Samsung, LG Phones Vulnerable Due to Leaked Certificates, Google Finds

Google’s Android Partner Vulnerability Initiative revealed several vulnerabilities in Android's platform signing keys trust mechanism.

Written by Anees Hussain, Edited by David Delima, Richa Sharma | Updated: 2 December 2022 20:43 IST

Samsung, LG Phones Vulnerable Due to Leaked Certificates, Google Finds

Photo Credit: Google

Users on Android are advised to update their firmware to the latest available version

Highlights

The vulnerability was identified by Google employee Łukasz Siewierski
Google has reportedly issued a statement assuring users of protection
The virus sample hash files have been uploaded online

Google's Android Partner Vulnerability Initiative, in a major security leak admission, has disclosed a new key vulnerability that has affected Android smartphones from major brands such as Samsung and LG, among others. Due to the leaking of the signing keys used by Android OEMs, imposter apps or malware could disguise themselves as "trusted" apps. The issue was earlier reported in May this year, following which several companies including Samsung took actions to control the vulnerability.

The security flaw was brought to light by Google employee Łukasz Siewierski (via Esper's Mishaal Rahman). Sirwierski, through his tweets, revealed how the platform certificates have been used to sign malware apps on Android.

Folks, this is bad. Very, very bad. Hackers and/or malicious insiders have leaked the platform certificates of several vendors. These are used to sign system apps on Android builds, including the "android" app itself. These certs are being used to sign malicious Android apps! https://t.co/lhqZxuxVR9
— Mishaal Rahman (@MishaalRahman) December 1, 2022

At the heart of the issue lies an Android platform key trusting mechanism vulnerability that could be exploited by malicious attackers. By design, Android trusts any application that uses a legitimate platform signing key, which is used to sign core system applications, through Android's shared user ID system.

However, the Android original equipment manufacturers (OEMs) have had their platform signing keys leaked, allowing malware creators to gain system-level permissions on a target device. This would make all user data on the particular device available to the attacker, just like another system app from the manufacturer signed with the same certificate.

[Sponsored] Samsung Galaxy S24: The Ultimate Camera Phone With Smarter On-Device AI

Another alarming part about the vulnerability is that it doesn't necessarily require a user to install a new or an "unknown" application. The leaked platform keys could also be used to sign common trusted apps such as Bixby app on a Samsung device. A user who downloaded such an application from a third-party website would not see a warning when installing it on their smartphone, as the certificate would match the one on their system.

Google, however, has not explicitly mentioned the list of devices or OEMs that have so far been affected by the critical vulnerability in its public disclosure. Nevertheless, the disclosure includes a list of sample malware files. The platform has since reportedly confirmed the list of affected smartphones, which include devices from Samsung, LG, Mediatek, Xiaomi and Revoview.

The search giant has also suggested ways for the affected companies to mitigate the issue at hand. The first step involves churning out Android platform signing keys that have been flagged to have been leaked and replacing them with new signing keys. The company has also urged all Android manufactures to drastically minimise the frequent use of platform key for an app to sign other apps.

Google to Face Class Action Lawsuit of 21 Million Users Over Play Store

According to Google, the issue was first reported in May. Since then, Samsung and all other affected companies have already taken remedial actions to mitigate and minimise the vulnerabilities that were at hand. However, according to Android Police, some of the vulnerable keys that were listed in the disclosure were recently used for apps for Samsung and LG phones uploaded to APK Mirror.

"OEM partners promptly implemented mitigation measures as soon as we reported the key compromise. End users will be protected by user mitigations implemented by OEM partners," Google said in a statement to BleepingComputer.

Google May Use Performance Management System for Layoffs in 2023: Report

Users on Android are advised to update their firmware versions to the latest available updates in order to remain protected from potential security flaws such as the one disclosed by Google, and to be vigilant while downloading apps from third-party sources.

Are the gaming-centric Asus ROG Phone 6 and 6 Pro worth the price jump? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.