uncovering Android Master Key affects almost all android device

Security research team BlueBox has discovered a bug in Google’s Android operating system which could make 99 percent of all devices vulnerable to a frightening attack. A vulnerability in the OS could theoretically allow attackers to take control of an otherwise legitimate app. From here the attacker could steal information or control the device itself.
According to BlueBox CTO Jeff Forristal, this vulnerability has been present in Android for the last four years and could affect as many as 900 million devices around the world. BlueBox alerted Google about this vulnerability in February and will explain how the bug affects Android later this month at the Black Hat USA Security Conference in Las Vegas, Nevada.
“The vulnerability involves discrepancies in how Android applications are cryptographically verified & installed, allowing for APK code modification without breaking the cryptographic signature,” writes Forristal on the BlueBox corporate blog.
“All Android applications contain cryptographic signatures, which Android uses to determine if the app is legitimate and to verify that the app hasn’t been tampered with or modified. This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been.”

Bluebox's corporate blog and how to scan for the vulnerability

Read also comments from others:

blackhat 2013 conference

David Meyer's blog

bug explained and patch from Google

ZDNet 's truth about latest Google security scare

Symantec on this bug and situation in China

留言

這個網誌中的熱門文章

CMOS sensor trends and astrophotography, from amateur astronomers perspective

Nowadays, even in low light conditions, digital camera can quality pictures with higher ISO, noise and hot pixels have been gradually reduced. Sony has introduced back illumination process for consumer market. Sony BSI sensors evolved from Exmor to now Exmor RS( stacked) technology. This stacked technology allows further chip size reduction, which has strong demands in smartphone camera market. Digital astrophotography is also benefited from such advances, utilising Back Side Illumination technology Exmor: Within the CMOS sensor, it outputs low-noise digital signals by "on-chip column AD conversion" and "dual noise reduction" to suppress noise in the first half of the process In low light conditions, when a wide aperture is desirable to collect as much light as possible. At apertures wider than f/2.0, back-illuminated Exmor R sensors are significantly more efficient at collecting light than conventional, front-illuminated sensor...

閱讀完整內容

ultrafast rendezvous to ISS

14 Oct 2020, being the first to use a new “ultrafast” rendezvous” scheme with the ISS. Following a flawless ascent to the correct orbit, Soyuz 2 .1a , Soyuz MS-17 caught up with the orbiting laboratory in only two orbits (three hours), halving the time it takes for crew to get to the Station. The three space travelers of the Soyuz MS-17 mission launched on a six-month mission the International Space Station. previous 3/4 orbit rendezvous: Soyuz MS-16 4 orbit rendezvous A three-orbit profile was deemed possible without major flight design changes after inauguration of the Soyuz 2-1A rocket that provides a much higher orbit injection accuracy than its predecessors and would allow the two correction maneuvers on Orbit #2 to be eliminated while the Automated Rendezvous Phase would still remain untouched. The deletion of the Orbit #2 maneuvers was expected to slightly tighten the already restrictive phase angle window from and upper limit of 30-35° to 25-28°...

閱讀完整內容

Scythians 斯泰基塞種西古提人

900 BC - 200 AD British museum Tomb of scythe prince, Buktarma valley, 1200 masl, Google map Herodotus 絲路上的帝國 Biblegeography 哥羅西書 3：11 在此並不分希利尼人、猶太人、受割禮的、未受割禮的、化外人、西古提人、為奴的、自主的．惟有基督是包括一切、又住在各人之內。塞種塞迦 saka 史記漢書西域傳：塞種 ctext 昔匈奴破大月氏，大月氏西君大夏，而塞王南君罽賓。塞種分散，往往為數國。自疏勒以西北，休循、捐毒之屬，皆故塞種也。匈奴列傳 Ctext ：塞王《史記》在《大宛列傳》與《匈奴列傳》中，詳細記錄了中亞至天山一帶的塞種（塞王、塞地）狀況。例如，文中記載了月氏西破走塞王，導致塞人南遷越過懸度（今帕米爾高原及克什米爾一帶） Baike Genetic history Genetics Nih griffin ? Scytho-Siberian world 塞迦 saka wiki Disappeared? Sarmatians （薩爾馬泰，奄蔡史記 , Aorsi ）and goths YouTube

閱讀完整內容

Hello!! It's Joseph

搜尋此網誌