Government // Enterprise Architecture
03:51 PM

Google's Android OS Has Security Flaw, Researcher Claims

The vulnerability is in the browsers and could potentially enable a hacker to have access to information the browser may use such as cookies and saved passwords.

Google's Android operating system is vulnerable to a serious security flaw, according to researchers from Independent Security Evaluators.

The vulnerability is in the browsers and could potentially enable a hacker to have access to information the browser may use such as cookies, saved passwords, and other sensitive information.

"A user of an Android phone who uses the Web browser to surf the Internet may be exploited if they visit a malicious page," the researchers wrote. "Upon visiting the malicious site, the attacker can run any code they wish with the privileges of the Web browser application. We have a very reliable exploit for this issue for demonstration purposes. This exploit will not be released until a fix is available."

Android is an open source operating system that uses more than 80 different open source packages. The security flaw comes from Google not using the most up-to-date version of these packages, ISE said.

"In other words, this particular security vulnerability that affects the G1 phone was known and fixed in the relevant software package, but Google used an older, still vulnerable version."

The security company did say that any attack would be limited because the Android's security architecture is "very well constructed." For example, an attacker would not be able to get access to the phone's dialer because Android "sandboxes" each applications.

The security researchers said they contacted Google regarding the flaw Oct. 20, two days before the first Android-powered G1 went on sale.

"We treat all security matters seriously and will carefully work with our partners to investigate and update devices periodically to reduce our users' exposure," a Google spokesperson told InformationWeek. "We are working with T-Mobile to include a fix for the browser exploit, which will soon be delivered over the air to all devices, and have addressed this in the Android open source platform."

The Android platform is expected to be on multiple handsets from different manufacturers and carriers, and Google said it doesn't expect this exploit to negatively impact future developments.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends to Watch in Financial Services
IT pros at banks, investment houses, insurance companies, and other financial services organizations are focused on a range of issues, from peer-to-peer lending to cybersecurity to performance, agility, and compliance. It all matters.
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on for the week of July 17, 2016. We'll be talking with the editors and correspondents who brought you the top stories of the week to get the "story behind the story."
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.