Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Android Installer Hijacking Vulnerability Could Expose Android Users to Malware

Summary: Unit 42 at Palo Alto Networks discovered a Time-of-Check to Time-of-Use vulnerability in Android's PackageInstaller, which it calls Android Installer Hijacking, that lets an attacker replace or modify an APK during installation so the user gets a different app with different permissions than the one they reviewed. The flaw affected APKs downloaded to unprotected local storage such as /sdcard, was estimated to impact 49.5 percent of Android users as of March 2015, and was tested against Android 2.3, 4.0.3-4.0.4, 4.1.X, 4.2.x, plus some vendors' Android 4.3 builds including Samsung Galaxy S4 and Amazon Fire OS 13.3.2.5.

Bottom line: The exploit needed no root and no user mistake beyond installing from a third-party store or an ad-hosted download, and Google's Android Security Team said it had not detected any attempts to exploit the vulnerability on user devices - meaning the 49.5 percent exposure estimate rested on silent, undetected substitution rather than observed attacks.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related