Android News

Black Hat hackers show off Android vulnerabilities in NFC and Google Play Store

July 26, 2012 | by Andrew Kameka



Google, like all tech companies, is in a constant battle with hackers to expose and close security holes in products like Android. At the Black Hat conference in Las Vegas, hackers demonstrated multiple ways in which they could take advantage of those vulnerabilities and compromise an Android device.

One vulnerability manages to outsmart the Bouncer feature designed to keep malware out of the Google Play Store. A pair of researchers from Trustwave Security claim that they sidestepped Bouncer by introducing an app with completely legitimate purposes that is free of malware. It then used Java script bridge to add new features without requiring the user visit the Play Store. Adding malicious code through script bridge could allow a developer to download code that turns over more control and information for seedy purposes.

Another trick on display was Accuvant’s Charlie Miller claiming that he can “take over your phone” using near field communication. Miller says a stamp-sized device placed near a register or other unsuspecting location could “infect” an Android phone. However, the “near” in NFC requires very close proximity based on current set-up, so the feasibility of a real world attack is questionable. A similar NFC attack was discussed that focused on gaining payment information from sales terminals, which seems to be a more likely threat.

Neither the Google Play Bouncer workaround nor the NFC attacks are yet cause for major concern. These hacks were revealed at the Black Hat conference and not some seedy criminal organization meeting, so there’s a greater chance of these security holes being patched before they can widely be deployed and used to attack users. By nature, these presentations are typically done to make companies wiser and recognize vulnerabilities that they missed. The bigger concern may be how quickly and effectively those patches are implemented. One hack discussed at the conference was for a vulnerability Google has already fixed that not all carriers pushed to customers.