Slashdot Mirror
Certifi-gate: Another Huge Android Vulnerability
An anonymous reader writes: Security research firm Check Point has released information about a new vulnerability called Certifi-gate, which they say compromises the security of hundreds of millions of Android devices. The flaw exists within the mobile Remote Support Tools, which are intended to enable screen sharing and simulated taps for tech support purposes. Unfortunately, the way mRSTs validate the remote operator is easy to exploit. Because the software is designed to allow both monitoring of a device's screen and simulated input, the potential for misuse is quite serious. The flaw was disclosed to manufacturers a month ago. HTC, for one, has confirmed it is already starting to roll out a fix.
really HTC *should* be responsible since they are the ones that customized it in a way that you could not just take straight patches from Google.
It's even more than that, since the security vulnerability in this case was added by HTC. There are no remote support tools in the base Android platform, and therefore no insecure remote support tools.
No Nexus devices have this problem.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.