Mobile Archives

Tag: Mobile

Security Start-Up, University Team On Android Patch App

July 16, 2013 Paul Roberts

The saga of the application-signing flaw affecting Google’s Android mobile phones took another turn Tuesday when a Silicon Valley startup teamed with graduate students from Northeastern University in Boston to offer their own fix-it tool for hundreds of millions of Android phones that have been left without access to Google’s official patch. Duo Security announced the availability of an Android utility dubbed “ReKey” on Tuesday. The tool allows Droid users to patch the so-called “Master Key” vulnerability on Android devices, even in the absence of a security update from Android handset makers (OEMs) and carriers who distribute the phones, according to a post on the Duo Security blog. The tool can be downloaded from the site rekey.io. “ReKey is the latest of our research projects designed to make the Internet a safer place,” said Collin Mulliner, a postdoctoral researcher at NEU SecLab in a joint press release issued by NEU […]

Updated: Exploit Code Released For Android Security Hole

July 8, 2013 Paul Roberts

A security researcher has published what he claims is a proof of concept program that exploits a security hole that affects hundreds of millions of Android mobile devices.* Pau Oliva Fora, a security researcher for the firm Via Forensics, published a small, proof of concept module that exploits the flaw in the way Android verifies the authenticity of signed mobile applications. The flaw was first disclosed last week by Jeff Forristal, the Chief Technology Officer at Bluebox Security, ahead of a presentation at the Black Hat Briefings in August. Oliva Fora posted his “quick and dirty” proof of concept on GitHub, a code sharing website, on Monday. The simple program leverages APKTool, a common, open source tool for reverse engineering Android applications – decompiling and then recompiling their contents. APKTool is widely used for analyzing and making modifications to closed binaries. His script allows a user to select an Android […]

Flaw Leaves 900M Android Devices Vulnerable

July 5, 2013 Paul Roberts

A security researcher claims to have uncovered a flaw in the Android security model that leaves almost all devices running the mobile operating system vulnerable to attacks and malicious software. Jeff Forristal, the Chief Technology Officer at Bluebox Security posted a description of the flaw on Wednesday. It affects Android devices running any version of the OS released in the past four years, starting with Version 1.6 (codename: “Donut” ) – a population of nearly 900 million devices. Discrepancies in how Android applications are cryptographically signed and then verified by Android allow a malicious attacker to modify the application package file (or APK) code without breaking the cryptographic signature. The implications of the flaw are huge. A malicious application installed on a vulnerable Android device could access any data stored on the device. For applications, such as mobile virtual private network (VPN), an attacker who could alter the application’s code or […]

Wardriving Goes Corporate: Comcast Turning Residential WiFi Into ‘Millions of Hotspots’

June 12, 2013 Paul Roberts

One of the big challenges to the growth of the “Internet of Things” is access. It goes without saying that, without access to the Internet, almost all of the benefits of connected devices disappear. Your smart phone becomes a dumb phone. Your ‘net connected watch or running shoes or car scream into the void – trying desperately to connect to a network that isn’t there. Here in the U.S., that problem has typically been addressed by routing traffic through 3G or – depending on where you live – 4G wireless networks. However, access to those networks is spotty, especially in the sparsely populated Western U.S. According to a survey by the U.S. Federal Communications Commission (FCC), much of the Western U.S. is a 3G wasteland, with little or no access to broadband wireless networks. One solution is to tap the loose network of residential broadband subscribers, allowing them to peel […]

New Malware Exploits Android Glitch To Block Removal

June 6, 2013 Paul Roberts

A new malicious program that runs on Android mobile devices exploits vulnerabilities in Google’s mobile operating system to extend the application’s permissions on the infected device, and to block attempts to remove the malicious application. Writing on securelist.com, Kaspersky Lab’s research blog, malware researcher Roman Unuchek called the newly discovered Trojan the “most sophisticated” malicious program yet detected that works with Android phones. He cited the Trojan’s advanced features, including complex obfuscation techniques that complicated analysis of the code, and the use of a previously unknown vulnerability in Android that allowed it to take control of and maintain a foothold on infected Android devices. Kaspersky said it has contacted Google regarding the malware and the alleged vulnerabilities in Android. Google was unable to confirm that prior to publication. The malware, dubbed Backdoor.AndroidOS.Obad.a, is described as a “multi function Trojan.” Like most profit-oriented mobile malware, Obad is primarily an SMS Trojan, […]