On June 30,
the IBM researchers found that about 86% of the Android there is a hole in the mobile phone. Hackers can take advantage of sensitive user information, including the banking services and virtual private network (VPN) key, and is used to unlock the device PIN or graphics.
the flaw in the Android KeyStore, which is a sensitive area of the Android system, specially used to store the key and the similar identity information. With the aid of the vulnerability, hackers can execute malicious code to get the user’s sensitive information. Researchers say that Google only in Android 4.4 kit kat mend this hole in the system, the other version is still under the influence of the problem. The users in all affected accounted for about 86.4% of Android users.
if hackers want to successful use of the loophole, must overcome a number of technical obstacles. The Android system USES the modern software protection measures, including data execution prevention model, and solved the problem of spatial layout randomization. These two functions will cause difficulties hackers execute malicious code.
the hacker must also be installed on the mobile phone under the influence of this loophole. However, due to exist in Android is most sensitive KeyStore, so the vulnerability is very serious.
rice, a professor of computer science at the university of Android security expert Dan WoLeiKe (Dan Wallach) explained: “generally, the application of authentication information will be stored in here, so if breached the KeyStore, so when a user has a corresponding application on your mobile phone, you can pretend to be mobile phone users to log on to the service. At least also can remember the password login service. This means that the most force you to enter a password every time bank of application, perhaps in response to this attack is relatively safe.”
hackers can take advantage of the vulnerability into the user’s Twitter account release garbage information, also can steal bank deposits. And if they steal the user’s VPN authentication data, you can bypass firewall on a variety of attacks.
security company viaForensics senior mobile security engineer, Paula Oliva (Pau Oliva), said the holes also can cause other threats, because it will allow hackers to access to the Android resource encrypt sensitive task. “Take advantage of this loophole, hackers can fake smartphone owners, generating RSA key and signature and authentication.” Oliva said.
Google may through the Bouncer service for the user to provide additional protection, but often by hackers to bypass this mechanism. It seems that often use Android devices for money transaction and transmission of important data users, still had better be careful when it is applied in the installation. Through channels other than Google Play when installing applications also should be careful. (book Yu)
source: sina science and technology