Android suffers from security flaw
By Matthew Sparkes
Posted on 29 Oct 2008 at 11:07
Google's new Android operating system has serious security flaws which could leave users open to malicious attacks and phishing, claim researchers.
"A user of an Android phone who uses the web browser to surf the internet may be exploited if they visit a malicious page," warns an advisory on the Independent Security Evaluators website.
"The attacker can run any code they wish with the privileges of the web-browser application. We have a very reliable exploit for this issue for demonstration purposes."
Three employees of the security firm discovered the flaw, specific details of which are being held back until a fix is released by Google. Currently the only device using the software, and therefore vulnerable to possible attacks, is the G1 handset, which was recently released on T-Mobile.
Although the exact mechanics of the flaw are unknown, researchers claim that the cause is Google's use of older versions of open-source software.
"Android is based on over 80 different open source packages. The vulnerability is due to the fact Google did not use the most up to date versions of all these packages. In other words, this particular security vulnerability that affects the G1 phone was known and fixed in the relevant software package, but Google used an older, still vulnerable version," explains the website.
Google recently admitted that it had built a 'kill-switch' into the Android operating system which would allow it to stop the execution of any program found to be malicious on all handsets instantly.
Google today confirmed that it has developed a technical fix for the issue, and is currently working with T-Mobile to work out a way to distribute the code to existing handsets.
From around the web
advertisement
- Laptop bag reviews: nine tested
- Sony VAIO T Series Ultrabook review: first look
- Revealed: the military standards and robots HP uses to test its laptops
- Windows 8: multi-monitors and double standards?
- Why is TalkTalk's year-old porn filter suddenly big news?
- Why are laptop screens so far behind mobiles?
- HP EliteBook Folio review: first look
- The shoebox-sized all-in-one printer
- Forget the Ultrabook: here comes the HP Sleekbook
- HP Spectre XT review: first look
- Why you have to be left in the dark on OS patches
- Publishing your email address isn't a security disaster
- Why antivirus is fighting a losing battle in your office
- Four year olds used to steal their parents' data
- An acceptable use policy for your kids
- Paying for your crimes with Bitcoin
- Pavement hacking: What it is and how to avoid it
- Google's risky pre-loaded pages
- Mac under attack: how secure is Apple's OS?
- Has your browser been hijacked?
advertisement
