Samsung, LG Phones Vulnerable Due to Leaked Certificates, Google Finds

[Pelican Press 0]

Samsung, LG Phones Vulnerable Due to Leaked Certificates,

This is the hidden content, please

• Sign In
• or
• Sign Up

Finds

This is the hidden content, please

• Sign In
• or
• Sign Up

’s Android Partner Vulnerability Initiative, in a major security ***** admission, has disclosed a new key vulnerability that has affected Android smartphones from major brands such as Samsung and LG, among others. Due to the leaking of the signing keys used by Android OEMs, imposter apps or malware could disguise themselves as “trusted” apps. The issue was earlier reported in May this year, following which several companies including Samsung took actions to control the vulnerability.

The security flaw was brought to light by

This is the hidden content, please

• Sign In
• or
• Sign Up

employee Łukasz Siewierski (

This is the hidden content, please

• Sign In
• or
• Sign Up

Esper’s Mishaal Rahman). Sirwierski, through his tweets, revealed how the platform certificates have been used to sign malware apps on Android.

Folks, this is bad. Very, very bad. Hackers and/or malicious insiders have leaked the platform certificates of several vendors. These are used to sign system apps on Android builds, including the “android” app itself. These certs are being used to sign malicious Android apps!

This is the hidden content, please

• Sign In
• or
• Sign Up

— Mishaal Rahman (@MishaalRahman)

This is the hidden content, please

• Sign In
• or
• Sign Up

At the heart of the issue ***** an Android platform key trusting mechanism vulnerability that could be exploited by malicious attackers. By design, Android trusts any application that uses a legitimate platform signing key, which is used to sign core system applications, through Android’s shared user ID system.

However, the Android original equipment manufacturers (OEMs) have had their platform signing keys leaked, allowing malware creators to gain system-level permissions on a target device. This would make all user data on the particular device available to the attacker, just like another system app from the manufacturer signed with the same certificate.

Another alarming part about the vulnerability is that it doesn’t necessarily require a user to install a new or an “unknown” application. The leaked platform keys could also be used to sign common trusted apps such as Bixby app on a Samsung device. A user who downloaded such an application from a third-party website would not see a warning when installing it on their smartphone, as the certificate would match the one on their system.

This is the hidden content, please

• Sign In
• or
• Sign Up

, however, has not explicitly mentioned the list of devices or OEMs that have so far been affected by the critical vulnerability in its

This is the hidden content, please

• Sign In
• or
• Sign Up

. Nevertheless, the disclosure includes a list of sample malware files. The platform has since

This is the hidden content, please

• Sign In
• or
• Sign Up

confirmed the list of affected smartphones, which include devices from Samsung, LG, Mediatek, Xiaomi and Revoview.

The search giant has also suggested ways for the affected companies to mitigate the issue at hand. The first step involves churning out Android platform signing keys that have been flagged to have been leaked and replacing them with new signing keys. The company has also urged all Android manufactures to drastically minimise the frequent use of platform key for an app to sign other apps.

According to

This is the hidden content, please

• Sign In
• or
• Sign Up

, the issue was first reported in May. Since then, Samsung and all other affected companies have already taken remedial actions to mitigate and minimise the vulnerabilities that were at hand. However, according to Android Police, some of the vulnerable keys that were listed in the disclosure were recently

This is the hidden content, please

• Sign In
• or
• Sign Up

for Samsung and LG phones uploaded to APK Mirror.

“OEM partners promptly implemented mitigation measures as soon as we reported the key compromise. End users will be protected by user mitigations implemented by OEM partners,”

This is the hidden content, please

• Sign In
• or
• Sign Up

said in a statement to BleepingComputer.

Users on Android are advised to update their firmware versions to the latest available updates in order to remain protected from potential security flaws such as the one disclosed by

This is the hidden content, please

• Sign In
• or
• Sign Up

, and to be vigilant while downloading apps from third-party sources.

---

Affiliate links may be automatically generated – see our ethics statement for details.

This is the hidden content, please

• Sign In
• or
• Sign Up

samsung lg

This is the hidden content, please

• Sign In
• or
• Sign Up

android certificate ***** vulnerability apvi breach

This is the hidden content, please

• Sign In
• or
• Sign Up

,android,android partner vulnerability initiative,apvi,samsung,lg,xiaomi
#Samsung #Phones #Vulnerable #Due #Leaked #Certificates #

This is the hidden content, please

• Sign In
• or
• Sign Up

#Finds

This is the hidden content, please

• Sign In
• or
• Sign Up