Google's Android OS Has Security Flaw, Researcher Claims - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Government // Enterprise Architecture
03:51 PM

Google's Android OS Has Security Flaw, Researcher Claims

The vulnerability is in the browsers and could potentially enable a hacker to have access to information the browser may use such as cookies and saved passwords.

Google's Android operating system is vulnerable to a serious security flaw, according to researchers from Independent Security Evaluators.

The vulnerability is in the browsers and could potentially enable a hacker to have access to information the browser may use such as cookies, saved passwords, and other sensitive information.

"A user of an Android phone who uses the Web browser to surf the Internet may be exploited if they visit a malicious page," the researchers wrote. "Upon visiting the malicious site, the attacker can run any code they wish with the privileges of the Web browser application. We have a very reliable exploit for this issue for demonstration purposes. This exploit will not be released until a fix is available."

Android is an open source operating system that uses more than 80 different open source packages. The security flaw comes from Google not using the most up-to-date version of these packages, ISE said.

"In other words, this particular security vulnerability that affects the G1 phone was known and fixed in the relevant software package, but Google used an older, still vulnerable version."

The security company did say that any attack would be limited because the Android's security architecture is "very well constructed." For example, an attacker would not be able to get access to the phone's dialer because Android "sandboxes" each applications.

The security researchers said they contacted Google regarding the flaw Oct. 20, two days before the first Android-powered G1 went on sale.

"We treat all security matters seriously and will carefully work with our partners to investigate and update devices periodically to reduce our users' exposure," a Google spokesperson told InformationWeek. "We are working with T-Mobile to include a fix for the browser exploit, which will soon be delivered over the air to all devices, and have addressed this in the Android open source platform."

The Android platform is expected to be on multiple handsets from different manufacturers and carriers, and Google said it doesn't expect this exploit to negatively impact future developments.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
How GIS Data Can Help Fix Vaccine Distribution
Jessica Davis, Senior Editor, Enterprise Apps,  2/17/2021
Graph-Based AI Enters the Enterprise Mainstream
James Kobielus, Tech Analyst, Consultant and Author,  2/16/2021
11 Ways DevOps Is Evolving
Lisa Morgan, Freelance Writer,  2/18/2021
White Papers
Register for InformationWeek Newsletters
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you.
Flash Poll