Hackers May Be Able to Secretly Download Malicious Apps onto Nearly Half of All Android Phones

Grow Your Business, Not Your Inbox

Stay informed and join our daily newsletter now!
3 min read
This story originally appeared on Business Insider

A researcher at Palo Alto Networks has discovered a frightening Android vulnerability that could allow hackers to steal data from unknowing users. Even scarier, it could affect nearly half of all current Android users. 

Called the “Android installer hijacking vulnerability,” the bug reportedly allows attackers to surreptitiously download apps to Android users without them knowing.

Here's how it works:

  • When an Android user installs an app, they are always directed to a permissions screen ensuring the user know what sort of requirements the app has.
  • This vulnerability, however, indicates that if a user downloads an app from a third-party app store or an app promotion (that is, not Google Play), Android doesn’t make sure that the app being presented to the user in the permissions page is the actual app being downloaded.
  • This means that an attacker can “modify or replace the package in the background.” That is, hackers can secretly change the files that you think you're downloading for other, more malicious ones. Think of it as an app bait and switch. 

There are two ways for attacker to capitalize on this vulnerability. One, they can present to consumers a normal-looking app and then, once approved by the user, swap it for a piece of malware. Or, attackers can flat-out lie about the permissions the app requires, meaning app can look benign but actually gain all sorts of access to private phone data.  

The fact that so many users are at risk highlights a real problem with Android. In short, Android operating systems are disturbingly fragmented. While the company has been working to fix its operating system fragmentation problem, more than half of the devices on the market use versions that are as many as three versions behind the latest. The most recent update, dubbed Lollipop, was released in November of 2014 and only 3.3% of all Android users currently run it.

Compare that with Apple, which claimed last fall that 94% of all iPhone users use a version of iOS that was released in the past year. With so many Android users spanning so many versions, it’s difficult for Google to issue a clean fix to problems like these.

The Android installer hijacking vulnerability applies to Android 4.3 devices. It was first discovered in January of 2014 and the researchers informed Google, Samsung, and Amazon (all of which provide operating systems to which the vulnerability applies). Now, more than a year later, all of the vendors have installed patches to fix it, but earlier versions of Android are still at risk. 

According to the most recent numbers, that represents 49.5% of the Android devices on the market. 

The most obvious fix for Android users would be to update their software. If they are unable to do that, users should only download apps through Google Play, as those files are unable to be overwritten by attackers.

So if you're running an older version of Android, you better make sure you know what you're downloading.

More from Entrepreneur
Our Franchise Advisors will guide you through the entire franchising process, for FREE!
  1. Book a one-on-one session with a Franchise Advisor
  2. Take a survey about your needs & goals
  3. Find your ideal franchise
  4. Learn about that franchise
  5. Meet the franchisor
  6. Receive the best business resources
Make sure you’re covered if an employee gets injured at work by
  • Providing us with basic information about your business
  • Verifying details about your business with one of our specialists
  • Speaking with an agent who is specifically suited to insure your business
Whether you want to learn something new, be more productive, or make more money, the Entrepreneur Store has something for everyone:
  • Software
  • Gadgets
  • Online Courses
  • Travel Essentials
  • Housewares
  • Fitness & Health Devices
  • And More

Latest on Entrepreneur