Google's Android OS Has Security Flaw, Researcher Claims - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Government // Enterprise Architecture
News
10/27/2008
03:51 PM
50%
50%

Google's Android OS Has Security Flaw, Researcher Claims

The vulnerability is in the browsers and could potentially enable a hacker to have access to information the browser may use such as cookies and saved passwords.

Google's Android operating system is vulnerable to a serious security flaw, according to researchers from Independent Security Evaluators.

The vulnerability is in the browsers and could potentially enable a hacker to have access to information the browser may use such as cookies, saved passwords, and other sensitive information.

"A user of an Android phone who uses the Web browser to surf the Internet may be exploited if they visit a malicious page," the researchers wrote. "Upon visiting the malicious site, the attacker can run any code they wish with the privileges of the Web browser application. We have a very reliable exploit for this issue for demonstration purposes. This exploit will not be released until a fix is available."

Android is an open source operating system that uses more than 80 different open source packages. The security flaw comes from Google not using the most up-to-date version of these packages, ISE said.

"In other words, this particular security vulnerability that affects the G1 phone was known and fixed in the relevant software package, but Google used an older, still vulnerable version."

The security company did say that any attack would be limited because the Android's security architecture is "very well constructed." For example, an attacker would not be able to get access to the phone's dialer because Android "sandboxes" each applications.

The security researchers said they contacted Google regarding the flaw Oct. 20, two days before the first Android-powered G1 went on sale.

"We treat all security matters seriously and will carefully work with our partners to investigate and update devices periodically to reduce our users' exposure," a Google spokesperson told InformationWeek. "We are working with T-Mobile to include a fix for the browser exploit, which will soon be delivered over the air to all devices, and have addressed this in the Android open source platform."

The Android platform is expected to be on multiple handsets from different manufacturers and carriers, and Google said it doesn't expect this exploit to negatively impact future developments.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Slideshows
IT Careers: 10 Industries with Job Openings Right Now
Cynthia Harvey, Freelance Journalist, InformationWeek,  5/27/2020
Commentary
How 5G Rollout May Benefit Businesses More than Consumers
Joao-Pierre S. Ruth, Senior Writer,  5/21/2020
News
IT Leadership in Education: Getting Online School Right
Jessica Davis, Senior Editor, Enterprise Apps,  5/20/2020
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Key to Cloud Success: The Right Management
This IT Trend highlights some of the steps IT teams can take to keep their cloud environments running in a safe, efficient manner.
Slideshows
Flash Poll