Android vulnerability allows attackers to modify apps

https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures

by WinandVM • 9 years ago

115 65 9 years ago

guardsquare.com

aluhut5• 9 years ago

All those problems and I sit here with my Moto and the last patch from February...

Good my guarantee runs out soon so I can switch to something I can patch myself.

overshard• 9 years ago

I'm in a similar situation, I got a One Plus Onyx since I heard so much about how One Plus supports and updates their products and I haven't had an update in over a year.

It's probably time to install LineageOS...

Yizahi2• 9 years ago

On the other hand OP3 and OP3T have pretty impressive (for me) track record and are now on 8.0 with September security (I think). And out of the box 3T had 6.X something. OP is not a perfect company, not even close, but ok I suppose overall.

roflcake11• 9 years ago

Why not getting an iPhone and let Apple patch it for you? It's just a phone, not your child, you don't have to take care of it...

aluhut5• 9 years ago

I don't like the closed culture and the prices they put up for their hardware are far beyond justified in my opinion.

Also, didn't they also had trouble recently?

josu• 9 years ago

Some Moto's allow you to unlock the bootloader through their official page.

tapoxi• 9 years ago

My X 2015 had significant performance issues and Bluetooth would randomly stop working. They didn't upgrade from Marshmallow 6.0.0 to Nougat (7.0.0, not even 7.1) until last month.

I bought an iPhone X. I love Android but most manufacturers don't seem to care about the product after you've purchased it.

tony1014• 9 years ago

Consider getting a Pixel. Guaranteed timely security updates for 3 years, and you can flash your own images if you'd like.

lostmsu2• 9 years ago

I ended up buying used HP Elite x3 (Win10 Mobile) because of that. Even though MS dropped feature updates for Win10 Mobile, they promised security updates until 2020 if I'm not mistaken.

pjmlp2• 9 years ago

€ 799.00, more than a month salary for many people that I know.

Multiple month salaries in many 2nd and 3rd tier countries around the world.

Security as a privilege only for the rich people is not a solution.

bubblethink• 9 years ago

and you can flash your own images if you'd like

Just an FYI for anyone interested in getting it. You can do this only if you buy directly from Google, not from Verizon. Only Google's version has an unlockable bootloader. Google sold out pretty hard to Verizon in order to get some sales. One of the nice things about the Nexus line (at least all the later ones) was that you get a good no-bullshit phone no matter where you buy it from. Now, with Pixel, you get the shitty one if you buy from Verizon. The major downside to this is the used market. No way to reliably buy a good phone on ebay etc. The model numbers are the same. Some respite is swappa, which lists them accurately.

petecox• 9 years ago

And after 3 years?

(I'm using a Nexus 4)

cJ0th• 9 years ago

You did not specify the exact model. Have you checked whether there is a LineageOs Rom for your device?

https://download.lineageos.org/

aluhut5• 9 years ago

There is. When I wrote the post above I thought I might wait until the guarantee did run out but I'm preparing the switch right now :)

junke• 9 years ago

The JAR signature scheme only takes into account the zip entries. It ignores any extra bytes when computing or verifying the application's signature.

Why? is there a use-case for this?

freeone3000• 9 years ago

Because that's how `jarsigner` (the Java application) signs. The code signature was fixed in Android 7.0.

0xtk• 9 years ago

Does it mean the vuln only affects devices running < 7.0?

kuschku• 9 years ago

Jarsigner is designed to be used by Java.

And both Jarsigner, and the Java command used to actually run the code on Oracle Java and OpenJDK use the same code – so they both only see the zip entries.

This issue only exists because Android reused a signing process designed for an entirely different execution environment.

r3bl• 9 years ago

Out of all the Android vulnerabilities so far, and out of all the devices that are not running an up-to-date versions of Android, what's your theory as to why we have yet to discover a large Android botnet?

r1ch• 9 years ago

Ironically this is the one thing that the Android ecosystem fragmentation has going for it. My guess is that no one can be bothered to make reliable exploits that have all the correct offsets and addresses for who knows how many different kernels and firmwares and such.

You'd think the Broadcom wifi bug would be an extremely lucrative worm target, but in reality it takes a great deal of effort to make a reliable exploit targeting a single version of a single device.

Until there's a more basic bug that doesn't involve kernel addresses and exact memory layouts etc it's far more profitable for bad actors to deliver their malware via malicious .APK files that users will happily install.

discreditable3• 9 years ago

A few reasons (imho):

* No one has really tried.

* Google will remove malicious apps from devices via Play Store if they spread too wide.

* A phone botnet would be pretty lame for ddos, which is what botnets seem to be all about these days. Their connections are unreliable, and utilizing the botnet for more than a few hours would kill it's batteries.

