Google's Android OS Has Security Flaw, Researcher Claims

Google's Android operating system is vulnerable to a serious security flaw, according to researchers from Independent Security Evaluators.

The vulnerability is in the browsers and could potentially enable a hacker to have access to information the browser may use such as cookies, saved passwords, and other sensitive information.

"A user of an Android phone who uses the Web browser to surf the Internet may be exploited if they visit a malicious page," the researchers wrote. "Upon visiting the malicious site, the attacker can run any code they wish with the privileges of the Web browser application. We have a very reliable exploit for this issue for demonstration purposes. This exploit will not be released until a fix is available."

Android is an open source operating system that uses more than 80 different open source packages. The security flaw comes from Google not using the most up-to-date version of these packages, ISE said.

"In other words, this particular security vulnerability that affects the G1 phone was known and fixed in the relevant software package, but Google used an older, still vulnerable version."

The security company did say that any attack would be limited because the Android's security architecture is "very well constructed." For example, an attacker would not be able to get access to the phone's dialer because Android "sandboxes" each applications.

The security researchers said they contacted Google regarding the flaw Oct. 20, two days before the first Android-powered G1 went on sale.

"We treat all security matters seriously and will carefully work with our partners to investigate and update devices periodically to reduce our users' exposure," a Google spokesperson told InformationWeek. "We are working with T-Mobile to include a fix for the browser exploit, which will soon be delivered over the air to all devices, and have addressed this in the Android open source platform."

The Android platform is expected to be on multiple handsets from different manufacturers and carriers, and Google said it doesn't expect this exploit to negatively impact future developments.