Drive-by Android Malware Exploits Unpatchable Vulnerability
Marty Pearsol of malwaredoc.com writes “Attackers have crafted the E-Z-2-Use malware code that exploits a 14-month-old vulnerability in Android devices. The vulnerability exists in the WebView interface a malicious website can utilize it to gain a remote shell into the system with the permissions of the hijacked application. Vulnerable devices are any device that is running a version earlier than 4.2 (in which the vulnerability was patched) which is a staggeringly large amount of the market. The vulnerability is in Android itself rather than the proprietary GMS application platform that sits atop the base operating system so it is not easily patched by Google.”
Most Android phones are unpatchable due to the carrier not giving a damn (for various reasons), the phone hardware being too old (or too low-end), and/or the manufactuer not giving a damn (they’d prefer you buy a new phone from them instead). There are of course jailbreaks, if your carrier doesn’t cut you off for using it, and if there’s one that works on your phone, and if you have the technical ‘oomph to install it without bricking the thing.
To put it bluntly? Unless you paid at least $300 for your Android smartphone and it’s less than 3 years old (if you’re lucky), you’re pretty much screwed.
It is likely going to drive the average consumer to buying iPhones (if they have the money) or WinMo devices (if they don’t.)
You see, people aren’t all that technically in-depth, and so they’re not going to (rightly) blame the manufacturers or carriers for blocking patches/upgrade – they’ll blame “Android”, and avoid it like the plague, even if the newer versions are fully patched against it.
Expert Malware Researcher Advice
If you’re gonna get an Android phone and care at all about updates, before you spend ANY money make sure you can find instructions on how to unlock/root your phone as well as check the level of development of ROMs available for the phone. If the phone of interest is sufficiently popular that there’s good instructions on how to unlock and root it and there’s a reasonably healthy community involved in developing ROMs for it (and hence updates), then it’s probably a good phone to get. Short of buying a Nexus, this is really the only way to guarantee that you’ll be able to keep updating your phone as time goes on.
I bought my Samsung Galaxy S2 in February of 2012. My carrier (Telstra) has long forgotten about supporting my particular phone (I think the last official Telstra supported update was 4.1.2). However, I’m running 4.4.2 and can only run that due to the wonderful community that’s still developing ROMs for this thing, long after corporate interest has dried up. I have absolutely no intention of replacing it until it breaks, since it’s still quite fast and capable.
The malicious code exploits a critical bug in Android’s WebView programming interface that was disclosed 14 months ago. The security hole typically gives attackers remote access to a phone’s camera and file system and in some cases also exposes other resources, such as geographic location data, SD card contents, and address books.
The easiest way to exploit the bug is to lure a vulnerable user to a booby-trapped webpage. Within seconds, the site operator will obtain a remote shell window that has access to the phone’s file system and camera. In some cases, the exploit can also be triggered by performing a man-in-the-middle attack (see new zeus banking trojan) while the victim is on an unsecured Wi-Fi network.