Click to Skip Ad
Closing in...

Major security flaw discovered in Android

Published Apr 16th, 2014 10:36AM EDT
Android Phishing Apps Security Flaw

If you buy through a BGR link, we may earn an affiliate commission, helping support our expert product labs.

Security firm FireEye has discovered a major security flaw in Google’s mobile operating system, ComputerWorld reports, which could allow an attacker to modify the behavior of an app icon in the launcher in order to send users to a malicious site that would collect personal data. It’s not clear whether any apps in the Google Play Store, or anywhere else, have already used this particular security issue to steal data from users. Google has apparently acknowledged the problem and already released a patch to OEM partners, though it will be a while until the fix hits affected Android devices.

“Many Android vendors were slow to adapt security upgrades. We urge these vendors to patch vulnerabilities more quickly to protect their users,” the company wrote.

For the purpose of demonstrating the flaw, FireEye published its Android app in the Play Store, proving that Google’s filters won’t prevent such phishing apps from being brought to the app store. Once installed on a device, the application would then be able to covertly take over the icon of certain apps – such as mobile banking applications – and send users to malicious websites that would then trick them into entering their personal details.

The app apparently uses “normal” app permissions, with FireEye having demoed its proof-of-concept attack on a Nexus 7 running Android 4.4.2. The company also said that apps with this phishing feature could work on many other devices, including smartphones and tablets that don’t use the “Launcher” functionality in AOSP – the company tested a Galaxy S4 running Android 4.3, a HTC One on Android 4.4.2 and a Nexus 7 running CyanogenMod 11, coming up with the same results.

Recently, Google issued an update to ‘Verify apps’ security feature to better monitor app behavior on a smartphone. Before that, it was discovered that legit Google Play Store apps were able to covertly turn millions of devices in miners for digital currency.

Chris Smith Senior Writer

Chris Smith has been covering consumer electronics ever since the iPhone revolutionized the industry in 2008. When he’s not writing about the most recent tech news for BGR, he brings his entertainment expertise to Marvel’s Cinematic Universe and other blockbuster franchises.

Outside of work, you’ll catch him streaming almost every new movie and TV show release as soon as it's available.