Menu
Report finds Android vulnerabilities aplenty

Report finds Android vulnerabilities aplenty

Why BYOD is still frought: over half of devices are vulnerable to known flaws, says security firm

Over half of Android devices are vulnerable to known security flaws that can be exploited by malicious applications to gain complete access to the operating system and the data stored on it, according to a report from mobile security firm Duo Security.

This conclusion is based on scans performed during the last couple of months with X-Ray, a free Android vulnerability assessment tool developed by Duo Security. X-Ray scans devices for known privilege escalation vulnerabilities that exist in various versions of the mobile operating system.

"Since we launched X-Ray, we've already collected results from over 20,000 Android devices worldwide," security researcher Jon Oberheide, who is co-founder and CTO of Duo Security, said last week in a blog post.

Privilege vulnerabilities can be exploited willingly by users in order to gain administrator (root) access on their devices and, for example, replace the firmware provided by the manufacturer with a custom-built one.

However, they can also be exploited by malware for malicious purposes and there have been multiple documented cases of Android malware that incorporated root exploits over the years.

"Since the launch of our mobile security solution, root exploits have been some of the most frequently encountered threats," Bogdan Botezatu, a senior e-threat analyst at antivirus vendor BitDefender, said last Friday via email.

For example, during the first quarter of 2012, the top 10 detected Android threats included the "Rage Against The Cage" exploit, the "GingerBreak" exploit, the "Exploid" exploit and the "Asroot" exploit, Botezatu said.

Some of those cases might have been caused by users who were attempting to "root" their devices. However, others were likely generated by malicious apps that used those exploits, Botezatu said.

Over 50 percent is actually a fairly conservative estimate, Oberheide said. "Yes, it's a scary number, but it exemplifies how important expedient patching is to mobile security and how poorly the industry (carriers, device manufacturers, etc) has performed thus far."

The slow deployment of security patches to Android devices is a problem that has been known of for years. Manufacturers stop issuing updates for some device models too quickly and even when they do issue updates, some carriers don't distribute them in a timely manner.

"In the Microsoft ecosystem, desktop users know that patches are provided for quite a while, just like what happened with Windows XP," Botezatu said. "Mobile carriers, on the other side, see the mobile device, as well as the operating system running atop of it as a wearable item that rapidly goes out of fashion and has a shorter lifespan than desktops or laptops."

"While it's well-known in the security community that slow patching of vulnerabilities on mobile devices is a serious issue, we wanted to bring greater visibility to the problem," Oberheide said. The researcher will present the preliminary results from the X-Ray project at the United Security Summit conference in San Francisco.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securityAndroidOSinternational news

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments