Risk
7/17/2013
02:20 PM
Connect Directly
RSS
E-Mail
50%
50%

Google Play Has Apps Abusing Master Key Vulnerability

Two apps currently available for download in Google Play abuse the critical master key vulnerability that affects almost all Android devices. Is Google reviewing apps for the flaw?

9 Android Apps To Improve Security, Privacy
9 Android Apps To Improve Security, Privacy
(click image for larger view)
Google Play alert: An information security researcher has spotted two apps that use the master key vulnerability that's present in an estimated 99% of all Android devices. But rather than being distributed by sketchy third-party app stores, which are known for harboring malicious apps that have been disguised as free versions of the real thing, these two apps are available directly from the official Google Play app store.

Fortunately, the apps don't appear to be malicious. But the presence of the free apps -- Rose Wedding Cake Game and Pirates Island Mahjong Free, which have been downloaded by between 15,000 and 60,000 people -- on the Google Play site calls into question whether Google is now scanning for apps that abuse the so-called master key vulnerability that was discovered by Bluebox Labs in February and detailed by Android hackers earlier this month, as well as a similar vulnerability that was disclosed last week by researchers at Android Security Squad in China.

"We always advise people to stick to applications that are delivered via Google Play," said Bogdan Botezatu, the senior e-threat analyst at BitDefender who discovered the apps, speaking by phone. "But we just saw applications manifesting this behavior on Google Play. So what do I advise my users and readers?"

In the meantime, he's notified Google about the apps and emphasized that "they do not pose a threat for users." In addition, he said, "We also notified the developers because at the moment we do not know if this is a voluntary behavior or if this is a side effect of them using a specific software development toolkit," which in this case was Adobe AIR. It's also possible that a simple coding mistake is to blame for the apps sporting two duplicate PNG files with the same name and extension being located in the same folder. "This is not a good practice, because the file system was not designed in such a way to allow two files with the same names and the same extension to be in the same folder -- it's going to lead to confusion," said Botezatu.

[ ReKey app patches major Android vulnerability, but devices must be rooted. Read more at Android Users Can Patch Critical Flaw. ]

Regardless, the apps won't be allowed to execute by the latest version of Android, or if users have installed antivirus or security software designed to block the master key exploit.

But given that Google was first alerted to the vulnerability in February, it's curious that its automated Bouncer application security checks didn't intercept the apps, which were last updated in mid-May and mid-June. "I'm not sure if Google Play didn't flag these applications as malicious because they didn't have malicious behavior, or if they weren't able to scan these applications for the vulnerability in Google Play," Botezatu said.

A Google spokesman didn't immediately respond to an emailed request for comment about the apps, or whether Google is now actively scanning all apps to detect if they appear to exploit the vulnerability.

From a patch standpoint, Android quickly patched the master key vulnerability in the Android Open Source Project (AOSP) after learning of the vulnerability in February, and some recently released devices -- Samsung Galaxy S4 and HTC One devices running Android 4.2.2 or above -- have a related patch. Likewise, the developers behind the third-party Android firmware CyanogenMod have updated their firmware with patches for the master key vulnerability identified by Bluebox Labs, as well as the more recent vulnerability identified by Android Security Squad.

How can other Android users protect themselves against the vulnerability? The easiest approach is to use an Android antivirus app that's been updated to block any apps that attempt to exploit the vulnerability, and both BitDefender and Webroot updated their Android antivirus software Tuesday, with Botezatu noting that BitDefender's software also includes a patch for the flaw spotted by Android Security Squad. Alternately, more advanced Android users can install ReKey from Duo Security, which will patch the vulnerability, but only on rooted devices.

Unfortunately, however, the majority of Android may have to wait months -- if ever -- to see a related operating system update for their device from their handset maker or carrier. "The thing is, not for users of Cyanogenmod, but rather who are part of the huge ecosystem that's Android 2.3.3 Gingerbread [or earlier], they are highly unlikely to receive any security updates from carriers," said BitDefender's Botezatu. "That's why we rushed the fix for our antivirus, because everyone can install an antivirus, but not everyone can upgrade their device. It's difficult for a regular user to root their phone and install a third-party ROM."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
speedo1456
50%
50%
speedo1456,
User Rank: Apprentice
7/13/2014 | 8:07:05 PM
Google taking steps to improve things?
Thumbs up for Google. Finally a big company is looking in some issues that concerns many android phone users. It took a while but maybe this is the beginning of some cleanup that had to be done inside the android market.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2413
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

CVE-2012-5244
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) return, (2) display, (3) table, or (4) search parameter to functions/suggest.php; (5) the id parameter to functions/widgets.php, (6) the category parameter to...

CVE-2012-5694
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the (1) agentPhNo, (2) controlPhNo, (3) agentURLPath, (4) agentControlKey, or (5) platformDD1 parameter to frameworkgui/attach2Agents.p...

CVE-2012-5695
Published: 2014-10-20
Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS m...

CVE-2012-5696
Published: 2014-10-20
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.