Google’s Android Partner Vulnerability Initiative, in a major security leak admission, has disclosed a new key vulnerability that has affected Android smartphones from major brands such as Samsung and LG, among others. Due to the leaking of the signing keys used by Android OEMs, imposter apps or malware could disguise themselves as “trusted” apps. The issue was earlier reported in May this year, following which several companies including Samsung took actions to control the vulnerability.
The security flaw was brought to light by Google employee Łukasz Siewierski (via Esper’s Mishaal Rahman). Sirwierski, through his tweets, revealed how the platform certificates have been used to sign malware apps on Android.
Folks, this is bad. Very, very bad. Hackers and/or malicious insiders have leaked the platform certificates of several vendors. These are used to sign system apps on Android builds, including the “android” app itself. These certs are being used to sign malicious Android apps! https://t.co/lhqZxuxVR9
— Mishaal Rahman (@MishaalRahman) December 1, 2022
At the heart of the issue lies an Android platform key trusting mechanism vulnerability that could be exploited by malicious attackers. By design, Android trusts any application that uses a legitimate platform signing key, which is used to sign core system applications, through Android’s shared user ID system.
However, the Android original equipment manufacturers (OEMs) have had their platform signing keys leaked, allowing malware creators to gain system-level permissions on a target device. This would make all user data on the particular device available to the attacker, just like another system app from the manufacturer signed with the same certificate.
Another alarming part about the vulnerability is that it doesn’t necessarily require a user to install a new or an “unknown” application. The leaked platform keys could also be used to sign common trusted apps such as Bixby app on a Samsung device. A user who downloaded such an application from a third-party website would not see a warning when installing it on their smartphone, as the certificate would match the one on their system.
Google, however, has not explicitly mentioned the list of devices or OEMs that have so far been affected by the critical vulnerability in its public disclosure. Nevertheless, the disclosure includes a list of sample malware files. The platform has since reportedly confirmed the list of affected smartphones, which include devices from Samsung, LG, Mediatek, Xiaomi and Revoview.
The search giant has also suggested ways for the affected companies to mitigate the issue at hand. The first step involves churning out Android platform signing keys that have been flagged to have been leaked and replacing them with new signing keys. The company has also urged all Android manufactures to drastically minimise the frequent use of platform key for an app to sign other apps.
According to Google, the issue was first reported in May. Since then, Samsung and all other affected companies have already taken remedial actions to mitigate and minimise the vulnerabilities that were at hand. However, according to Android Police, some of the vulnerable keys that were listed in the disclosure were recently used for apps for Samsung and LG phones uploaded to APK Mirror.
“OEM partners promptly implemented mitigation measures as soon as we reported the key compromise. End users will be protected by user mitigations implemented by OEM partners,” Google said in a statement to BleepingComputer.
Users on Android are advised to update their firmware versions to the latest available updates in order to remain protected from potential security flaws such as the one disclosed by Google, and to be vigilant while downloading apps from third-party sources.
