One Billion Android Devices Open To Privilege Escalation

msm1267 (2804139) writes "The first deep look into the security of the Android patch installation process, specifically its Package Management Service (PMS), has revealed a weakness that puts potentially every Android device at risk for privilege escalation attacks. Researchers from Indiana University and Microsoft published a paper that describes a new set of Android vulnerabilities they call Pileup flaws, and also introduces a new scanner called SecUP that detects malicious apps already on a device lying in wait for elevated privileges. The vulnerability occurs in the way PMS handles updates to the myriad flavors of Android in circulation today. The researchers say PMS improperly vets apps on lower versions of Android that request OS or app privileges that may not exist on the older Android version, but are granted automatically once the system is updated.

The researchers said they found a half-dozen different Pileup flaws within Android's Package Management Service, and confirmed those vulnerabilities are present in all Android Open Source Project versions and more than 3,500 customized versions of Android developed by handset makers and carriers; more than one billion Android devices are likely impacted, they said." Handily enough, the original paper is not paywalled.

Comments

Re:Nevertheless, I do thank MS for pointing it out

[symbolset]

The source of malware still has to get you to install their app and then update your Android. And it's only a problem if you didn't already assume that when you gave the app that permission it would gain it when available. The risk is way overstated. If this is the mud Microsoft can sling, I find that comforting.

Now let's talk about that last patch batch where IE couldn't even safely display a JPEG in any currently supported version on any version of Windows.