Phone exploits seem to be more about harvesting personal data[1], ransomware[2], and/or adware[3].

1. http://www.zdnet.com/article/this-bank-data-stealing-android...

2. http://www.zdnet.com/article/this-nasty-new-android-ransomwa...

3. http://www.bbc.com/news/technology-31129797

MuffinFlavored• 9 years ago

What are some other things botnets could be used for?

chatmasta• 9 years ago

Many phones are connected to reliable WiFi for a significant percentage of the day.

nine_k2• 9 years ago

Using a phone for ddosing when it's charging and connected to wifi could be feasible, though, given a large enough infection rate.

ufmace• 9 years ago

For all of the publicity about vulnerabilities, I don't remember any that are really that useful for compromising large numbers of devices. Many, including this one, require something like installing a random app from the web, which most users likely have disabled. Some require being physically close to the device. Some, like Stagefright, are easily blocked at the carrier level.

I can't remember any that were like some of the Windows vulnerabilities of the bad old days, of fully owning the device just from it being on the network. The OS is a lot more locked down too, no install of non-store apps by default, and heavy restrictions on app permissions.

Probably also helps that since they're phones, anything doing the usual botnet activities would result in rapid battery death and the user getting their phone fixed or replaced.

badrabbit• 9 years ago

Stagefright is one,so is the broadcom SoC exploits project zero published

guelo2• 9 years ago

Because Android is more secure then you've been led to believe. Google does a decent job of continually hardening the OS and ecosystem and of detecting and counteracting the spread of malware.

s73ver_3• 9 years ago

But most people don't get access to that work, because their phones don't get updated.

chickenbane2• 9 years ago

Although the Android ecosystem is probably the biggest OS deployment on devices right now, Google has done a pretty impressive job maintaining its overall safety. The primary mechanism they use is what they call GMS (Google Mobile Services), built on top of AOSP.

GMS includes the Google Play Store, which they reported this year had 2B monthly active users. The most notable AOSP derivatives that do not run GMS are Amazon's Fire OS and whatever Chinese companies are doing. Whenever you see somebody trying to implement "Android without Google", they are (misguidedly) replacing GMS.

Anyway, GMS on the device auto-updates and works with cloud services to detect and act on malware the user may have installed. This year Google branded this "Google Play Protect". Because GMS doesn't require firmware, kernel, or platform updates to work, Google is able to police the ecosystem effectively.

Also, because all apps are signed by the developer and Google controls the Play Store, its also able to work with developer community to mitigate libraries / sdks that are harmful. The overall end result is harmful apps are only on 0.05% of devices that only install apps from the Play Store (the most common scenario, and the default).

Karliss• 9 years ago

Apk are usually signed using v1 an v2 signatures for backwards compatibility. Ripping out v2 signature would keep v1 signature valid. I hope Android 7 doesn't allow signing scheme downgrades if previously installed version was signed with v2 signature.

UPD Documentation states it does.

klyubin2• 9 years ago

Ripping out v2 signatures makes the APK invalid on Android 7.0 and newer. This is because the v1 signature contains a special header X-Android-APK-Signed in its META-INF/*.SF files. When Android 7.0 or newer encounters this header without having encountered a valid v2 signature, it rejects the APK.

Installing a v1-only signed update to an APK which is v2 signed is permitted. However, the update has to be the same versionCode or higher to be accepted, meaning it can't be a downgrade in terms of versionCode. Thus, as long as you don't produce updates/upgrades which are v1-only signed, you should be protected against this vulnerability on Android 7.0 and newer.

brianshaler• 9 years ago

This seems noteworthy:

Any scenario still requires the user to install the malicious update from a source outside the Google Play store.

blacksmith_tb• 9 years ago

Agreed. Also this "The ... vulnerability affects ... Android 5.0 and newer... Applications that have been signed with APK signature scheme v2 and that are running on devices supporting the latest signature scheme (Android 7.0 and newer) are protected against the vulnerability."

orblivion• 9 years ago

From a user's standpoint, the impression I'm getting is this:

"A user might download a malicious update to an existing application from someplace other than Google Play, and Android will incorrectly tell the user that the application is valid."

Is this correct? Then they should say so in this article, perhaps in the introduction. As a user I can look at the details later if I'm interested, but for now I need to know what (not) to do to stay safe.

Again, beating the drum that security news needs to improve its messaging.

tony1014• 9 years ago

I believe your understanding is correct. And if you have security patch level of 2017-12-01 or newer, you are safe from this vulnerability.

I agree that the article needs a TLDR at the top.

https://source.android.com/security/bulletin/2017-12-01

s73ver_3• 9 years ago

"And if you have security patch level of 2017-12-01 or newer, you are safe from this vulnerability."

So, not most people.

Android vulnerability allows attackers to modify apps

Related Stories