June 7, 2012 report
Researchers point out ways to circumvent Google's Bouncer (w/ Video)
(麻豆淫院) -- Back in February, Google announced that it had added a security program called to its Android Market, a site similar to Apple鈥檚 iTunes, that would test applications that had been uploaded to the site, in an attempt to keep out those that contain malware. In the announcement, Google also said that Bouncer had been running for several months and that because of it, apps with malware uploaded to Android Market, which is now called Google Play, were down forty percent. Unfortunately, if that number is correct, it鈥檚 likely to change soon as two security analysts, Charlie Miller and Jon Oberheide have not only found some very serious security problems with Bouncer, but have created a video and posted it on YouTube showing exactly how to take advantage of the lapse.
Miller and Oberheide explain that the way Bouncer works is by creating a virtual phone environment every time an app is uploaded to Google Play. It鈥檚 in that environment that Bouncer runs and tests the app in various ways to see if it can detect the presence of any malware. Unfortunately, as the two found, Bouncer only tests for five minutes. Any app that waits till after that time period has lapsed to carry out its nefarious functions will get a clean bill of health.
The duo discovered this flaw in Bouncer by creating an app that automatically connects to a server under their control, which allowed them to run Linux commands on an Android phone. Then, they created a false Google Play developer account and uploaded the app. Once it ran in the simulator, they were able to execute commands to find out how Bouncer worked and then to use that information to find weaknesses.
In so doing, they also found that Google had created just a single fake user account, email address, and two photo images to use for its testing purposes. If an app with malware tried to touch any of those, it was 鈥渂ounced.鈥� Unfortunately, using such a limited set of test information allows those working to subvert the system an easy means of identifying if they are running in a simulation or on a real phone. If it鈥檚 the simulation, then they can just do nothing so they won鈥檛 be detected.
The two researchers say there are other security holes they鈥檝e discovered as well and have been in contact with Google to let them know what they鈥檝e found and will be outlining their findings at this week鈥檚 SummerCon conference in New York.
漏 2012 麻豆淫院.Org
