Security researchers have discovered what is believed to be the
first security flaw in
Google's open source Android operating system.
The open source process is partly blamed for the flaw by the
researchers, as it has caused confusion among software engineers as
to which secure component in the OS should be used.
:
T-Mobile has just launched the first G1 mobile device equipped
with
Android, and Google is now working with the researchers to
rectify the reported problem.
Charlie Miller, Mark Daniel, and Jake Honoroff of
Independent Security
Evaluators have identified and exploited a security
vulnerability in Android.
They said, "The first commercial phones with Android are being
shipped with the vulnerability present and may pose a security risk
to their users until an update becomes available."
Android is based on more than 80 different open source packages.
The researchers said the vulnerability "is due to the fact Google
did not use the most up to date versions of all these packages. In
other words, this particular security vulnerability that affects
the G1 phone was known and fixed in the relevant software package,
but Google used an older, still vulnerable version."
They said, "So as not to inform the 'bad guys', we will not
release any further information on the particular vulnerability or
software package until a fix is available."
They would say only that a user of an Android phone who uses the
web browser to surf the internet may be exploited if they visit a
malicious page. Upon visiting the malicious site, the attacker can
run any code they wish with the privileges of the web browser
application.
"We have a very reliable exploit for this issue for
demonstration purposes. This exploit will not be released until a
fix is available."
The same researchers have recently reported security
vulnerabilites in Apple iPhone.