Security News Android Security Flaw Lets Malware Bypass Permission Check, Read Device Info

[Bot]

A security flaw in Android allows malicious apps to bypass permission checks and thus obtain access to read more information they were supposed to, including details that could allow malware to track device location.

Discovered by Nightwatch Cybersecurity, the vulnerability affects all versions of Android except for the recently-released Pie. The security hole is detailed in CVE-2018-9489 and is unlikely to get any fix, according to the advisory.

“The vendor fixed these issues in Android P / 9. Because this would be a breaking API change, the vendor does not plan to fix prior versions of Android. Users are encouraged to upgrade to Android P / 9 or later,” Nightwatch Cybersecurity notes.

As to how the vulnerability can be exploited, the research indicates that malicious apps can listen to system broadcasts in order to bypass permission checks and get access to specific device information.

Read more: Android Security Flaw Lets Malware Bypass Permission Check, Read Device Info

 

[DeepWeb]

So basically 99.9% of Android users are affected and no patch for those phones. Great.

 

[509322]

So basically 99.9% of Android users are affected and no patch for those phones. Great.

This is nothing new. It's been like this for years. But people just keep on buying Android phones and downloading tons of unknown droid apps.

One of these days some malDroid coder is gonna teach the world the mother of all IT security lessons.

 

[RejZoR]

This is nothing new. It's been like this for years. But people just keep on buying Android phones and downloading tons of unknown droid apps.

One of these days some malDroid coder is gonna teach the world the mother of all IT security lessons.

Like there are any other options? It's either Android or iOS. And if you hate Apple, you're stuck with Android. All the other phone operating systems quite frankly suck, have no support or have next to zero useful apps. Until Google changes the policy of forced OS updating things will never change because majority of vendors just plain don't care.

It's the same argument as with people hating Microsoft for forcing everyone to use Windows 10 and that being the latest possible version in just few months time. While we all hate their fast cycle and bugs, from a security perspective, it's the only logical way.

 

[LDogg]

If most stuck to the official app store (Google Play). Even then there are some malwares on the store. Either way on the app store should be safe with some common sense

~LDogg

 

[AriDfoix]

Even if this not solve anything, I suggest take a look at this application:

8enet/AppOpsX

index - powered by h5ai v0.29.0 (https://larsjung.de/h5ai/)

It has a very informative GUI for permission management...

 

[Ink]

So basically 99.9% of Android users are affected and no patch for those phones. Great.

Get a better phone. /s

OnePlus 3/T owners will get Android Pie, as well as most Oreo users.

I doubt the majority will actually be affected, but who knows, tomorrow you'll download an APK and get malware that exploits this flaw. LOL

 

[DeepWeb]

Even if this not solve anything, I suggest take a look at this application:

8enet/AppOpsX

index - powered by h5ai v0.29.0 (https://larsjung.de/h5ai/)

It has a very informative GUI for permission management...

What's the difference between this and the regular AppOps app?

 

[AriDfoix]

What's the difference between this and the regular AppOps app?

Personally, I like more the design and the last time a permission was used, it has a more expanded informative tab and is free.

The other one has integration with the Island by oasisfeng, but for my network model, suits better the first.