Android bug lets apps make rogue phone calls

A vulnerability present in most Android devices allows apps to initiate unauthorized phone calls, disrupt ongoing calls and execute special codes that can trigger other rogue actions.

The flaw was found and reported to Google late last year by researchers from Berlin-based security consultancy firm Curesec, who believe it was first introduced in Android version 4.1.x, also known as Jelly Bean. The vulnerability appears to have been fixed in Android 4.4.4, released on June 19.

However, the latest version of Android is only available for a limited number of devices and currently accounts for a very small percentage of Android installations worldwide. Based on Google’s statistics, almost 60 percent of Android devices that connected to Google Play at the beginning of June ran versions 4.1.x, 4.2.x and 4.3 of the mobile OS. Another 13 percent ran versions 4.4, 4.4.1, 4.4.2 or 4.4.3, which are also vulnerable. Version 4.4.4 had not been released at that time.

Full details here: http://www.pcworld.com/article/2451220/android-bug-lets-apps-make-rogue-phone-calls.html