Android Certifi-gate Flaw Still a Risk, Despite Few Victims
The flaw, which was first reported at the Black Hat USA conference in early August, could enable an attacker to take over an Android device.At the Black Hat USA security conference on Aug. 6, security researchers from Check Point publicly announced a new Android flaw dubbed "Certifi-gate." Now, nearly three weeks later, Check Point has published statistics on the impact of the flaw that could potentially enable an attacker to take over an Android device. The Certifi-gate flaw is all about privileged certificates used by OEM vendors to sign remote support tool (mRST) apps. The risk is that an attacker could potentially make use of the OEM vendor certificates to gain privileged access on an Android device. When the Certifi-gate flaw was first announced, Check Point also released a mobile scanning tool that enables users to scan Android devices to see if they are vulnerable to the Certifi-gate issue. According to Check Point, from Aug. 6 until Aug. 19, there were approximately 100,000 downloads of the Certifi-gate scanner app. Approximately 30,000 people who downloaded the app opted to send their information anonymously to Check Point. Check Point has identified three tiers of risks associated with the Certifi-gate issue. The lowest tier is if the device itself is vulnerable to the Certifi-gate flaw: 42.09 percent of devices were found to be vulnerable. The second tier is if a vulnerable mRST plug-in is actually installed: 15.84 percent of scanned devices were at risk. The third tier is if a device is at risk, a vulnerable mRST plug-in is installed and there is a third-party application that is exploiting the flaw to gain elevated access to the device and its sensitive resources. Check Point found that only 0.01 percent of devices scanned were identified as being at the highest level of risk.
Avi Bashan, technology leader, Mobile Threat Detection, at Check Point, explained that the level of risk depends on layers of vulnerability.