Computer scientist uncovers Android SMS phishing vulnerability
Network World - A researcher at North Carolina State University has uncovered a vulnerability that could be exploited to send deceptive text messages from some Android devices, as part of a phishing scheme.
MORE ON ANDROID: Hottest Android news and rumors for the week ending Nov. 2
Particularly worrisome is the fact that the vulnerability doesn't need any elevated app permissions in order to function, said NCSU computer science professor Xuxian Jiang.
"The vulnerability allows a running [untrusted] app on the phone to fake an incoming SMS text message with arbitrary content, including the text message itself as well as the 'sending' phone number, which can be your friend in the contact list or simply your trusted banks," Jiang said in an email to Network World.
The flaw is apparently present in the Android Open-Source Project, and some versions of the software ranging from 1.6 (Donut) to 4.1 (Jelly Bean) are vulnerable. Jiang said that his team has been able to exploit it on the Samsung's Galaxy Nexus, Nexus S and Galaxy S III, HTC's One X and Inspire, and the Xiaomi MI-One.
Jiang praised Google for reacting quickly, confirming the presence of the vulnerability within two days of receiving the team's report. In the email, he expressed hope that a rapid patch would be forthcoming.
Jiang did not provide full technical details of the flaw, citing responsible disclosure issues, although he did describe the vulnerability as difficult to detect but easy to exploit, once found.
Jiang has been at the forefront of the discovery of several other Android security flaws, including, in June, a rootkit attack that might have allowed malicious software to be concealed on an affected device. He is the founder of the Android Malware Genome Project, an academic investigation of security threats affecting the platform.
Email Jon Gold at email@example.com and follow him on Twitter at @NWWJonGold.
Read more about software in Network World's Software section.
- Pragmatic Endpoint Management: Empowering an SMB Workforce in the Age of Mobility Lacking the time for proper training and education, SMB administrators often resort to taking shortcuts to keep their environment running.This paper discusses the...
- Improve Your Mobile Application Security with IBM Worklight IBM® Worklight helps organizations extend their business across multiple mobile devices. It provides an open, comprehensive and advanced mobile application platform to help...
- Top 3 Iron-Clad Reasons Why File Sync/Share is Not Endpoint Backup Employees unknowingly create corporate data security risks by adopting these easy-to-use, personal applications. Read this executive brief to learn more.
- Security Technologies for Mobile and BYOD With so many security technologies available, how do you sort through the options and pick the solutions that will really work for your...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Mobile Security White Papers | Webcasts
Our new weekly Consumerization of IT newsletter covers a wide range of trends including BYOD, smartphones, tablets, MDM, cloud, social and what it all means for IT. Subscribe now and stay up to date!