Researchers Discover Security Flaw Affecting 99% of Android Devices

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

Researchers from Bluebox Security are sounding the alarm about a security flaw in Android. The vulnerability affects nearly all Android devices released within the last four years.

The Washington Post’s Hayley Tsukayama reported, “Security researchers believe they have found a major security flaw in the Google’s Android mobile operating system, which could affect up to 99 percent of Android phones now in consumers’ hands. In results published Wednesday by the Bluebox Security research firm, chief technology officer Jeff Forristal said the flaw gave hackers a ‘master key’ into the Android system.”

BBC News explained, “The bug emerges because of the way Android handles cryptographic verification of the programs installed on the phone. Android uses the cryptographic signature as a way to check that an app or program is legitimate and to ensure it has not been tampered with. Mr Forristal and his colleagues have found a method of tricking the way Android checks these signatures so malicious changes to apps go unnoticed.”

Ars Technica’s Dan Goodin added, “Malicious apps that exploit the vulnerability would enjoy the same system privileges as the legitimate one. That access could be especially dangerous if the app that’s modified originated with the handset manufacturer or third parties that partner with the manufacturer, Wednesday’s blog post said. That’s because such apps are typically granted elevated privileges within the Android OS.”

CIO’s Lucian Constantin noted, “Google was notified of the vulnerability in February and the company shared the information with their partners, including the members of the Open Handset Alliance, at the beginning of March, [Bluebox Chief Technology Officer Jeff] Forristal said. It is now up to those partners to decide what their update release plans will be, he said. Forristal confirmed that one third party device, the Samsung Galaxy S4, already has the fix, which indicates that some device manufacturers have already started releasing patches. Google has not released patches for its Nexus devices yet, but the company is working on them, he said.”