Black Hat: Don't assume safety from "master key" Android vulnerability

Share this article:
The bug is a major threat, especially since a majority of Android users disable security features.
The bug is a major threat, especially since a majority of Android users disable security features.

The CTO who disclosed the "master key" Android vulnerability, which allows miscreants to invisibly infect any legitimate app, has presented follow-up research that reinforced how exposed users are to the threat.

At last week's Black Hat conference in Las Vegas, Jeff Forristal, CTO of Bluebox Security, warned that the bug impacting 99 percent of Android devices shouldn't be downplayed under the assumption that users know better than to download apps from untrusted sources.

He revealed that 69 percent of Android users, drawn from a sample of those in Bluebox's network, permitted app downloads from unofficial online sites. According to Forristal, the users didn't employ an Android setting on their phones that blocked app downloads from “untrusted sources.”

The finding was particularly relevant because the master key vulnerability, which was disclosed last month, allows an attacker to weaponize any clean app without altering its cryptographic signature. Modifying this digital signature serves as a red flag that an app has been tampered with.

In late July, Symantec researchers discovered the first signs of the bug being exploited in the wild when attacker infected popular games and other apps found in third-party marketplaces in China.The flaw allowed attackers to remotely control victims' phones, send premium SMS messages and disable security software on the device, all by implanting legitimate apps with malicious code.

Forristal said Bluebox's poll, which analyzed around 250,000 Android devices in its network, showcased how prevalent the threat still is to users.

"This is an even bigger problem than those Android experts think it is,” Forristal told Black Hat attendees on Thursday.

Further, Forristal said other flaws exist that give attackers similar “master key” privileges. He has noted other members of the master key vulnerability “family,” including findings from other researchers who discovered additional bugs.

Google currently has patches for the vulnerability discovered by Bluebox, along with two others said to achieve similar app takeovers (#9695860 and #8219321).

Share this article:

Sign up to our newsletters

More in News

Report: SQL injection a pervasive threat, behavioral analysis needed

Report: SQL injection a pervasive threat, behavioral analysis ...

Long lag times between detection and resolution and reliance on traditional methods impair an organization's ability to combat SQL injection attacks.

WhatsApp bug allows for interception of shared locations

Researchers identified a vulnerability in WhatsApp that could enable an attacker to intercept shared locations using a man-in-the-middle attack, or a rogue access point.

Google tweaks its terms of service for clarity on Gmail scanning

The company is currently dealing with a lawsuit that challenges its email scanning practices.