It seems like there isn't any end to Android security flaws. After the discovery of the Stagefright vulnerability that allowed hackers to infect Millions of Android devices with just a maliciously-crafted message…
Researchers have now warned of another critical security hole in Google's Android mobile operating system platform that impacts over 55 percent of all Android users.
Security researchers at IBM have discovered a new privilege escalation vulnerability in the Android platform that could allow "a malicious app with no privileges the ability to become a 'super app' and help the cybercriminals own the device."
Dubbed the Android serialization vulnerability, assigned CVE-2015-3825, affects Android versions 4.3 and above, including the latest build of Android M.
The vulnerability resides in a component of Android's platform called OpenSSLX509Certificate, which can be exploited by an Android app to compromise the system_server process and gain powerful system-level access on the Android device.
In a video, the researchers showed proof-of-concept attack, demonstrating how they were able to exploit the flaw using a malicious app and replace it with the real Facebook app to steal social networking login credentials.
Once the user runs that app with no apparent special privileges, it then download additional code to overwrite the existing app, loaded with an exploit used to escalate permissions using the vulnerability.
Besides Android serialization vulnerability, the security researchers also discovered other vulnerabilities in a series of third-party Android Software Development Kits (SDKs) that could allow hackers to execute remote code from apps that use these SDKs.
IBM notified Google's security team of the flaw well in advance of its presentation, and a patch has since been issued. However, most Android users will not receive the patch anytime soon.
You can find more details from the paper published.
This vulnerability is the latest in the list of recently discovered Android vulnerabilities.
Last week, researchers found a critical Certifi-Gate vulnerability in the pre-install Android's 'Remote Support Tool (mRST)' plugin that allowed malicious apps to gain illegitimate privileged access rights, even if the device is not rooted.
