Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


06:24 PM

Researchers Beat Up Google's Bouncer

The gatekeeper for the Android app store has major growing pains ahead, as security researchers find ways to bypass it

Bouncer, the gatekeeper for the Android app store, looks ready for a rough adolescence. Two groups of security researchers have probed the security service for weaknesses and have had few problems bypassing it.

Click here for more of Dark Reading's Black Hat articles.

Nicholas Percoco and Sean Schulte, both of security firm Trustwave, submitted increasingly malicious versions of an Android application to Google Play. Each variant of the application was scanned by Bouncer, Google's security-checking application, and it failed to flag them as malicious, the two security researcher plan to report at the Black Hat security conference in Las Vegas next month.

"We came up with a technique to hide the malicious activity from Bouncer," Percoco says. "We would upload some code (using the technique) and that would get past Bouncer, and then we upload some more, and we finally got to the point where we had a botnet."

Percoco and Schulte limited the attack so that no users were impacted, but they could have stolen photos, contacts, and passwords from the phone. In the end, they created a botnet capable of a denial-of-service attack, similar to the Low-Orbital Ion Cannon (LOIC) software used by hacktivists.

[Mobile malware hasn't yet grown to the problematic levels that once plagued Windows PCs back in the days before Trustworthy Computing, but that doesn't mean mobile vulnerabilities aren't exploitable. See 6 Discoveries That Prove Mobile Malware's Mettle.]

The researchers are not the first to show Bouncer's problems. At SummerCon earlier this month, two researchers reported on their successful attempts to used Google Play submissions to probe the capabilities of Bouncer. The researchers -- Charlie Miller of security consultancy Accuvant and Jon Oberheide, chief technology officer of mobile security firm Duo Security -- found that Bouncer only runs a submitted application for five minutes and ran applications on a virtualized phone instance running on the QEMU emulator.

Just by waiting more than five minutes to execute malicious code, cybercriminals can bypass Bouncer, says Oberheide. Another simple method, which consultant Miller used against Apple's App Store, is to submit a benign application to the app store and then modify it after acceptance.

Google is undoubtedly developing countermeasures to these techniques, but the researchers identified several ways to get by Bouncer, many of which will not easily be solved.

"There are low-hanging fruit that Google can pick off and fix, but there are others that will require a long time for solve," he says.

Google announced Bouncer earlier this year, but it had been using the security vetting service for more than a year. Over those 12 months, the number of Android users infected by malware from the Google Play store dropped by 40 percent, Google has stated. Despite its initial success weeding malware out of the Android app store, Google has a hard fight ahead to keep malicious applications out of its Google Play store, the researchers say.

While a bouncer in the physical world may let a patron into a store, if the patron start causing problems, the bouncer will eject them. In the digital world, the security service is not yet able to do that, says Percoco.

"If you start causing a problem in the bar, another bouncer is going to see you and kick you out," he says. "In the mobile app world, Google's Bouncer won't kick you out."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
User Rank: Ninja
6/26/2012 | 3:21:46 AM
re: Researchers Beat Up Google's Bouncer
Hopefully this research will help Google tighten its defenses. But has all the information been shared with Google so they have an opportunity to patch?
Brian Prince, InformationWeek/Dark Reading Comment Moderator-
Jay Dan
Jay Dan,
User Rank: Apprentice
7/3/2012 | 11:59:25 AM
re: Researchers Beat Up Google's Bouncer
Google Bouncer is an additional layer of security for Android phones that scan for malware. It sounded new and direct applications without interrupting the user experience. It runs on cloud infrastructure, once the application is loaded then start scanning application for formal suspects goalkeeper consumption, trojans and spyware. - @ClickSSL
User Rank: Apprentice
8/1/2012 | 1:01:29 AM
re: Researchers Beat Up Google's Bouncer
Bouncer is a whitelisting product by CoreTrace
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-13
Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. An attacker could replace the .dll and redirect pixels elsewhere.
PUBLISHED: 2021-05-13
The lack of nested page table protection in the AMD SEV/SEV-ES feature could potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.
PUBLISHED: 2021-05-13
In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise...
PUBLISHED: 2021-05-13
A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially to prevent any new user connections.
PUBLISHED: 2021-05-13
A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with t...