TECH

Bluebox: Android Security Bug Could Leave Virtually All Devices Open To Hackers

04/07/2013 10:11 | Updated 02 September 2013
Getty

A potentially catastrophic security flaw has been found that could leave virtually every Android device open to hackers.

According to researchers at Bluebox Security, the 'master key' issue is fundamental to the way Google's open mobile operating system works - and only one device has so far been patched.

The issue apparently affects all versions of Android since version 1.6, meaning up to 900 million devices could be vulnerable to the flaw.

The method demonstrated by Bluebox would let app developers modify an update to a legitimate app to look like a system file, which can then be used to take control of a phone. With the right signature disguising its real motives, the update could log passwords, credit card information, photos, emails - essentially anything on your mobile device.

"The implications are huge," Bluebox explains on its website.

"Depending on the type of application, a hacker can exploit the vulnerability for anything from data theft to creation of a mobile botnet."

It adds:

"All Android applications contain cryptographic signatures, which Android uses to determine if the app is legitimate and to verify that the app hasn't been tampered with or modified. This vulnerability makes it possible to change an application's code without affecting the cryptographic signature of the application - essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been."

The bug was reported to Google in February, Bluebox CTO Jeff Forristal says, but it's up to device makers and mobile networks to develop, issue and install the updates.

So far only the Galaxy S4 is not affected - indicating that patches are being worked on, but are not widely available.

Bluebox recommends that users of Android devices be extra cautious in downloading only apps where they are sure of the content, and wants businesses to prompt all uses to keep their devices updated.

As for Google themselves, Engadget reports that they had "no comment" about the Bluebox report.

  • 1 Apple iPhone 6s
  • The iPhone 6s on the surface at least looks like your bog standard update. Visually it's very much the same animal but look a little deeper and this is an entirely different phone. There's now a pressure-sensitive display utilising a feature called 'Force Touch' while a blistering new processor means it's one of the most capable gaming devices outside of your living room.
  • 2 Google Nexus 5X
  • The Nexus 5X strikes the ultimate balance between power and affordability. Taking over the responsibility from the frankly excellent Nexus 5, Google's new smartphone boast an ultra-light body but still crams in a fingerprint sensor, the latest version of Android marshmallow and a Full-HD display.
  • 3 HTC One A9
  • The HTC One A9 is the iPhone for people who love Android. There's simply no denying the design similarities between the two phones. Thankfully HTC's packed this with more flagship features than you can shake a indecently sized stick at. There's a fingerprint reader, 5-inch Full-HD display, 13MP camera and the A9 can play high-resolution audio.
  • 4 Sony Xperia Z5 Premium
  • Sony has created the world's first truly 4K smartphone. While you might be wondering why, the fact is they've gone ahead and done it anyway. Utilising Sony's amazing screen expertise it should come as no surprise to learn the display is an absolute stunner. There's a fingerprint reader and the ability to play high-res audio.
  • 5 Google Nexus 6P
  • The Google Nexus 6P is Google's answer to the big-screen phone. Sporting a 5.7-inch Full-HD panel, the 6P has a beautifully thin unibody enclosure while the subtle fingerprint scanner on the back can be used for security and for paying. You'll also get the added advantage of owning a phone that'll always get Google's Android software before anyone else keeping it safer than ever.
  • 6 LG G4
  • The LG G4 is LG's most advanced smartphone yet. Combining a massive 5.5-inch 2K display with a powerful F1.8 lens camera this is a phone that means business. If you can get past the size of it then you'll be richly rewarded. Thanks to that F1.8 lens LG claims that the G4 is the closest you'll get to a professional SLR on a smartphone without spending thousands on a camera.
  • The Galaxy S6 Edge is probably the most advanced phone available right now. With it's stunningly curved 2K display and powerful octa-core processor this is a return to form for Samsung that was much needed. If you're after the absolute cutting-edge then this is for you, just don't expect the battery to last any longer than a day.
  • The Moto X 2 is significant for two reasons; the first of which is that you can almost entirely design it yourself. On top of that you get a stunning 5.2-inch display that's matched with a phone that measures in at just 3.8mm at its thinnest point. Thanks to Motorola's agreement with Google it's pure Android and will get updates from Google as soon as they're announced. For now, this is your Nexus replacement.
  • This is the Samsung Galaxy Note 4 and it shows the biggest departure from Samsung's design thinking yet. Gone is the cheap plasticky body, replaced with a thin metal frame and smooth leather back. The screen is still 5.7-inches but Samsung's upped the resolution to a massive 2K.
  • The Nokia Lumia 930 is the flagship phone for Microsoft. Running the increasingly impressive Windows Phone operating system the 930 is a serious contender against the iPhone 6 and S6. It also happens to be a seriously powerful smartphone as well with a 5-inch Full-HD display, 20MP camera and professional levels of film recording thanks to four mics for full stereo pickup.
Suggest a correction