Per THIS article at the BBC, Symantec has found someone using it in the wild. Here is their ITEM on it, with all the technical details.
Kind of funny when the attitude of some was that there wasn't much chance of it being used.
Right.
Showing posts with label Android Master Key Vulnerability. Show all posts
Showing posts with label Android Master Key Vulnerability. Show all posts
Thursday, July 25, 2013
UPDATE II: Android "Master Key" Security issue
Well, a further update on the Android "Master Key" issue. See my first posting HERE.
Per THIS article at the BBC, Symantec has found someone using it in the wild. Here is their ITEM on it, with all the technical details.
Kind of funny when the attitude of some was that there wasn't much chance of it being used.
Right.
Per THIS article at the BBC, Symantec has found someone using it in the wild. Here is their ITEM on it, with all the technical details.
Kind of funny when the attitude of some was that there wasn't much chance of it being used.
Right.
Wednesday, July 10, 2013
UPDATE: Android "Master Key" Security issue
Some updates on the Android "Master Key" issue brought up by Bluebox Security.
Per THIS article at TechCrunch, Google has patched the issue.
HOWEVER, before anyone starts to think this is over, keep in mind this means that Google has created a patch and given it to their partners. THEY then need to test this patch with their released versions of Android for their devices (and realize that this issue goes back to earlier versions of Android which most manufacturers are no longer patching). And THEN they will release the patch to the carriers so they can test it before its released. This isn't like Windows Update.
As noted, most of the manufacturers are only maintaining the newer versions of Android they've released (usually just Jelly Bean), so who knows what this means for those stuck at prior versions.
Also, Bluebox has created a scanner that will tell you if you Android device is vulnerable. I thought THIS article was a pretty good response to that news.
Per THIS article at TechCrunch, Google has patched the issue.
HOWEVER, before anyone starts to think this is over, keep in mind this means that Google has created a patch and given it to their partners. THEY then need to test this patch with their released versions of Android for their devices (and realize that this issue goes back to earlier versions of Android which most manufacturers are no longer patching). And THEN they will release the patch to the carriers so they can test it before its released. This isn't like Windows Update.
As noted, most of the manufacturers are only maintaining the newer versions of Android they've released (usually just Jelly Bean), so who knows what this means for those stuck at prior versions.
Also, Bluebox has created a scanner that will tell you if you Android device is vulnerable. I thought THIS article was a pretty good response to that news.
Friday, July 5, 2013
New Android Security hole
So am not the first to bring this to others attention. I've seen several articles on it over the last week on the Android "Master Key" vulnerability.
Basically, researchers at Bluebox Security have found this security hole that has been present in all version of Android since v1.6. The firm informed Google about this in February. The Samsung Galaxy S4 supposedly has been patched for it. No word on any other Android device.
More information on it will be forthcoming at the Black Hat Security Conference. But for right now, you can check out their blog posting HERE on it.
Now, a basic thing about this issue is that it is exploited by malicious apps. And malicious apps, despite tools like Bouncer in the Google Play Store, can still be put up there. Patching Android is always a tough thing, because the process has to include both the manufactors and the carriers. According to a recent item on CIO, Google has already updated Play Store to block apps that take advantage of the issue. But I hope people see that as only a stop gap to getting the Android OS itself patch.
For those interested, here are the articles I've see so far on this:
Bluebox Blog
Techcrunch
Android Central
CIO
Basically, researchers at Bluebox Security have found this security hole that has been present in all version of Android since v1.6. The firm informed Google about this in February. The Samsung Galaxy S4 supposedly has been patched for it. No word on any other Android device.
More information on it will be forthcoming at the Black Hat Security Conference. But for right now, you can check out their blog posting HERE on it.
Now, a basic thing about this issue is that it is exploited by malicious apps. And malicious apps, despite tools like Bouncer in the Google Play Store, can still be put up there. Patching Android is always a tough thing, because the process has to include both the manufactors and the carriers. According to a recent item on CIO, Google has already updated Play Store to block apps that take advantage of the issue. But I hope people see that as only a stop gap to getting the Android OS itself patch.
For those interested, here are the articles I've see so far on this:
Bluebox Blog
Techcrunch
Android Central
CIO
Subscribe to:
Posts (Atom)