‘Fake ID’ security flaw could be the greatest threat to Android phones yet
One Android feature that never made its way to iOS may be the cause of one of the most worrying security exploits ever on the mobile platform. AppleInsider reports that Bluebox Security has found an Android design flaw that could potentially allow malware apps to take over someone’s device without requiring users to manually give the app permission to access their phones.
Dubbed ‘Fake ID,’ the flaw allows the malicious apps to send fake credentials to Android, granting the app the ability to take on the form of another legitimate app that would have more extensive access to the device.
Perhaps unsurprisingly, one of the trusted apps that ‘Fake ID’ can assume the identity of is Adobe Flash, an Android-specific feature that Steve Jobs refused to include in iOS for this very reason. Although Google ditched Flash for Android a few years ago, the software was so deeply ingrained in the platform that a residual flaw remained in the Android WebView until the release of Android 4.4 KitKat.
Unfortunately, only 18% of Android users have installed KitKat, which leaves 82% of the Android population vulnerable to ‘Fake ID’ through Flash. Of course, Flash isn’t the only victim — Google Wallet can be exploited as well, putting users’ financial data at risk.
According to Bluebox, “other devices and applications that depend upon the presence of specific signatures to authenticate an application may also be vulnerable. Essentially anything that relies on verified signature chains of an Android application is undermined by this vulnerability.”
More from BGR: New iPhone 6 component leak reveals major new features
This article was originally published on BGR.com
Related stories
This app will let you delete all your drunk texts once you sober up
Video: Don't be fooled by this extremely detailed iPhone 6 clone running Android
Fleksy keyboard brings new tricks to Android as it prepares for iOS 8's arrival
