Android bug let hackers spread malware, fixed

Millions of devices with older OS still face malware risk

install the app with one tap, without any security warning.

While the lack of a notification sounds unimportant, it has turned out to be a major issue in android’s security model. android devices aren’t allowed to install apps from ‘unknown sources’ — as anything installed from outside the official Play Store is considered untrusted and unverified.

If users want to install an app from outside the

Play Store, they have to visit the ‘Install apps from unknown sources’ section of their android OS and enable the feature.

Until android 8, this option was a system-wide setting, the same for all apps. But, since android 8, Google re-designed this mechanism into an appbased setting.

In latest android versions, users can visit the ‘Install unknown apps’ section in android’s security settings, and allow specific apps to install other apps. For example, the Chrome and Dropbox android apps are allowed to install apps, similar to the Play Store app, without being blocked.

The bug resided in the fact that the android Beam app was also whitelisted, receiving the same level of trust as the official Play Store app.

Google said it wasn’t meant to happen, as the android beam service was never meant as a way to install applications, but merely as a way to transfer data from device to device.

The October 2019 android patches removed the android Beam service from the OS whitelist of trusted sources.

However, many millions of users remain at risk. If users have the NFC service and the android Beam service enabled, a nearby attacker could plant malware on their phones.

Since there’s no prompt for an install from an unknown source, tapping the notification starts the malicious app’s installation. Also, there’s a danger that many users might misinterpret the message as coming from the Play Store, and install the app, thinking it’s an update.

— Agencies