The Android Bug 8219321

There's a lot of talk about an Android security bug that affects almost all the Android devices. Jeff Forristal from Bluebox Security reported that "the vulnerability involves discrepancies in how Android applications are cryptographically verified & installed, allowing for APK code modification without breaking the cryptographic signature. Details of Android security bug 8219321 were responsibly disclosed through Bluebox Security's close relationship with Google in February 2013."

So the bug could allow someone to create a modified version of an system app and trick other people to install it. The modified version could include malicious code.

Actually, the bug is simple: APK files are ZIP archives and Android allows APK files to include files with the same name. "It's a problem in the way Android handles APKs that have duplicate file names inside," says Pau Oliva Fora, security engineer at security firm ViaForensics. "The entry which is verified for signature is the second one inside the APK, and the entry which ends up being installed is the first one inside the APK - the injected one that can contain the malicious payload and is not checked for signature at all."

The problem is that Android supported duplicate file names in APKs and the patch removed this support. The patch is extremely simple: return an error if the APK file has duplicate file names.

Apparently, Geremy Condra from Google wrote a patch in February. "Google made changes to Google Play in order to detect apps modified in this way and a patch has already been shared with device manufacturers," informs ComputerWorld. CyanogenMod included the bug fix in the latest release, faster than OEMs and even Google, which didn't update Nexus devices to address this issue.

The bug #8219321 is now a test that will show us how fast Google, OEMs and carriers can deploy security patches. For now, CyanogenMod is the place to go to get the latest features and security patches.

Google Shows Your Recent Sign-ins

There's a new section in the Google Account settings page: recent activity. Google shows a list of recent sign-ins and other security-related actions, with information about the browser, device, IP address and approximate location.

The feature seems similar to Gmail's account activity feature, but it's not. Gmail's feature shows information about about recent activity, whether it's from a browser or an email client, and it's only limited to Gmail. Google's new recent activity feature shows "security-related actions you've taken, like signing in to your Google Account, changing your password, or adding a recovery email address or phone number. This information is for your entire Google Account, so sign-ins from any Google product (such as Blogger, Gmail, or YouTube) will be listed in this section."

There's a subtle difference: "A sign-in is only listed when you've actually typed your username and password to sign in. For example, if you've been signed in to your account for several weeks on your phone, checking your email from time to time, we'll only list the time and location of your initial sign-in." That's not the case for Gmail's account activity feature, which is not limited to the initial sign-ins.

In other related news, Google has a new security dashboard that shows information about your password, recovery options, notifications for unusual activity, 2-step verification and connected applications/sites.

{ Thanks, Florian K. and Herin. }

Google Blocks Gmail's Mail Fetcher

Google has always added great security features that protect user accounts: from SSL access to most services, Google Safe Browsing, Gmail's spam and phishing filters to 2-step authentication, phone number verification and Gmail's account activity monitoring.

Sometimes Google's security features are extra paranoid and block Google's own services. I tried to use the mail fetcher feature from a secondary Gmail account and Google mentioned that the authentication failed (it's been enabled before). I entered the right password and Google still couldn't authenticate. Then Google started to show warnings in my main Gmail account, at the top of Google search pages and even sent an email and an SMS message: "Someone recently tried to use an application to sign in to your Google Account. We prevented the sign-in attempt in case this was a hijacker trying to access your account."

Google sent me to this page which says: "We detected activity on your Google Account from a location you don't usually sign in from." The IP address is 209.85.192.147 (mail-pd0-f147.google.com) and it's from United States. Obviously, it's Google's own IP address.

How to fix this issue? Go to this page, click "Yes" and "Yes - Continue". From the Google confirmation message: "As a security precaution, Google may prevent an application from accessing your account if it's the first time we've seen this application sign in to your account, or if it's attempting to sign in from a new location."

Then Google sends you to this page and you need to click "Continue" and "sign in using the application you want to authorize access to your account within the next ten minutes."

Unfortunately for Google, it wasn't even the first time when Gmail's mail fetcher was enabled. Google should find a way to make Gmail's mail fetcher work without having to jump through hoops.

Security Notifications for Google Accounts

A Google help center page mentions a new feature that will be added to the Google Account settings page: security notifications.

"Google notifies you via email and/or text message when your password is changed, and when we detect a suspicious attempt to sign in to your account. If you receive a notification about a password change you didn't make, or an attempt to sign in to your account that wasn't you, these email and text message notifications will provide details on next steps to help you secure your account," informs Google.

This feature should be available under the "security" tab of the Account Settings page, but I don't see it. Maybe it's enabled in your accounts.

In other related news, the Account Settings page has a new interface and shows information about your account activity, a large photo from your profile, Google Drive storage data.

{ Thanks, Herin. }

Android Market's Malware Scanner

Google doesn't like to manually review user-generated content. It's not efficient and algorithms can do a better job. Imagine how many people would need to be hired to watch all the videos submitted to YouTube (60 hours of videos uploaded every minute).

In some ways, uploading an application to the Android Market is just like uploading a video to YouTube. Sure, you need to pay a fee, but you don't have to wait until a Google employee checks the application. Unfortunately, this also means that the application can include malware, deceive users, crash or spam your contacts. Google usually reviewed the app only after enough users reported that the app is malicious.

Now there's a new service called Bouncer "which provides automated scanning of Android Market for potentially malicious software without disrupting the user experience of Android Market or requiring developers to go through an application approval process. The service performs a set of analyses on new applications, applications already in Android Market, and developer accounts. Here's how it works: once an application is uploaded, the service immediately starts analyzing it for known malware, spyware and trojans. It also looks for behaviors that indicate an application might be misbehaving, and compares it against previously analyzed apps to detect possible red flags. We actually run every application on Google's cloud infrastructure and simulate how it will run on an Android device to look for hidden, malicious behavior".

That seems like a great idea: Google actually tests the apps without having to wait until other users install them and notice there's something wrong. The bad news is that this service was tested last year and was used to find potentially-malicious apps. Despite that, the apps infected by DroidDream were found by a security vendor and not by Google.

"The service has been looking for malicious apps in Market for a while now, and between the first and second halves of 2011, we saw a 40% decrease in the number of potentially-malicious downloads from Android Market. This drop occurred at the same time that companies who market and sell anti-malware and security software have been reporting that malicious applications are on the rise," says Google. Another explanation could be that Google's service is not good enough.

Google also says that Android "makes malware less potent" because it uses sandboxing, it displays the list of permissions and Android Market can remotely remove malware. I don't think that most of the users read the list of permissions. They simply ignore them, click "OK" and install the application. Maybe it would be a better idea to require users to explicitly enable sensitive permissions when they're using the apps.

While security vendors try to scare Android users and push their products, Google should focus on removing spam and malware from the Android Market and make it a safer place. Improving Android's security model and finding ways to install security updates faster are also important.