{"id":20593,"date":"2022-12-02T18:26:36","date_gmt":"2022-12-02T18:26:36","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/02\/samsung-lg-other-android-devices-vulnerable-to-malware-after-security-leak\/"},"modified":"2022-12-02T18:26:36","modified_gmt":"2022-12-02T18:26:36","slug":"samsung-lg-other-android-devices-vulnerable-to-malware-after-security-leak","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/02\/samsung-lg-other-android-devices-vulnerable-to-malware-after-security-leak\/","title":{"rendered":"Samsung, LG, other Android devices vulnerable to malware after security leak"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Google publicly disclosed a major security leak impacting devices from Samsung, LG, Xiaomi and more. The leak enabled the creation of \u2018trusted\u2019 malware apps that can gain access to the entire Android operating system.<\/p>\n

Shared by Googler \u0141ukasz Siewierski<\/a> (via 9to5Google<\/em><\/a>), Google\u2019s Android Partner Vulnerability Initiative (APVI) revealed the details, which you can view here<\/a>. The main issue is that multiple Android manufacturers had their platform signing keys leaked. Those keys ensure that the version of Android running on your device is legitimate and created by the manufacturer. However, those keys can also be used to sign individual apps, which Android trusts by design.<\/p>\n

However, a malicious actor with those signing keys could abuse that trust to give malware full, system-level permissions on an affected device since that device would see the official, signed key and, by default, trust the app. Since some manufacturers use these keys to sign relatively common apps \u2014 for example, 9to5 <\/em>points to Samsung\u2019s Bixby, which is signed with the company\u2019s key on at least some phones \u2014 attackers could add malware to a trusted app, sign it with the same key, and then Android would trust it. Worse, this malicious version of the app could come from various sources \u2014 the Play Store, Samsung\u2019s Galaxy Store, or be sideloaded.<\/p>\n

Google didn\u2019t say which devices or manufacturers were affected in its disclosure. However, the company did include hashes of example malware files, which were uploaded to VirusTotal. 9to5 <\/em>notes that VirusTotal reveals the names of some of the affected companies, which include Samsung, LG, MediaTek, Szroco (which makes \u2018Onn\u2019 tablets for Walmart), and Revoview. There are more keys as well, but they have not been identified.<\/p>\n

In the disclosure, Google recommends that manufacturers change their platform signing keys from the ones that leaked. It also urged all manufacturers to reduce how often they use those keys to avoid potential security issues. Moreover, Google said that Samsung and other affected companies took \u201cremediation measures to minimize the user impact\u201d of the security leaks after the issue was first reported in May 2022.<\/p>\n

However, 9to5Google <\/em>notes that Samsung used its vulnerable platform signing key in several Android app updates within just the last few days, based on details from APKMirror. It also remains unclear which Android devices, if any, are still vulnerable.<\/p>\n

Moreover, while Google notes the exploit was first reported in May 2022, VirusTotal first scanned some of the malware examples as early as 2016. It remains unclear whether the leak and associated exploits were actively used against anyone in that time.<\/p>\n

Google said in a statement to 9to5 <\/em>that there are several systems in place to protect people from these kinds of security vulnerabilities, such as Play Protect. The company also said that \u201cthere is no indication that this malware is or was on the Google Play Store.\u201d<\/p>\n

To protect themselves, Android users should make sure their devices are up-to-date and avoid sideloading apps.<\/p>\n

Source: Google<\/a>, \u0141ukasz Siewierski<\/a> Via: 9to5Google<\/a><\/p>\n<\/p><\/div>\n