Android update process gives malware a leg-up to evil

snoopy · Mar 24, 2014

Android update process gives malware a leg-up to evil
Click to expand...

: Indiana U
Click to expand...

Old apps get access to privileges that didn't exist when they were written

Researchers from Indiana University Bloomington have tagged a vulnerability in the way Android handles updates, which they say puts practically every Android device at risk of malicious software.

As ThreatPost explains, the vulnerability uses the update process to “ramp up the permissions given to malicious apps once Android is updated without raising an alarm to the user.”

The research was carried out by Indiana's Luyi Xing, Xiaorui Pan, Kan Yuan and XiaoFeng Wang, with help from Rui Wang of Microsoft Research.

What's going on in “Pileup” – privilege escalation through updating – is this: some permission settings offered in newer Android versions aren't present in older versions. A malicious app – one that would raise alarms in a newer version – can be installed in an older version without problems. It can't ask for dangerous permissions, because those permissions don't exist.

However, because Android tries not to break apps during the update process, an update on the infected device will automatically assign the escalated permissions to the malicious app, without alerting the user.

As the paper states, the attack “is not aimed at a vulnerability in the current system. Instead, it exploits the flaws in the updating mechanism of the “future” OS, which the current system will be upgraded to … the adversary can strategically claim a set of carefully selected privileges or attributes only available on the higher OS version”.
Click to expand...

Read more on this topic here: http://www.theregister.co.uk/2014/03/23/android_updates_a_critical_vuln_indiana_u/

Log in or Sign up

Android update process gives malware a leg-up to evil

snoopy Registered Members

Share This Page

Log in or Sign up

Android update process gives malware a leg-up to evil

snoopy Registered Members

Share This Page

Useful Searches