{"id":21163,"date":"2022-12-05T23:51:15","date_gmt":"2022-12-05T23:51:15","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/05\/compromised-android-keys-used-to-sign-info-stealing-malware-the-register\/"},"modified":"2022-12-05T23:51:15","modified_gmt":"2022-12-05T23:51:15","slug":"compromised-android-keys-used-to-sign-info-stealing-malware-the-register","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/05\/compromised-android-keys-used-to-sign-info-stealing-malware-the-register\/","title":{"rendered":"Compromised Android keys used to sign info-stealing malware \u2022 The Register"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

Compromised Android platform certificate keys from device makers including Samsung, LG and Mediatek are being used to sign malware and deploy spyware, among other software nasties.<\/p>\n

Googler \u0141ukasz Siewierski found and reported<\/a> the security issue and it’s a doozy that allows malicious applications signed with one of the compromised certificates to gain the same level of privileges as the Android operating system \u2014 essentially unfettered access to the victim’s device.<\/p>\n

As explained in a Android Partner Vulnerability Initiative (AVPI) security alert<\/a>:<\/p>\n

Also in the alert, Google listed 10 malware samples and related SHA256 hashes, and recommended all affected smart-device vendors rotate their platform certificates.\u00a0<\/p>\n

“We also strongly recommend minimizing the number of applications signed with the platform certificate, as it will significantly lower the cost of rotating platform keys should a similar incident occur in the future,” the AVPI said.<\/p>\n

\n