Android less than four years at risk - Computerworld Portugal

Bluebox Security experts say they have detected a vulnerability in the operating system Android, which purport to explain in detail during the Black Hat conference in late July. The weakness has to do with differences in how om system makes verification measures for encrypting Android: allows an attacker to modify the application packages (APK) without breaking the encryption of the same signatures.

When you install an application and it creates a “secluded” (sandbox), and Android registers the digital signature of this application, explains the director of BlueBox, Jeff Forristal. All subsequent updates, must match this signature to verify that they are from the same author, the expert continues.

This is a significant event for the security model of Android, because it ensures that sensitive data stored by an application in an isolated area can only be accessed by a new version of the application signed with the key of the original author. The vulnerability, which has existed since at least version 1.6 of Android, called Donut, lets add malicious code infecting packages without breaking security measures.

This means that potentially can affect any Android device, sold over the past four years. Depending on the application, an attacker can exploit this flaw to steal data or create a mobile botnet say experts.