Mitigating Android Security Vulnerabilities on Company-Owned Devices with 42Gears’ UEM Solution

Critical Android Security Vulnerabilities

This is how Google classifies Android security vulnerabilities and ranks them by severity. Let's take a closer look at these vulnerabilities, see how they are commonly exploited, and what kinds of threats they pose to businesses that use Android devices.

Remote code execution (RCE)

Remote Code Execution (RCE) allows attackers to access or make changes to devices they don’t own by running a malicious code remotely and without the device owner’s knowledge. RCE vulnerabilities are considered to be the most dangerous as it happens through a malicious code run on the vulnerable system or device. For businesses, if exploited, RCE can result in the exfiltration of confidential data, network intrusions, and overall device impairment, harming business functionality.

Generally, RCE-based exploitation happens through email, web browsing and instant messaging apps via media files. RCE can allow an attacker to access the device, extract private data and use it for malicious purposes.

Another way of executing RCE attacks is by exploiting a vulnerability in the way Android devices implement Bluetooth. An attacker can silently execute an arbitrary code (which would run in the background without the user’s knowledge) by using Bluetooth privileges. 

Key Threat Vectors : Emails, Web Browsing, MMS media files, Bluetooth, Wi-Fi, and Malicious Apps

Elevation of Privilege (EoP)

Elevation of Privilege (EoP) is a security flaw that exists in an app or OS and can be exploited by an attacker to gain elevated access. For instance, someone who has only ‘read’ access to a particular file can gain ‘read and write’ access using a malicious app. By elevating their privileges, attackers can steal data, run commands by gaining admin access, and damage the OS and/or other apps by deploying malware.

Numerous research articles have shown that EoP can occur through malicious and genuine apps alike. Even Android’s security and sandbox model cannot provide protection against malware and runtime attacks.

Sandbox smashing is the most common way to elevate privileges. Attackers seeking additional information may break the application sandbox or root the device. They can do this by exploiting vulnerabilities at the OS, hardware, or application levels. One such vulnerability that made headlines confirmed that a malicious app exploiting this vulnerability can elevate its access to “root level” temporarily.

Brain Test and HummingBad were similar attacks. Brain Test, bundled in a game in the Google Play Store,  was able to bypass Google’s security scanning to install a rootkit on the device by exploiting various vulnerabilities of EoP. The malware stayed on the device even after users uninstalled the app. HummingBad was a kind of mobile chain attack targeted to download malicious apps by rooting user’ devices.

Key Threat Vectors : Malicious Apps

Information Disclosure (ID)

Information Disclosure attacks permit access to hidden or otherwise inaccessible information. At-risk information includes application-specific information (such as underlying frameworks and architecture) or device-level information (such as device MAC addresses or unique identifiers).

Information Disclosure attacks can serve as a gateway to exploiting more threatening vulnerabilities. This  can result in the loss of confidential and proprietary information.

One of the most common threat vectors for ID vulnerability is peeking at debug logs. These logs often include developer comments and error messages left due to negligence, allowing hackers to infer a great deal of information about app or system internals. Allowing reads from buffer overflows is another common way in which this vulnerability manifests. Malicious apps can exploit these kinds of vulnerabilities to read protected information.

Key Threat Vectors : ADB Debugging, System Logs, and Malicious Apps

Denial of Service (DoS)

In denial-of-service (DoS) attacks, the attackers restrict an authorized user from accessing some on-device data or resources. This kind of vulnerability allows attackers to crash or choke key services on a device. This can occur by flooding the device with requests, or crafting requests to key  services that cause the services to crash and thus deny them to all other apps on the device. These DoS attacks can impair device functionality and performance, disrupting productivity and business continuity.

One such critical vulnerability (discovered and patched by Google) targeted the Media Framework System on Android devices. Attackers could send a specifically crafted message to the device, parsing which Media Framework System could crash and fail to serve other applications on the device. DoS attacks can also target Android devices’ Bluetooth capabilities.

Key Threat Vectors : Bluetooth, MMS, and Malicious Apps