Published: March 17, 2020 on our newsletter Security Fraud News & Alerts Newsletter.
There’s a vulnerability putting millions of Android mobile devices at risk and most users haven’t heard about it…until now. Published early this year, the Android Security Bulletin contained an update from Google that addressed the weakness. However, it may be too little too late for those affected, especially since the issue was first discovered in early 2019…yes, that’s right. A year ago. This exploit script vulnerability steals data from affected devices and installs malicious apps without the user having any idea their device is compromised. Since Google just recently issued a security patch for its device owners, the exploit has been stealing data for almost a year. To date, other device manufacturers have yet to address the issue, much less do anything about it.
The most users can do at the moment is to quickly update their Google devices with the security patch and review installed apps. Delete those you do not recognize. It seems a Taiwanese manufacturer, MediaTek, installed 64-bit chips for mobile Android’s that left them vulnerable to the exploit. This exploit takes “root” in an Android device. Rooting happens when a mobile device operating system is overtaken, giving total access and control to all parts of a system. It allows the device to be exploited by cybercriminals who install malware apps, extensions and other software not authorized by Google Play store. Both Google and Apple remind users to only download apps from the official app stores. Also, don’t jailbreak devices. This means to “break” them so that apps from other locations other than official store can be downloaded to them. This also means some of the security controls are compromised.
Android users who don’t have a Google device are left waiting for their device manufacturer to confront the issue, create a patch, and publicly notify and distribute it. In other words, it could be a while. Android 10 users don’t appear to be vulnerable at this time, but those running 7, 8 and 9 should act quickly to patch the device, if available.
In the meantime, downloading apps from other than Google Play is a very risky choice as other sites may not scan apps for malware before making them available. Checking app reviews before purchasing one can do a lot for safety. Those apps with questionable reviews should be avoided. Also, pay close attention to permissions an app asks to access during download. Although all the pop-up permissions may be annoying, common sense works best when deciding what permissions to allow. Remember, if it doesn’t make sense for an app to access certain data or functions, don’t agree to it.
Keep up to date: Sign up for our Fraud alerts and Updates newsletter
Want to schedule a conversation? Please email us at advisor@nadicent.com