Massive Android flaw leaves 99% of devices vulnerable

Discovery by security firm BlueBox offers a 'master key' to hackers

Security researchers have discovered a dangerous flaw in Google’s Android operating system that allows hackers to take full control of smartphones running the OS. The team behind the discovery – Bluebox Security – claim that “99% of devices” are vulnerable.

In a post on their website detailing their research Bluebox CTO Jeff Forristal says that the mistake has been present since the release of Android 1.6 in September 2009, potentially affecting nearly 900 million devices.

The vulnerability is based in “discrepancies” in how Android verifies and installs third party software (whether that is built by developers or by manufacturers). The cryptography guaranteeing that the apps have not been tampered with or modified has been found to be deficient.

“[A malicious application] not only has the ability to read arbitrary application data on the device (email, SMS messages, documents, etc.), retrieve all stored account & service passwords, it can essentially take over the normal functioning of the phone,” said Forristal.

“Finally, and most unsettling, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving (therefore hard-to-detect) nature of these “zombie” mobile devices to create a botnet.”

Despite this, the fact that the loophole has been discovered by independent research and not as an investigation of any particular malware is comforting – meaning that malicious exploitation of the flaw is so far only hypothetical.

Bluebox notified Google of the flaw in February 2013 but did not detail how the company had responded to the threat. “It’s up to device manufacturers to produce and release firmware updates for mobile devices (and furthermore for users to install these updates),” said Forristal.

Google have so far declined to comment.

PROMOTED VIDEO
Life and Style
ebooksA superb mix of recipes serving up the freshest of local produce in a delicious range of styles
Life and Style
ebooksFrom the lifespan of a slug to the distance to the Sun: answers to 500 questions from readers
Arts and Entertainment
Robert De Niro, Martin Scorsese and DiCaprio, at an awards show in 2010
filmsDe Niro, DiCaprio and Pitt to star
News
i100
News
In this photo illustration a school student eats a hamburger as part of his lunch which was brought from a fast food shop near his school, on October 5, 2005 in London, England. The British government has announced plans to remove junk food from school lunches. From September 2006, food that is high in fat, sugar or salt will be banned from meals and removed from vending machines in schools across England. The move comes in response to a campaign by celebrity TV chef Jamie Oliver to improve school meals.
science
Sport
England captain Wayne Rooney during training
FOOTBALLNew captain vows side will deliver against Norway for small crowd
Life and Style
Red or dead: An actor portrays Hungarian countess Elizabeth Báthory, rumoured to have bathed in blood to keep youthful
health
News
peopleJustin Bieber charged with assault and dangerous driving after crashing quad bike into a minivan
News
peopleHis band Survivor was due to resume touring this month
News
people'It can last and it's terrifying'
Life and Style
fashionModel of the moment shoots for first time with catwalk veteran
Sport
Radamel Falcao poses with his United shirt
FOOTBALLRadamel Falcao's journey from teenage debutant in Colombia to Manchester United's star signing
Life and Style
fashionAngelina Jolie's wedding dressed revealed
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating
and  

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    Front-Office Developer (C#, .NET, Java, AI)

    £40000 - £45000 per annum + Benefits + Bonus: Harrington Starr: Front-Office D...

    C# Software Engineer (ASP.NET, C#, CSS, Java Script, JQuery)

    £40000 - £50000 per annum + Benefits, Training & Bonus: Harrington Starr: C# S...

    Systems Administrator (SharePoint) - Central London - £36,500

    £35000 - £36500 per annum: Ashdown Group: Systems Administrator (SharePoint) -...

    Derivatives Risk Commodities Business Analyst /Market Risk

    £600 - £800 per day: Harrington Starr: Derivatives Risk Commodities Business A...

    Day In a Page

    Chief inspector of GPs: ‘Most doctors don’t really know what bad practice can be like for patients’

    Steve Field: ‘Most doctors don’t really know what bad practice can be like for patients’

    The man charged with inspecting doctors explains why he may not be welcome in every surgery
    Stolen youth: Younger blood can reverse many of the effects of ageing

    Stolen youth

    Younger blood can reverse many of the effects of ageing
    Bob Willoughby: Hollywood's first behind the scenes photographer

    Bob Willoughby: The reel deal

    He was the photographer who brought documentary photojournalism to Hollywood, changing the way film stars would be portrayed for ever
    Hollywood heavyweights produce world's most expensive corporate video - for Macau casino

    Hollywood heavyweights produce world's most expensive corporate video - for Macau casino

    Scorsese in the director's chair with De Niro, DiCaprio and Pitt to star
    Angelina Jolie's wedding dress: made by Versace, designed by her children

    Made by Versace, designed by her children

    Angelina Jolie's wedding dressed revealed
    Anyone for pulled chicken?

    Pulling chicks

    Pulled pork has gone from being a US barbecue secret to a regular on supermarket shelves. Now KFC is trying to tempt us with a chicken version
    9 best steam generator irons

    9 best steam generator irons

    To get through your ironing as swiftly as possible, invest in one of these efficient gadgets
    England v Norway: Wayne Rooney admits England must ‘put on a show’ to regain faith

    Rooney admits England must ‘put on a show’ to regain faith

    New captain vows side will deliver for small Wembley crowd
    ‘We knew he was something special:’ Radamel Falcao's journey from teenage debutant to Manchester United's star signing

    ‘We knew he was something special’

    Radamel Falcao's journey from teenage debutant to Manchester United's star signing
    'I’ll tell you what I would not serve - lamb and potatoes': US ambassador hits out at stodgy British food served at diplomatic dinners

    'I’ll tell you what I would not serve - lamb and potatoes'

    US ambassador hits out at stodgy British food
    Radio Times female powerlist: A 'revolution' in TV gender roles

    A 'revolution' in TV gender roles

    Inside the Radio Times female powerlist
    Endgame: James Frey's literary treasure hunt

    James Frey's literary treasure hunt

    Riddling trilogy could net you $3m
    Fitbit: Because the tingle feels so good

    Fitbit: Because the tingle feels so good

    What David Sedaris learnt about the world from his fitness tracker
    Saudis risk new Muslim division with proposal to move Mohamed’s tomb

    Saudis risk new Muslim division with proposal to move Mohamed’s tomb

    Second-holiest site in Islam attracts millions of pilgrims each year
    Alexander Fury: The designer names to look for at fashion week this season

    The big names to look for this fashion week

    This week, designers begin to show their spring 2015 collections in New York