And Android security hits the news once again, it\u2019s not a vulnerability in the OS per-say but rather in the browser based on the Webkit engine. It does highlight the inherent fragmentation problems with the Android platform and the security concerns that come with running old OS and software versions.<\/p>\n
<\/p>\n
It\u2019s a problem that is plaguing Android right now with different phones running different core OS versions (from 1.5 to 2.2) \u2013 on top of that 3rd party skins for the OS from Samsung, Motorola and more. This makes updating the OS slow and many users are stuck with old versions and no news regarding updates.<\/p>\n
\nA security researcher has released proof-of-concept code that exploits a vulnerability in most versions of Google\u2019s Android operating system for smartphones.
\nM.J. Keith of Alert Logic said he released the attack code to expose what he characterized as inadequate patching practices for the open-source mobile platform. Rather than find the underlying bug himself, he searched through a list of documented security flaws for Apple\u2019s Safari, which relies on the same Webkit browser engine used in Android. In short order, he had an attack that exploits about two-thirds of the handsets that rely on the OS.
\n\u201cThey need a better patching system,\u201d Keith told The Register. \u201cThey do a good job of repairing future releases, but I think a better patching system needs to be set up for Android.\u201d
\nThe bug Keith\u2019s code exploits was fixed in Android 2.2, but according to figures supplied by Google, only 36 percent of users have the most recent version. That means the remainder are susceptible to the attack.<\/p><\/blockquote>\nGoogle has claimed that they are changing the architecture with the upcoming release of Gingerbread, many of the system apps will be pushed to the Marketplace \u2013 meaning they can push out updates much faster and easier than if everything is integrated in the OS image.<\/p>\n
Of course core problems with the kernel or underlying OS will still have to be addressed via firmware updates, but still like this \u2013 which effects the browser \u2013 could be negated if a new browser version could be pushed out from the Android Marketplace.<\/p>\n
The same goes for the recent Critical Zero Day Abobe Flash Flaw Which Put Android Phones At Risk.<\/p>\n
What\u2019s more, Keith said he had no trouble finding other documented Webkit vulnerabilities that have yet to be fixed in version 2.2.<\/p>\n
\u201cI found about four or five and I wasn\u2019t trying to [do] an exhaustive search,\u201d he said.<\/p>\n
A Google spokesman declined to comment for this post. To be fair, Android\u2019s design does a good job of segregating the functions of one application from those of another. That would make it hard for someone exploiting the bug Keith demonstrated to gain root privileges or access to many of the targeted handset\u2019s resources. But it still would allow an attacker to access anything the browser can read, including a phone\u2019s Secure Digital memory card.<\/p>\n
The bigger point, Keith said, is that most users have no idea their devices are vulnerable to bugs that were patched long ago on other platforms.<\/p>\n
\u201cI wanted to demonstrate that nobody\u2019s being notified that their Android phone is vulnerable to this stuff,\u201d he explained. Google \u201cwants to pretend it\u2019s not there.\u201d<\/p><\/blockquote>\n
It is a serious problem that Android is facing right now and I hope Google do more to address this and work alongside with the handset vendors so OS updates can be pushed out in a more efficient and timely manner.<\/p>\n
The exploit code can be found here:<\/p>\n