At the recently held Def Con 21 security conference in Las Vegas, security researcher Craig Young with Tripwire demonstrated a proof of concept for a vulnerability in the way Android handles one-click authentication for web sites and apps. The authentication method is called “weblogin” and works by generating a unique token that is used to directly authenticate users via their Google+ accounts. Young’s proof of concept demonstrated how a rogue app could steal the weblogin tokens and redirect them to an attacker. Once they have the tokens, attackers could then impersonate victims with a variety of Google services like Gmail, Google Apps, Drive, Calendar and Voice. » Read the rest
After all the commotion about the latest major security vulnerability to Android devices, you would think things on the security side of the platform would quiet down for a bit. However, that’s not the case, as a Chinese site has posted details about an application exploit similar to Bluebox’s earlier revealed loophole that would allow apps to avoid signature verification to run malicious code on an Android device. However, the vulnerability was found in older code that was replaced with a security fix, so Google was already aware of the problem and has patched it up as soon as they were made aware of it. It may take awhile for that type of security patch to hit devices in the wild, but like the Bluebox vulnerability, Google has done all they can to take care of things on their end.
If you want to read up on the specifics of the vulnerability, hit the links below. It’s a pretty small, complicated vulnerability that would be pretty tricky for malware to pull off on most devices, but it’s interesting nonetheless.
source: Sina Blog
via: Android Police
Some bad news is surfacing this weekend for owners of several popular Samsung devices. Members of XDA Developers identified a kernel exploit for devices with certain Exynos processors that could provide root access without flashing the device. According to XDA member alephzain, the vulnerability was discovered on his Samsung Galaxy S III in /dev/exynos-mem. The weakness provides full read/write rights to all physical memory. » Read the rest
We reported yesterday that there has been a major security hole discovered in Skype for Android. The vulnerabilities make it possible for third-party malicious apps to easily access your Skype files, including your profile info.
As of late yesterday, Skype officially responded on their blog with the following:
It has been brought to our attention that, were you to install a malicious third-party application onto your Android device, then it could access the locally stored Skype for Android files.
These files include cached profile information and instant messages. We take your privacy very seriously and are working quickly to protect you from this vulnerability, including securing the file permissions on the Skype for Android application.
To protect your personal information, we advise users to take care in selecting which applications to download and install onto their device.
In other words: Yes, Skype is aware of the issue. Yes, they’re working on it. No, they don’t have a fix yet. However, with as relentless as the Android community is about their privacy (and rightfully so), you can bet that we’ll see an update with fixes soon. Be sure to keep it locked here for all the latest on this issue, and let us know what you think about it in the comments.
Well we kind of already knew this, with the recent wallpaper fiasco, but here is a video interview with Anthony Leinberg (sorry if last name is misspelled!) who is a security researcher with Lookout Mobile Security. Anthony and his associates at Lookout have developed an exploit that can give them root access to a variety of Android phones, including some higher-end devices like the HTC EVO, Droid X and Droid Incredible. Just check out the video and watch for yourself: