PDA

View Full Version : 900 Million Android Phones at risk (again...)



Bob
8th August 2016, 04:47
It's called the QuadRooter Flaw -

Got an Android?

Well, another hole leaves your phone open potentially to attack, where the attacker can take everything over, get whatever they want off it, lock you out, get all the data, turn on the camera and microphone.

At the Def Con security conference on Sunday Adam Donenfeld security researcher at CheckPoint described the "high" risk privilege escalation vulnerabilities that was found.

A malicious APP is all it takes. Normally apps are checked for security vulnerabilities, but its been pointed out that some manage to sneak through. (for instance an innocent looking game turned phones into zombies for botnets - see http://www.zdnet.com/article/new-android-malware-poses-as-app-joins-device-to-botnet/ - The malware is dubbed "Viking Horde," after one of the popular apps it poses as. )

Google's Nexus 5X, Nexus 6, and Nexus 6P, HTC's One M9 and HTC 10, and Samsung's Galaxy S7 and S7 Edge are some of those named vulnerable to one or more of the flaws.

The recently-announced BlackBerry DTEK50, which the company touts as the "most secure Android smartphone," is also vulnerable to one of the flaws.


A Qualcomm spokesperson said the chipmaker has fixed all of the flaws, and had issued patches to customers, partners, and the open source community between April and the end of July. Most of those fixes have already gone into Android's monthly set of security patches, which Google issues early each month to its own-brand Nexus devices. Many other phone and tablet makers roll out those patches at the same time or in the following few days.

Three flaws were fixed in Google's latest set of monthly security updates, but one of the vulnerabilities is still outstanding, largely because the final patch wasn't issued in time.

Google confirmed that the fourth flaw will be fixed in the upcoming September update, due out a little after the start of next month.

IF ONE doesn't update, doesn't get the PATCHES one's phone remains vulnerable (once again)..


"No-one at this point has a device (Android powered) that's fully secure," he said. "That basically relates to the fact that there is some kind of issue of who fixes what between Qualcomm and Google."

How about that?

and


That's one of the reasons why two federal agencies have stepped in to question why phone security updates are often haphazard, or few and far between.

The Federal Trade Commission (FTC) and the Federal Communications Commission (FCC) both asked Apple, Google, and phone makers and carriers when is it decided "to patch a vulnerability on a particular mobile device" or not.

A report is due out later this year.

(source (http://www.zdnet.com/article/quadrooter-security-flaws-affect-over-900-million-android-phones/))


http://zdnet2.cbsistatic.com/hub/i/r/2015/05/15/931dab70-615f-4222-9c19-65ab99390125/resize/220x165/1a0fc15e03c2c38c38e95157bec24d2a/android.jpg

Bob
11th August 2016, 21:10
Apparently keeping up with reminding folks about "Android" issues works (at least a tiny bit).. Google says well, er, if you have for whatever reason turned it OFF, turn IT ON AND USE, VERIFY APPS - (they say it will block apps that have any exploit attempting to use the QuadRooter flaw). They say it is normally TURNED ON by DEFAULT.. (they are in essence saying no worries ! So we could naively ask how come there are holes and bugs then?)

From the article:

"Android's "Verify Apps" feature, included in Google Play Services and enabled by default almost four years ago in Android 4.2 Jelly Bean, is designed to protect against exactly this sort of thing.

And now we have confirmation from Google that, as expected, Verify Apps can identify and block apps using QuadRooter. A Google spokesperson gave Android Central the following statement:"


"We appreciate Check Point's research as it helps improve the safety of the broader mobile ecosystem. Android devices with our most recent security patch level are already protected against three of these four vulnerabilities. The fourth vulnerability, CVE-2016-5340, will be addressed in an upcoming Android security bulletin, though Android partners can take action sooner by referencing the public patch Qualcomm has provided. Exploitation of these issues depends on users also downloading and installing a malicious application.

Our Verify Apps and SafetyNet protections help identify, block, and remove applications that exploit vulnerabilities like these."

AND


90 percent (of the Android devices) should automatically block any app using QuadRooter.

And the remaining 10 percent can be protected if they enable this security feature manually.

Source - the Android's leading promo page - http://www.androidcentral.com/google-confirms-verify-apps-can-block-apps-quadrooter-exploits

How to TURN IT ON, if you are one of the one's who has not updated or has an 'old phone' (like so many of us) -


And on older versions of Android going back to 2010's Gingerbread release, you can enable Verify Apps under "Security" in the Google Settings app.

On the Nexus 6P, it's under Settings/Google/Security/Verify Apps.

Android user - How many had to turn off this security feature to install Amazon video app?

Android user - Often people here, including the author's, forget about the millions of users worldwide, who don't have Google services.

Do you have all your AUTO-UPDATE features, Google Service active?