If you’re still thinking about Stagefright when it comes to the security of your Android phone, we’re past that now. Now you have to worry about Certifi-Gate. According to Check Point, the flaw comes from software like TeamViewer, CommuniTake Remote Care and MobileSupport by Rsupport. All of these are remote access tools that allows someone to take control of your phone remotely for troubleshooting purposes. The problem is that apps like these have root level access to the device which means that they can do anything they want. All that’s required to leverage that if you’re a bad guy is an app designed to look for this vulnerability.
Bad news. Those apps are in the wild as I type this.
Now Check Point released an app that allows Android users to check if their particular device is susceptible to the vulnerability. But that won’t do you any good because if you find it and nuke it, permissions for remote access are still present in the device. So some other app can take advantage of this. Thus the real fix has to come from Google. Given how fragmented Android is, that may take while. In the meantime, the document from Check Point that I linked to has some mitigation strategies. They’re worth a read.
Related
This entry was posted on August 26, 2015 at 1:54 pm and is filed under Commentary with tags Google, Security. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Android Phones Threatened By New Vulnerability Dubbed “Certifi-Gate”
If you’re still thinking about Stagefright when it comes to the security of your Android phone, we’re past that now. Now you have to worry about Certifi-Gate. According to Check Point, the flaw comes from software like TeamViewer, CommuniTake Remote Care and MobileSupport by Rsupport. All of these are remote access tools that allows someone to take control of your phone remotely for troubleshooting purposes. The problem is that apps like these have root level access to the device which means that they can do anything they want. All that’s required to leverage that if you’re a bad guy is an app designed to look for this vulnerability.
Bad news. Those apps are in the wild as I type this.
Now Check Point released an app that allows Android users to check if their particular device is susceptible to the vulnerability. But that won’t do you any good because if you find it and nuke it, permissions for remote access are still present in the device. So some other app can take advantage of this. Thus the real fix has to come from Google. Given how fragmented Android is, that may take while. In the meantime, the document from Check Point that I linked to has some mitigation strategies. They’re worth a read.
Share this:
Like this:
Related
This entry was posted on August 26, 2015 at 1:54 pm and is filed under Commentary with tags Google, Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.