Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/25/2012
06:24 PM
50%
50%

Researchers Beat Up Google's Bouncer

The gatekeeper for the Android app store has major growing pains ahead, as security researchers find ways to bypass it

Bouncer, the gatekeeper for the Android app store, looks ready for a rough adolescence. Two groups of security researchers have probed the security service for weaknesses and have had few problems bypassing it.

   
Click here for more of Dark Reading's Black Hat articles.

Nicholas Percoco and Sean Schulte, both of security firm Trustwave, submitted increasingly malicious versions of an Android application to Google Play. Each variant of the application was scanned by Bouncer, Google's security-checking application, and it failed to flag them as malicious, the two security researcher plan to report at the Black Hat security conference in Las Vegas next month.

"We came up with a technique to hide the malicious activity from Bouncer," Percoco says. "We would upload some code (using the technique) and that would get past Bouncer, and then we upload some more, and we finally got to the point where we had a botnet."

Percoco and Schulte limited the attack so that no users were impacted, but they could have stolen photos, contacts, and passwords from the phone. In the end, they created a botnet capable of a denial-of-service attack, similar to the Low-Orbital Ion Cannon (LOIC) software used by hacktivists.

[Mobile malware hasn't yet grown to the problematic levels that once plagued Windows PCs back in the days before Trustworthy Computing, but that doesn't mean mobile vulnerabilities aren't exploitable. See 6 Discoveries That Prove Mobile Malware's Mettle.]

The researchers are not the first to show Bouncer's problems. At SummerCon earlier this month, two researchers reported on their successful attempts to used Google Play submissions to probe the capabilities of Bouncer. The researchers -- Charlie Miller of security consultancy Accuvant and Jon Oberheide, chief technology officer of mobile security firm Duo Security -- found that Bouncer only runs a submitted application for five minutes and ran applications on a virtualized phone instance running on the QEMU emulator.

Just by waiting more than five minutes to execute malicious code, cybercriminals can bypass Bouncer, says Oberheide. Another simple method, which consultant Miller used against Apple's App Store, is to submit a benign application to the app store and then modify it after acceptance.

Google is undoubtedly developing countermeasures to these techniques, but the researchers identified several ways to get by Bouncer, many of which will not easily be solved.

"There are low-hanging fruit that Google can pick off and fix, but there are others that will require a long time for solve," he says.

Google announced Bouncer earlier this year, but it had been using the security vetting service for more than a year. Over those 12 months, the number of Android users infected by malware from the Google Play store dropped by 40 percent, Google has stated. Despite its initial success weeding malware out of the Android app store, Google has a hard fight ahead to keep malicious applications out of its Google Play store, the researchers say.

While a bouncer in the physical world may let a patron into a store, if the patron start causing problems, the bouncer will eject them. In the digital world, the security service is not yet able to do that, says Percoco.

"If you start causing a problem in the bar, another bouncer is going to see you and kick you out," he says. "In the mobile app world, Google's Bouncer won't kick you out."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/26/2012 | 3:21:46 AM
re: Researchers Beat Up Google's Bouncer
Hopefully this research will help Google tighten its defenses. But has all the information been shared with Google so they have an opportunity to patch?
Brian Prince, InformationWeek/Dark Reading Comment Moderator-
Jay Dan
50%
50%
Jay Dan,
User Rank: Apprentice
7/3/2012 | 11:59:25 AM
re: Researchers Beat Up Google's Bouncer
Google Bouncer is an additional layer of security for Android phones that scan for malware. It sounded new and direct applications without interrupting the user experience. It runs on cloud infrastructure, once the application is loaded then start scanning application for formal suspects goalkeeper consumption, trojans and spyware. - @ClickSSL
xxxxxxxxxxxxxxxxx
50%
50%
xxxxxxxxxxxxxxxxx,
User Rank: Apprentice
8/1/2012 | 1:01:29 AM
re: Researchers Beat Up Google's Bouncer
Bouncer is a whitelisting product by CoreTrace
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.