Kryptowire, a US based security firm has uncovered 38 different vulnerabilities in some Android devices shipped by popular OEMs that can allow for spying and malware reload on the affected devices.
While the US military vetted security firm, Kryptowire specializes in mobile security analysis tools, app marketplace analytics, anti-piracy technologies and Enterprise Mobility Management (EMM) solutions, and was jumpstarted by the DARPA (Defense Advanced Research Projects Agency ) and the Department of Homeland Security.
The vulnerabilities are such that hackers can leverage it to take screenshots, factory reset a device or steal personal information and potentially access the logs of what a person is typing or reading at any given time through the malicious applications.
It's quite alarming that lots of Android users fall victim to malicious apps that pose as harmless tools such as flashlight or battery savers, albeit these apps can't get access to protected files themselves, but they can leverage the flaws in pre-installed applications for access.
According to the researchers, the vulnerabilities were tied to devices from ZTE, Asus, LG and Essential Phone, which are distributed by carriers like Verizon and AT&T in the United States.
These malware are supposedly bundled out of the box, not that it is downloaded and installed by the user, nor is it a flaw in the Android operating system itself, but third party code running on the devices.
Since there's so many different Android phone makers involved, the vulnerabilities are different across the devices, as they come with different pre-installed apps, making it pretty hard for Google to keep track of all the pre-installed malicious apps.
The researchers, however noted that there could be more infected devices out there, outside the named OEMs, considering that not all Android devices were tested, and given that over 24,000 different types of devices were logged in 2015 alone; to run vulnerability scans on every single device will indeed be a herculean task.
No comments