Google's Android OS Has Security Flaw, Researcher Claims - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Government // Enterprise Architecture
News
10/27/2008
03:51 PM
50%
50%

Google's Android OS Has Security Flaw, Researcher Claims

The vulnerability is in the browsers and could potentially enable a hacker to have access to information the browser may use such as cookies and saved passwords.

Google's Android operating system is vulnerable to a serious security flaw, according to researchers from Independent Security Evaluators.

The vulnerability is in the browsers and could potentially enable a hacker to have access to information the browser may use such as cookies, saved passwords, and other sensitive information.

"A user of an Android phone who uses the Web browser to surf the Internet may be exploited if they visit a malicious page," the researchers wrote. "Upon visiting the malicious site, the attacker can run any code they wish with the privileges of the Web browser application. We have a very reliable exploit for this issue for demonstration purposes. This exploit will not be released until a fix is available."

Android is an open source operating system that uses more than 80 different open source packages. The security flaw comes from Google not using the most up-to-date version of these packages, ISE said.

"In other words, this particular security vulnerability that affects the G1 phone was known and fixed in the relevant software package, but Google used an older, still vulnerable version."

The security company did say that any attack would be limited because the Android's security architecture is "very well constructed." For example, an attacker would not be able to get access to the phone's dialer because Android "sandboxes" each applications.

The security researchers said they contacted Google regarding the flaw Oct. 20, two days before the first Android-powered G1 went on sale.

"We treat all security matters seriously and will carefully work with our partners to investigate and update devices periodically to reduce our users' exposure," a Google spokesperson told InformationWeek. "We are working with T-Mobile to include a fix for the browser exploit, which will soon be delivered over the air to all devices, and have addressed this in the Android open source platform."

The Android platform is expected to be on multiple handsets from different manufacturers and carriers, and Google said it doesn't expect this exploit to negatively impact future developments.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Slideshows
Strategies You Need to Make Digital Transformation Work
Joao-Pierre S. Ruth, Senior Writer,  11/25/2019
Commentary
Enterprise Guide to Data Privacy
Cathleen Gagne, Managing Editor, InformationWeek,  11/22/2019
News
Watch Out: 7 Digital Disruptions for IT Leaders
Jessica Davis, Senior Editor, Enterprise Apps,  11/18/2019
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Getting Started With Emerging Technologies
Looking to help your enterprise IT team ease the stress of putting new/emerging technologies such as AI, machine learning and IoT to work for their organizations? There are a few ways to get off on the right foot. In this report we share some expert advice on how to approach some of these seemingly daunting tech challenges.
Slideshows
Flash Poll