Skip to main content
  1. Home
  2. Mobile
  3. News

Major KeyStore security vulnerability threatens 86 percent of Android devices

Malarie Gokey
By

nsa friends spyware phones google play android vulnerable
Image used with permission by copyright holder
Researchers at IBM have published a report detailing a serious vulnerability in the KeyStore that affects 86 percent of Android devices. Google’s Android OS stores extremely sensitive information in the KeyStore. Hackers who exploit the security hole will be able to access sensitive information, such as crypotographic keys for several banking apps and virtual private networks, as well as the pattern sequences or PINs used to unlock Android devices.

According to the report from IBM, Google only built the necessary protection against this threat into Android 4.4 KitKat, leaving some 86.4 percent of Android devices vulnerable to the stack-based buffer overflow, which allows hackers to access the information in the KeyStore. Right now, any hacker who finds the security hole can execute malicious code that will force the keys from banking and other apps containing sensitive information to leak and even unlock the unsuspecting victim’s device.

Recommended Videos

The researchers discovered the flaw nine months ago and alerted Google. Its findings were published last week after the Android Security Team patched the issue for KitKat.

Related

Although the KeyStore vulnerability is very serious, it seems that no one has exploited the flaw yet. In fact, Ars Technica says that hackers have to jump through a lot of hoops to wiggle their way into the KeyStore.

Android has several strong barriers in place that protect the KeyStore from hackers. Measures such as data execution prevention and address space layout randomization are supposed to make it difficult for hackers to execute the correct code and discover flaws in the system. Those who would break into the KeyStore’s vault of sensitive information, would also have to get users to install a malware-infested app on their devices first.

Google is most likely working on a fix for the issue for all earlier versions of Android, but in the meantime, if your device isn’t running KitKat, you are advised to download only apps you trust completely and keep an eye out for any suspicious activity on your Android devices.

Editors' Recommendations

Topics
Malarie Gokey
Malarie Gokey
Former Digital Trends Contributor
As DT's Mobile Editor, Malarie runs the Mobile and Wearables sections, which cover smartphones, tablets, smartwatches, and…
Android 11 hits Samsung devices; here’s how to download Android 11
Pixel phone with five icon at the bottom of the display.

Android 11 may have been out on Pixel phones for a while -- pretty much since's Google's online I/O event -- but as always, it takes a little while for the latest version of Android to find its way to other phone manufacturers. However, the rollout is getting there, and the latest phones to receive the latest version of Android are Samsung's latest flagship devices. So if you're rocking a Samsung device, go down the article to find out how you can check for the update.

Of course, not every phone has received the update yet, but a number of those can still access the Android 11 beta. But it's important to note that only some people should download the beta for themselves. It's generally not a good idea to download the beta to the phone you use on a day-to-day basis, and most average people should wait until the final version of the software is available for your phone. That's because the beta version will likely have a number of bugs and issues, and may break certain aspects of your phone's software.

Read more
There’s a major Android bluetooth security flaw. Here’s how to fix it
Android

Looks like it's time to check if you have an Android security update available to your phone. A new security flaw has been discovered in Android -- and this time, it uses Bluetooth to allow access to your phone.

The flaw, called BlueFrag, takes advantage of Bluetooth in Android 8 and 9, and it basically allows hackers to execute code on your device. The result? Hackers can fully access anything stored on your phone, and install malware without your knowledge.

Read more
Google’s Android bug bounty program announces a $1 million prize
pixel 4 xl screen vs pixel 3 xl screen

Google has been handing out cash rewards to Android bug hunters since 2015 in an effort to keep the mobile operating system safe and secure and running smoothly.

This week the Mountain View, California-based company announced it is increasing its top payout to a whopping $1 million, with a potential for a 50% bonus that pushes it to $1.5 million.

Read more