Google patches Android mobile phone security vulnerability


Google patches Android mobile phone security vulnerability

Antony Savvas

Google is issuing a security patch to address the first reported vulnerability in its open source mobile phone operating system.

Google is working with T-Mobile - the sole distributor of the first G1 Android device - on getting the patch out to users. Google has not said how many G1 users there are.

The open source process is partly to blame for the flaw, said the researchers who discovered it. They said the open source process has caused confusion among software engineers as to which secure component in the OS should be used.

Charlie Miller, Mark Daniel, and Jake Honoroff of Independent Security Evaluators identified and have exploited the security in tests.

They said at the time of the flaw being made public, "The first commercial phones with Android are being shipped with the vulnerability present and may pose a security risk to their users until an update becomes available."

Android is based on more than 80 open source packages. The researchers said, "The vulnerability is due to the fact Google did not use the most up-to-date versions of all these packages. In other words, this particular security vulnerability that affects the G1 phone was known and fixed in the relevant software package, but Google used an older, still vulnerable version."

They said, "So as not to inform the 'bad guys', we will not release any further information on the particular vulnerability or software package until a fix is available."

They would say only that a user of an Android phone who uses the web browser to surf the internet may be exploited if they visit a malicious page. Upon visiting the malicious site, the attacker can run any code they wish with the privileges of the web browser application.

"We have a very reliable exploit for this issue for demonstration purposes. This exploit will not be released until a fix is available."

The same researchers have recently reported security vulnerabilites in the Apple iPhone.

Video: Android flaw >>

Email Alerts

Register now to receive IT-related news, guides and more, delivered to your inbox.
By submitting your personal information, you agree to receive emails regarding relevant products and special offers from TechTarget and its partners. You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

COMMENTS powered by Disqus  //  Commenting policy