A new loophole in the name of Certifi-Gate can cause harm to Android phones




The researchers Ohad Bobrov and Avi Bashan out of the company announced Check Point security for their discovery of a new loophole in the system Android bearing the name Certifi-gate , and is this gap by exploiting the support tools remote mobile or the so-called Acronym mRSTs, which operates in a manner similar to a strain of malicious programs known as Trojan Trojan remote access or mRATs.

And is used mSRTs software by many for many applications such as LogMeIn and TeamViewer, and are used these applications for troubleshooting, where can these tools remote access to the phone, and do many other things, access to all the contents of your phone data, such as contacts and messages and everything the user is doing on the phone.

While mRATs malicious software needs to be installed manually by the attackers within the victim’s phone, the advantage that it mSRTs software comes pre-installed on the phone by the manufacturers of phones and has full control on the phone, and this is the way the researchers exploited.

The list of manufacturers of phones who they include such applications several companies such as Samsung, LG, HTC, Huawei and Lenovo, which means that millions of phones may be at risk, also means that the potential danger caused by this gap no less dangerous than a gap Stagefright .

In order to know the modus operandi of this gap must initially get an idea of ​​Kiffa work mSRTs software, as mSRTs software you need for broad powers on the phone in order to work correctly, and so associated with these software applications work properly, they need special permissions certified by the manufacturers of phones themselves.

The software is divided into two parts mSRTs are the actual application that the user sees and uses it, the other part is present in the background extras not seen by the user or deal with, these additions are that provide permissions for these applications.

When the work of one of these applications require special permissions on your phone to complete its work properly, and the application in this case does not have such permissions, who shall contact additions in the background and is responsible for granting the necessary permissions to complete its work.

The researchers indicate that it is possible the existence of such additions even though the phones were not contain Related applications running on the phone.

In order to verify the applications that send requests for permissions is a reliable applications to manufacturers of phones to build their own documentation tools strapped system Android, and this way companies ensure that there is no ratification process permissions are on their own.

The researchers have been exploiting this duality and they exploit additions and control and thus obtained the full control on the phone.

And to provide practical explain the researchers tested the gap on the application of TeamViewer, where they found that the documentation which the application asks for permissions based on the verification of the serial number of the certificate program, which the researchers Bathbath by making application with the same serial number and were able to deceive mSRTs extras in the background and obtaining the required permissions and thus obtained full control of the phone.

What makes matters worse is that these additions signed by the manufacturers of phones, so the user try to stop certificates to avoid problems would expose him to greater problems with the operating system, so the best way to solve the problem is the manufacturers of phones to work on manufacturing more robust documentation system between applications and additions.

The researchers pointed out that the problem of the Android system is that it is fragmented, and this is what appeared through a gap Stagefright, and figures show that almost on the launch of version Android 5.0 after year are not installed, but accounted for only 18% of the total operating hardware system Android in general, and therefore Analysts that even if solutions are found and the manufacturers to provide system updates and filling gaps periodically the arrival of these updates and fixes for all users of Android phones in various publications very slim chances.


In: A Technology & Gadgets Asked By: [20342 Red Star Level]

Answer this Question

You must be Logged In to post an Answer.

Not a member yet? Sign Up Now »