Critical app flaw bypasses screen lock on up to 100 million Android phones

ronjor · Apr 24, 2013

by Dan Goodin

A critical flaw in an Android app downloaded as many as 100 million times allows attackers to take full control of handsets even when they're protected by screen locks.

The vulnerability in the Skype rival known as Viber affects Android smartphone brands such as Samsung, Sony, and HTC, according to a blog post published Tuesday by Bkav Internet Security. Although attack techniques differ from model to model, they all exploit programming logic in the way Viber handles popup messages, researchers with the company wrote.

A spokesman Viber Media, maker of the affected app, said company officials learned of the vulnerability on Wednesday and plan to release a fix next week.
Click to expand...

http://arstechnica.com/security/201...een-lock-on-up-to-100-million-android-phones/

SweX · Apr 24, 2013

FWIW Everyone may not know who the vendor BKAV is, they are a known vendor (based in Vietnam) and their AV has been tested by for example VirusBulletin. Just FYI

Rmus · Apr 24, 2013

If I understand the article correctly, do the "attackers" need physical access to the phone?

Steps for exploiting the bug involve sending a Viber message to the target handset, using the notification bar of the target handset to make the Viber keyboard appear, and then manipulating model-specific features to bypass the screen lock.
Click to expand...

----
rich

ronjor · Apr 29, 2013

Viber releases update for screen lock flaw - but not on Google Play

Viber, the messaging and voice over IP company, has released an update to the Viber application on Android, version 2.7. The company says that the update fixes the the problem disclosed last week where the Viber app's handling of replying to messages without unlocking the smartphone could be used to give an attacker full access to a locked phone. Many users will not see the update, though.
Click to expand...

http://www.h-online.com/security/ne...lock-flaw-but-not-on-Google-Play-1851600.html

Log in or Sign up

Critical app flaw bypasses screen lock on up to 100 million Android phones

ronjor Global Moderator

SweX Registered Member

Rmus Exploit Analyst

ronjor Global Moderator

Log in or Sign up

Critical app flaw bypasses screen lock on up to 100 million Android phones

ronjor Global Moderator

SweX Registered Member

Rmus Exploit Analyst

ronjor Global Moderator

Useful Searches