Researchers find big leaks in pre-installed Android apps

[LiberalArkie]

<http://arstechnica.com/tech-policy/news/2011/11/researchers-find-big-leaks-in-pre-installed-android-apps.ars>


Researchers at North Carolina State University have uncovered a variety of vulnerabilities in the standard configurations of popular Android smartphones from Motorola, HTC, and Samsung, finding that they don't properly protect privileged permissions from untrusted applications. In a paper just published by researchers Michael Grace, Yajin Zhou, Zhi Wang, and Xuxian Jiang, the four outlined how the vulnerabilities could be used by an untrusted application to send SMS messages, record conversations, or even wipe all user data from the handset without needing the user's permission.

The researchers evaluated the security of eight phones: the HTC Legend, EVO 4G, and Wildfire S; the Motorola Droid and Droid X; the Samsung Epic 4G; and the Google Nexus One and Nexus S. While the reference implementations of Android used on Google's handsets had relatively minor security issues, the researchers were "surprised to find out these stock phone images do not properly enforce permission-based security model." The team shared the results with Google and handset vendors, and have received confirmation of the vulnerabilities from Google and Motorola. However, the researchers have "experienced major difficulties" in trying to report issues to HTC and Samsung.

snip


By exploiting these leaks, the researchers found "an untrusted app on these affected phones can manage to wipe out the user data on the phones, send out SMS messages (e.g., to premium numbers), record user conversation, or obtain user geo-locations—all without asking for any permission."

[Speck Tater]

1. I'm so glad my cheep cellphone doesn't do aps. nt

[REP]

2. But will they perform abortions?

:sarcasm: