06:24 PM
Connect Directly
Repost This

Researchers Beat Up Google's Bouncer

The gatekeeper for the Android app store has major growing pains ahead, as security researchers find ways to bypass it

Bouncer, the gatekeeper for the Android app store, looks ready for a rough adolescence. Two groups of security researchers have probed the security service for weaknesses and have had few problems bypassing it.

Click here for more of Dark Reading's Black Hat articles.

Nicholas Percoco and Sean Schulte, both of security firm Trustwave, submitted increasingly malicious versions of an Android application to Google Play. Each variant of the application was scanned by Bouncer, Google's security-checking application, and it failed to flag them as malicious, the two security researcher plan to report at the Black Hat security conference in Las Vegas next month.

"We came up with a technique to hide the malicious activity from Bouncer," Percoco says. "We would upload some code (using the technique) and that would get past Bouncer, and then we upload some more, and we finally got to the point where we had a botnet."

Percoco and Schulte limited the attack so that no users were impacted, but they could have stolen photos, contacts, and passwords from the phone. In the end, they created a botnet capable of a denial-of-service attack, similar to the Low-Orbital Ion Cannon (LOIC) software used by hacktivists.

[Mobile malware hasn't yet grown to the problematic levels that once plagued Windows PCs back in the days before Trustworthy Computing, but that doesn't mean mobile vulnerabilities aren't exploitable. See 6 Discoveries That Prove Mobile Malware's Mettle.]

The researchers are not the first to show Bouncer's problems. At SummerCon earlier this month, two researchers reported on their successful attempts to used Google Play submissions to probe the capabilities of Bouncer. The researchers -- Charlie Miller of security consultancy Accuvant and Jon Oberheide, chief technology officer of mobile security firm Duo Security -- found that Bouncer only runs a submitted application for five minutes and ran applications on a virtualized phone instance running on the QEMU emulator.

Just by waiting more than five minutes to execute malicious code, cybercriminals can bypass Bouncer, says Oberheide. Another simple method, which consultant Miller used against Apple's App Store, is to submit a benign application to the app store and then modify it after acceptance.

Google is undoubtedly developing countermeasures to these techniques, but the researchers identified several ways to get by Bouncer, many of which will not easily be solved.

"There are low-hanging fruit that Google can pick off and fix, but there are others that will require a long time for solve," he says.

Google announced Bouncer earlier this year, but it had been using the security vetting service for more than a year. Over those 12 months, the number of Android users infected by malware from the Google Play store dropped by 40 percent, Google has stated. Despite its initial success weeding malware out of the Android app store, Google has a hard fight ahead to keep malicious applications out of its Google Play store, the researchers say.

While a bouncer in the physical world may let a patron into a store, if the patron start causing problems, the bouncer will eject them. In the digital world, the security service is not yet able to do that, says Percoco.

"If you start causing a problem in the bar, another bouncer is going to see you and kick you out," he says. "In the mobile app world, Google's Bouncer won't kick you out."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
8/1/2012 | 1:01:29 AM
re: Researchers Beat Up Google's Bouncer
Bouncer is a whitelisting product by CoreTrace
Jay Dan
Jay Dan,
User Rank: Apprentice
7/3/2012 | 11:59:25 AM
re: Researchers Beat Up Google's Bouncer
Google Bouncer is an additional layer of security for Android phones that scan for malware. It sounded new and direct applications without interrupting the user experience. It runs on cloud infrastructure, once the application is loaded then start scanning application for formal suspects goalkeeper consumption, trojans and spyware. - @ClickSSL
User Rank: Ninja
6/26/2012 | 3:21:46 AM
re: Researchers Beat Up Google's Bouncer
Hopefully this research will help Google tighten its defenses. But has all the information been shared with Google so they have an opportunity to patch?
Brian Prince, InformationWeek/Dark Reading Comment Moderator-Š
Register for Dark Reading Newsletters
White Papers
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web