Android malware risk – Bluebox discovers Android ‘Fake ID’ flaw


Image: Bluebox

65% of smartphone owners worldwide use the Android operating system according to figures from GlobalWebIndex (GWI). Are you one of them? You might have a problem…

Millions of Android users could be at risk from mobile malware – and will have been since 2010 if they haven’t updated their OS to Android 4.4 (KitKat) – according to Bluebox Labs, which has discovered a flaw that it’s named ‘Fake ID’.

Fake ID exploits the way Android handles apps’ certification signatures, allowing malware to be inserted into apps. Jeff Forristal of Bluebox explains:

“The Android package installer makes no attempt to verify the authenticity of a certificate chain; in other words, an identity can claim to be issued by another identity, and the Android cryptographic code will not verify the claim”.

Google has already issued a patch which has been distributed to Android partners and the Android Open Source Project, but with an estimated 82.1% of Android users running an old version of the operating system, millions of devices are still at risk.

Mobile malware is a rapidly increasing threat which many people discount, but the importance of keeping your devices up to date cannot be overstated. If you use mobile banking or social networking apps you could be leaving your personal information open to exploitation.

If you’re running Android 2.1 to Android 4.3 you will not have been sent the fix, and your device is still vulnerable.