In a significant security leak admission, Google's Android Partner Vulnerability Initiative has revealed a new important vulnerability that has impacted Android handsets from well-known manufacturers like Samsung and LG, among others. The signing keys used by Android OEMs were exposed, making it possible for malware or fake apps to pose as "trusted" apps. Following an earlier discovery of the problem in May of this year, some businesses, including Samsung, took measures to close the vulnerability.
Google employee ukasz Siewierski discovered the security hole (through Esper's Mishaal Rahman). Through his tweets, Sirwierski disclosed how Android malware apps have been signed using platform certificates.
A weakness in the Android platform's key trusting system, which may be used by malevolent attackers, is at the root of the problem. By default, Android's shared user ID system trusts any programme that makes use of a valid platform signing key, which is used to sign core system apps.
However, the platform signing keys of the Android OEMs have been exposed, giving malware developers access to system-level privileges on a target device. As with another system programme from the manufacturer certified with the same certificate, this would provide the attacker access to all user data on that specific device.
The fact that the vulnerability doesn't always need a user to install a new or "unknown" programme is another troubling aspect of it. The platform keys that were compromised might potentially be used to sign widely used, reputable programmes, like the Bixby app on a Samsung smartphone. The certificate would match the one on their system, so a user who downloaded such an app from a third-party website wouldn't get a warning while installing it on their smartphone.
Google, however, has not made clear in its public statement which OEMs or devices are now vulnerable by the significant vulnerability. Nevertheless, a list of sample malware files is included in the publication. The list of impacted handsets, which includes models from Samsung, LG, Mediatek, Xiaomi, and Revoview, has apparently been validated by the platform in the intervening period.
The search engine behemoth has also offered suggestions on how the impacted businesses may lessen the current problem. The initial stage is generating fresh signing keys and replacing any Android platform signing keys that have been suspected of having been leaked. Additionally, the corporation has asked all Android manufacturers to substantially reduce the frequency with which platform keys are used by one app to sign those of other apps.
Google claims that the problem was originally brought up in May. Samsung and all other impacted businesses have since taken corrective measures to reduce and mitigate the vulnerabilities that were present. However, according to Android Police, parts of the disclosure's list of susceptible keys were recently employed in Samsung and LG phone applications that were posted to APK Mirror.
"As soon as we disclosed the primary breach, OEM partners swiftly put mitigation strategies into place. User mitigations implemented by OEM partners will safeguard end users "In a response to BleepingComputer, Google noted.
In order to stay safe from potential security flaws like the one disclosed by Google, users on Android are advised to update their firmware versions to the most recent updates and to exercise caution when downloading apps from third-party sources.
