A major security leak has led to the creation of “trusted” malware apps that can gain access to the entire Android operating system on devices from Samsung, LG, and others.
As shared by Googler Łukasz Siewierski (via Mishaal Rahman), Google’s Android Partner Vulnerability Initiative (APVI) has publicly disclosed a new vulnerability that affected devices from Samsung, LG, Xiaomi, and others.
The core of the issue is that multiple Android OEMs have had their platform signing keys leaked outside of their respective companies. This key is used to ensure that the version of Android that’s running on your device is legitimate, created by the manufacturer. That same key can also be used to sign individual apps.
By design, Android trusts any app signed with the same key used to sign the operating system itself. A malicious attacker with those app signing keys would be able to use Android’s “shared user ID” system to give malware full, system-level permissions on an affected device. In essence, all data on an affected device could be available to an attacker.
Notably, this Android vulnerability doesn’t solely happen when installing a new or unknown app. Since these leaked platform keys are also in some cases used to sign common apps — including the Bixby app on at least some Samsung phones — an attacker could add malware to a trusted app, sign the malicious version with the same key, and Android would trust it as an “update.” This method would work regardless of if an app originally came from the Play Store, Galaxy Store, or was sideloaded.
Google’s public disclosure doesn’t lay out which devices or OEMs were affected, but it does display the hash of example malware files. Helpfully, each of the files has been uploaded to VirusTotal, which also often reveals the name of the affected company. With that, we know the following companies’ keys were leaked (though some keys have not yet been identified):
- Samsung
- LG
- Mediatek
- szroco (makers of Walmart’s Onn tablets)
- Revoview
According to Google’s brief explainer of the issue, the first step is for each affected company to swap out (or “rotate”) its Android platform signing keys to no longer use the ones that have been leaked. It’s good practice to do this regularly anyway, to minimize the damage of potential future leaks.
Beyond that, Google has also urged all Android manufacturers to drastically minimize how often the platform key is used to sign other apps. Only an application that needs that highest level of permissions should be signed that way to avoid potential security issues.
Google says that, since the issue was reported in May 2022, Samsung and all of the other affected companies have already “taken remediation measures to minimize the user impact” of these major security leaks. It’s not clear what exactly this means, as some of the vulnerable keys were used in Android apps from Samsung in the last few days, according to APKMirror.
It’s not known which current Android devices, if any, are still vulnerable to this security exploit. We’ve reached out to Google for additional details, but the company was not immediately available for comment.
Notably, while Google’s disclosure says the exploit was reported in May 2022, some of the malware examples were first scanned by VirusTotal as early as 2016. It’s not yet clear if this means the leak and associated exploits have been actively used against some devices in that time.
In a statement, Google clarified that people’s devices are protected against this particular vulnerability in a handful of ways, including through Google Play Protect, “mitigations” from device makers, and more. Beyond that, this exploit did not make its way into apps distributed through the Google Play Store.
OEM partners promptly implemented mitigation measures as soon as we reported the key compromise. End users will be protected by user mitigations implemented by OEM partners. Google has implemented broad detections for the malware in Build Test Suite, which scans system images. Google Play Protect also detects the malware. There is no indication that this malware is or was on the Google Play Store. As always, we advise users to ensure they are running the latest version of Android.
— Google spokesperson
While the details of this latest Android security leak are being confirmed, there are some simple steps you can take to make sure your device stays secure. For one, be sure that you’re on the newest firmware available for your device. If your device is no longer receiving consistent Android security updates, we recommend upgrading to a newer device as soon as possible.
Beyond that, avoid sideloading applications to your phone, even when updating an app that’s already on your phone. Should the need to sideload an app arise, be sure you completely trust the file you’re installing.
Dylan Roussel contributed to this article.
More on Android:
- Google reports decline in Android memory safety vulnerabilities as Rust usage grows
- December Google Play System Updates: Digital driver’s license beta, Pixel Tablet prep
- Samsung boasts speedy Android 13 rollout, wants Android 14 to be even faster
Author: Kyle Bradshaw
Source: 9TO5Google
