital signature—an
ID card, in essence. Adobe Systems (ADBE), for example, has a specific
signature on Android, and all programs from Adobe have an ID that’s based on
that signature. Bluebox discovered that when an application flashes an Adobe
ID, for example, Android does not check back with Adobe that it’s an authentic
one. That means that a malicious actor could create malware based on Adobe’s
signature and infect your system. The problem isn’t specific to Adobe; a hacker
could create a malicious application that impersonates Google Wallet and then
access payment and financial data. The same issue applies to administrative
software present on some devices, allowing full control of the entire system.
“We basically discovered a way to create fake ID cards,”
says Forristal. “There are different vectors. They all come down to: I can
create a fake ID card. The question is, which fake ID card do I create?”
The flaw affects Android systems from 2.1 (released in
January 2010) on up, though the latest version, 4.4 or KitKat, has closed the
hole as it relates to Adobe, according to Bluebox. To give an idea of scale:
From 2012 to 2013, about 1.4 billion new devices shipped with the Android
operating system, according to Gartner. Gartner (IT) estimates that 1.17
billion additional Android devices will ship this year.
The revelation of this particular vulnerability
illustrates how security researchers and Google handle the discovery of flaws
in software or programs. It also shows the complexity of handling a
vulnerability affecting Android because fixes require adjustments from not only
Google but also from various app developers and device makers.
Bluebox concluded its research in late March and
submitted the bug to Google by March 31, according to Forristal. The Android
security team developed a fix in April and provided the patch to vendors, who
had 90 days to implement it before Bluebox publicized its findings, he says.
Bluebox has tested about 40 Android-based devices out of more than 6,300 in the
market. So far the company knows of only one vendor that has put a patch out,
he adds.
Google did not respond to an e-mailed request for
comment.
Bluebox plans to discuss its findings at the Black Hat
convention in Las Vegas next week. Expect a lot more troubling security news
before then. Black Hat tends to bring it out.
Comments
Post a Comment