{"id":148856,"date":"2022-12-05T16:12:13","date_gmt":"2022-12-05T16:12:13","guid":{"rendered":"https:\/\/harchi90.com\/long-running-major-vulnerability-left-millions-of-android-handsets-wide-open-to-data-theft\/"},"modified":"2022-12-05T16:12:13","modified_gmt":"2022-12-05T16:12:13","slug":"long-running-major-vulnerability-left-millions-of-android-handsets-wide-open-to-data-theft","status":"publish","type":"post","link":"https:\/\/harchi90.com\/long-running-major-vulnerability-left-millions-of-android-handsets-wide-open-to-data-theft\/","title":{"rendered":"Long-running major vulnerability left millions of Android handsets wide open to data theft"},"content":{"rendered":"
\n
According to a tweet from Google’s \u0141ukasz Siewierski<\/a> (via Mishaal Rahman<\/a>, 9to5Google), hackers and “malicious insiders” have been able to leak the platform signing keys used by several Android manufacturers to sign system apps used on Android devices. These signing keys are used to guarantee that the apps and even the Android operating system version running on your phone, are legitimate.<\/div>\n

Long-running vulnerability affected LG, Samsung, and other Android-related manufacturers
<\/h2>\n<\/p>\n

Baked into Android is a system that trusts apps signed by the same key that is used to authenticate the operating system itself. So you can see what the problem is here. A bad actor with control of these keys could have Android “trust” malware-laden apps on the system level. That is like giving a thief the keys to your home and car with your approval. Any and all data on vulnerable devices could be at risk. And some of these keys are used to sign regular apps installed from the Play Store or sideloaded from other Android app storefronts.<\/p>\n

<\/p>\n
\n
\n