Unless you Upgrade to Android Pie, a Vulnerability Leaves your Phone Trackable -- and Google Won't Fix It
A vulnerability in the Android operating system means that it is worryingly easy to track and locate phones. While the issue has been addressed in Android Pie, Google has no plans to patch the vulnerability in earlier versions of its mobile OS.
The vulnerability (CVE-2018-9489) was revealed in a report from Nightwatch Cybersecurity which warns that it can be used to "uniquely identify and track any Android device" and also to "geolocate users". As well as Google's own Android builds, the problem is also said to affect forked versions such as FireOS.
The vulnerability, which was first reported to Google back in March, means that it is possible for apps to bypass permissions and gain access to information that is contained in system broadcasts -- information that can be very revealing. The problem is made all the more serious thanks to the fact that the vast majority of people will never see Pie on their phones, meaning their handsets will remain vulnerable.
Describing the problem, Nightwatch Cybersecurity says:
System broadcasts by Android OS expose information about the user's device to all applications running on the device. This includes the WiFi network name, BSSID, local IP addresses, DNS server information and the MAC address. Some of this information (MAC address) is no longer available via APIs on Android 6 and higher, and extra permissions are normally required to access the rest of this information. However, by listening to these broadcasts, any application on the device can capture this information thus bypassing any permission checks and existing mitigations.
Because MAC addresses do not change and are tied to hardware, this can be used to uniquely identify and track any Android device even when MAC address randomization is used. The network name and BSSID can be used to geolocate users via a lookup against a database of BSSID such as WiGLE or SkyHook. Other networking information can be used by rogue apps to further explore and attack the local WiFi network.
It is not known whether the vulnerability has been exploited in the wild, but now it has been exposed, that risk has greatly increased. More information about the security issue can be found in the Nightwatch Cybersecurity report.
Source: betanews
Latest Jobs
-
- IDAM Business Analyst
- London
- Up to £65,000 Base
-
A Business Analyst with strong exposure within the Identity & Access or Privileged Access Management space is required by a leading consulting firm. You will have a strong technical understanding of at least one of the following subjects; Privileged Access/ Identity management, Identity Governance and Administration. Vendor experience may include; CyberArk, Sailpoint or Ping Identity. Any of the following vendors could also be advantageous; Oracle’s Identity Manager/ Access Manager or One Identity. The role is to be based in either London or Manchester, with 3-4 days of travel required in a week, that may flex based on the influx of work. This person will have excellent client facing skills, as you will be the primary point of contact between the clientele, and the Engineering team. So prior client facing experience is a must. If this sounds like you, give me a call today on; 0208 663 4030 or email Thomas.Childs@DCLSearch.com Ref: TC7516
-
- ISO27001 Information Security Consultant
- London
- Up to £60,000
-
Information Security Consultant with ISO27001 audit and advisory experience is needed for a client facing opportunity with a Cyber Security company in London. Experience with ISO27001 is essential. Activities of the role will include, but not be limited to providing advice to clients, Gap analysis, Risk assessment, analysis, ISO27001 Audits. Experience taking a client through to iso 27001 certification is highly desirable. This Cybersecurity consultancy, who are dedicated to improving and investing in their client's businesses and employees careers, are looking for a security consultant due to expansion. All the training and development will be provided to help them specialise into the PCI industry / Security advisory industry. Ideal certifications ISO27001 Lead Auditor, ISO 27001 Lead implementer, PCI ISA. Aspiring PCI QSA. Other certifications such as CISSP, CISM or CISA are beneficial to have but not required. The ability to SC Clearance is essential. MUST be UK based and realistically able to commute to London. Structured career path, technical training, diverse and interesting clients available. (ISO70001 Lead Auditor, ISO 27001 Lead implementer, PCI ISA. Aspiring PCI QSA, ISO27001 Information Security Consultant) Contact me on chris.holt@dclsearch.com or 07884666351 or 02086634030 Ref: CH7514
-
- Google Cloud Data Engineer
- London
- Up to £650 Per Day
-
Google Cloud Data Engineer London Up to £650 Per Day Duration: 3 months (Potential to extend) We are currently working with a leading Google Cloud partner who are currently looking for a Google Cloud Data Engineer in London. The Google Cloud Data Engineer will be responsible for a new, on-site project (start to finish) designing and implementing a data cataloguing platform using Google Cloud. Current Experience Required Google Cloud Data Analytics (Data Engineering, Data Mining, Data Cataloguing etc.) Cloud PUB / SUB Ref: PG7512
-
- Professional Services Security Engineer
- United Kingdom
- £65,000
-
Professional Services Security Engineer with current checkpoint experience is needed for the UK focused client facing implementation/migration, configuration position. The role will be utilising the latest versions of Checkpoint, so someone accredited with either CCSA or CCSE, on at least version R80 is ideal. The Professional Services Security Engineer must have current technical implementation experience using Checkpoint, however, I would look at someone with strong firewalling experience around other vendors such as Palo Alto and Fortinet. Being a multi-vendor professional services business, there is scope for this person to receive training and experience within other vendors. This is a UK wide role, the company in question has 2 offices across the UK, however, there is scope for this person to be home based when not on client site. Vendor training and exposure actively promoted.