06:24 PM
Connect Directly

Researchers Beat Up Google's Bouncer

The gatekeeper for the Android app store has major growing pains ahead, as security researchers find ways to bypass it

Bouncer, the gatekeeper for the Android app store, looks ready for a rough adolescence. Two groups of security researchers have probed the security service for weaknesses and have had few problems bypassing it.

Click here for more of Dark Reading's Black Hat articles.

Nicholas Percoco and Sean Schulte, both of security firm Trustwave, submitted increasingly malicious versions of an Android application to Google Play. Each variant of the application was scanned by Bouncer, Google's security-checking application, and it failed to flag them as malicious, the two security researcher plan to report at the Black Hat security conference in Las Vegas next month.

"We came up with a technique to hide the malicious activity from Bouncer," Percoco says. "We would upload some code (using the technique) and that would get past Bouncer, and then we upload some more, and we finally got to the point where we had a botnet."

Percoco and Schulte limited the attack so that no users were impacted, but they could have stolen photos, contacts, and passwords from the phone. In the end, they created a botnet capable of a denial-of-service attack, similar to the Low-Orbital Ion Cannon (LOIC) software used by hacktivists.

[Mobile malware hasn't yet grown to the problematic levels that once plagued Windows PCs back in the days before Trustworthy Computing, but that doesn't mean mobile vulnerabilities aren't exploitable. See 6 Discoveries That Prove Mobile Malware's Mettle.]

The researchers are not the first to show Bouncer's problems. At SummerCon earlier this month, two researchers reported on their successful attempts to used Google Play submissions to probe the capabilities of Bouncer. The researchers -- Charlie Miller of security consultancy Accuvant and Jon Oberheide, chief technology officer of mobile security firm Duo Security -- found that Bouncer only runs a submitted application for five minutes and ran applications on a virtualized phone instance running on the QEMU emulator.

Just by waiting more than five minutes to execute malicious code, cybercriminals can bypass Bouncer, says Oberheide. Another simple method, which consultant Miller used against Apple's App Store, is to submit a benign application to the app store and then modify it after acceptance.

Google is undoubtedly developing countermeasures to these techniques, but the researchers identified several ways to get by Bouncer, many of which will not easily be solved.

"There are low-hanging fruit that Google can pick off and fix, but there are others that will require a long time for solve," he says.

Google announced Bouncer earlier this year, but it had been using the security vetting service for more than a year. Over those 12 months, the number of Android users infected by malware from the Google Play store dropped by 40 percent, Google has stated. Despite its initial success weeding malware out of the Android app store, Google has a hard fight ahead to keep malicious applications out of its Google Play store, the researchers say.

While a bouncer in the physical world may let a patron into a store, if the patron start causing problems, the bouncer will eject them. In the digital world, the security service is not yet able to do that, says Percoco.

"If you start causing a problem in the bar, another bouncer is going to see you and kick you out," he says. "In the mobile app world, Google's Bouncer won't kick you out."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
8/1/2012 | 1:01:29 AM
re: Researchers Beat Up Google's Bouncer
Bouncer is a whitelisting product by CoreTrace
Jay Dan
Jay Dan,
User Rank: Apprentice
7/3/2012 | 11:59:25 AM
re: Researchers Beat Up Google's Bouncer
Google Bouncer is an additional layer of security for Android phones that scan for malware. It sounded new and direct applications without interrupting the user experience. It runs on cloud infrastructure, once the application is loaded then start scanning application for formal suspects goalkeeper consumption, trojans and spyware. - @ClickSSL
User Rank: Ninja
6/26/2012 | 3:21:46 AM
re: Researchers Beat Up Google's Bouncer
Hopefully this research will help Google tighten its defenses. But has all the information been shared with Google so they have an opportunity to patch?
Brian Prince, InformationWeek/Dark Reading Comment Moderator-
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-07-14
SQL injection vulnerability in the Policy Manager in Aruba Networks ClearPass 5.x, 6.0.x, 6.1.x through, 6.2.x through, and 6.3.x before 6.3.4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Published: 2014-07-14
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php.

Published: 2014-07-14
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.

Published: 2014-07-14
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.

Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.