Security Architecture, Endpoint/Device Security, Endpoint/Device Security, Security Strategy, Plan, Budget, Vulnerability Management, Incident Response, TDR, Endpoint/Device Security, Endpoint/Device Security, Endpoint/Device Security

Black Hat: Don’t assume safety from “master key” Android vulnerability

The CTO who disclosed the "master key" Android vulnerability, which allows miscreants to invisibly infect any legitimate app, has presented follow-up research that reinforced how exposed users are to the threat.

At last week's Black Hat conference in Las Vegas, Jeff Forristal, CTO of Bluebox Security, warned that the bug impacting 99 percent of Android devices shouldn't be downplayed under the assumption that users know better than to download apps from untrusted sources.

He revealed that 69 percent of Android users, drawn from a sample of those in Bluebox's network, permitted app downloads from unofficial online sites. According to Forristal, the users didn't employ an Android setting on their phones that blocked app downloads from “untrusted sources.”

The finding was particularly relevant because the master key vulnerability, which was disclosed last month, allows an attacker to weaponize any clean app without altering its cryptographic signature. Modifying this digital signature serves as a red flag that an app has been tampered with.

In late July, Symantec researchers discovered the first signs of the bug being exploited in the wild when attacker infected popular games and other apps found in third-party marketplaces in China.The flaw allowed attackers to remotely control victims' phones, send premium SMS messages and disable security software on the device, all by implanting legitimate apps with malicious code.

Forristal said Bluebox's poll, which analyzed around 250,000 Android devices in its network, showcased how prevalent the threat still is to users.

"This is an even bigger problem than those Android experts think it is,” Forristal told Black Hat attendees on Thursday.

Further, Forristal said other flaws exist that give attackers similar “master key” privileges. He has noted other members of the master key vulnerability “family,” including findings from other researchers who discovered additional bugs.

Google currently has patches for the vulnerability discovered by Bluebox, along with two others said to achieve similar app takeovers (#9695860 and #8219321).

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.