Android bugs allow attackers to secretly install malware

Jon Oberheide – the security researcher who has so effectively pointed out the existence of a major security bug in the Android platform nearly a year ago – has found two more.

The first one – affecting all Android handsets – is a permission escalation vulnerability that allows attackers to install additional applications on the victim’s smartphone without asking for permission or notifying the user. “It’s important to note that this attack can also be performed by compromising an existing application. This vulnerability is very similar in nature to my Angry Birds proof-of-concept app I released last year, but uses a different exploitation vector,” says Oberheide.

The second one is a Linux kernel privilege escalation bug that allows attackers to use apps with limited privileges to ultimately gain full control over the device. This one affects some of the Android devices, among which is the the Samsung Nexus S model.

Oberheide has refrained from sharing more details about the bugs, except from saying that even though Google has been notified of their existence, the two vulnerabilities are still unpatched.

He and his colleague Zach Lanier are scheduled to hold a training course on mobile security at the SOURCE Barcelona conference in November where, among other things, they will be demonstrating and explaining these vulnerabilities.