A new class of vulnerabilities uncovered in Google‘s mobile platform is suspected to affect all of the almost one billion Android devices in existence.
According to a paper published by researchers from Indiana University and Microsoft, the so-called ‘Pileup’–short for privilege escalation through updating–lurks inside the Android Package Management Service (PMS) and increases the permissions offered to malicious apps whenever an update occurs, without giving the user any info about the matter.
“Every few months, an update is released, which causes replacement and addition of tens of thousands of files on a live system. Each of the new apps being installed needs to be carefully configured to set its attributes within its own sandboxes and its privileges in the system, without accidentally damaging existing apps and the user data they keep,” the researchers wrote. “This complicates the program logic for installing such mobile updates, making it susceptible to security-critical flaws.”
“Through the app running on a lower version of Android, the adversary can strategically claim a set of carefully selected privileges or attributes only available on the higher OS version,” the researchers added.
Six different Pileup vulnerabilities have been discovered within the Android PMS. According to the researchers, these vulnerabilities are present in all Android Open Source Project versions, including all 3,522 source code versions customised by handset OEMs and carriers.
“A third-party package attribute or property, which bears the name of its system counterpart, can be elevated to a system one during the updating shuffle-up where all apps are installed or reinstalled, and all system configurations are reset,” the researchers mentioned in the paper. “Also, when two apps from old and new systems are merged as described above, security risks can also be brought in when the one on the original system turns out to be malicious.”
The research team is said to have reported their findings to Google, which has already patched one of the six vulnerabilities.
source:muktware
