Home › News ›

Vulnerability Allows Maliciously-Modified Android Apps To Appear Verified

Jul 4, 2013, 9:13 AM by Rich Brome @richbrome

A newly-revealed vulnerability in Android allows attackers to bypass the usual app authenticity and integrity checks. Normally, the checks allow Android to verify that an app has not been modified. This new issue allows those with ill intent to modify an app with malicious code, without breaking the security signature. This will cause Android to report that the app is genuine and unmodified, when in fact it is not. The issue does not affect apps downloaded and updated exclusively through Google's Play Store. Apps downloaded or updated through any other sources may be affected. Full protection can only be provided by a patch to Android itself, which is up to phone manufacturers (and carriers) to provide. Samsung has implemented a fix on its Galaxy S 4, but the fix has not been confirmed for any other phones, and Google has not yet patched the issue in the base Android code, nor on its Nexus devices. Google was first notified about the issue in February, and notified its major partners in March. It affects all versions of Android from 1.6 through 4.2.

IDG »
Bluebox »

Related

Review: Samsung Galaxy S4 Active for AT&T

The Galaxy S4 Active is a tougher, water-resistant version of Samsung's flagship Android smartphone, and it offers most of the same features. Phone Scoop puts it through its paces in this full review.

Hands On: Samsung Galaxy S4 Active for AT&T

Samsung showed off the Galaxy S4 Active, a semi-rugged version of its flagship phone. In some ways, the Active is superior to the phone that inspired it.

Review: Samsung Galaxy S 4 for Verizon Wireless

The Galaxy S 4 performs very well on Verizon's network. Here is Phone Scoop's review of Samsung's 2013 flagship Android smartphone.

Review: Samsung Galaxy S 4 for AT&T

The Galaxy S 4 performs very well on AT&T's network. Here is Phone Scoop's review of Samsung's 2013 flagship Android smartphone.

Review: Samsung Galaxy S 4 for Sprint

The Galaxy S 4, Samsung's most important phone of the year, arrives at U.S. carrier stores this month.

Samsung Galaxy S 4 (GSM)

5" display FHD+ resolution
Snapdragon 600 8064T processor 2 GB RAM
2,600 mAh battery
Memory Card Slot, Headphone Jack (3.5mm), NFC

Samsung Galaxy S 4 (Verizon / Sprint)

5" display FHD+ resolution
Snapdragon 600 8064T processor 2 GB RAM
2,600 mAh battery
Memory Card Slot, Headphone Jack (3.5mm), NFC

Samsung Galaxy S 4 (regional CDMA)

5" display FHD+ resolution
Snapdragon 600 8064T processor 2 GB RAM
2,600 mAh battery
Memory Card Slot, Headphone Jack (3.5mm), NFC

more news about:

Comments

This forum is closed.

This forum is closed.

tjobrien21

Jul 8, 2013, 1:07 PM

This points to a need for HUGE changes in smartphone security

Somehow, Android or whatever succeeds it needs to be more agile in terms of running on a wide variety of hardware. That way, patches can be issued by Google in the morning and implemented on a user's phone that afternoon. Kinda like Windows Update if you will.

The fundamental problem is smartphone security isn't taken seriously enough. Not even close. Consider what people store on their phones: It's generally their most personal information - and often times, that of others as well. Photos, account numbers, addresses, SSNs, personal notes, email, chats, SMS... All this on a device that's always connected to the internet. Top off the insecurity with the fact that they carry it around with them, often without even a lockscreen, and it's a r...
(continues)

Vmac39

You make a great point. I think even Windows Phone will be just as vulnerable to these attacks, as they move forward to making desktop and Windows Phone more compatible in software design. This may allow users to download apps and other software witho...
(continues)

...

OmegaWolf747

Jul 4, 2013, 9:36 AM

Since February

Google and the manufacturers have been sitting on this since February and we're just now finding out about it? 🤨 😡

Haggard

Full protection can only be provided by a patch to Android itself, which is up to phone manufacturers (and carriers) to provide.

How unfortunate for Verizon handset owners.

...

Hays21

Jul 4, 2013, 2:19 PM

Amount of people...

I feel like there are not many people that download apps from anywhere but the google play store. I doubt this will affect that many people.

KOL4420

I actually know a lot of people that do this. They are mostly the individuals who root their phones or dont want to pay for an app.

Personally I dont download anything unless I have a trusted source whether its on mobile or on my PC.

I rooted ...
(continues)

...

Page 1 of 1