Millions of Android devices could be hacked exploiting a plugin that comes pre-installed on your Android devices by the manufacturers.
Most of the Android device manufacturers pre-install 'Remote Support Tool (mRST)' plugin onto their phones that are intended to help users, such as RSupport or TeamViewer.
But, a critical Certifi-Gate security vulnerability in this mRTS plugin allows malicious applications to gain illegitimate privileged access rights, even if your device is not rooted.
"Certifi-Gate" Android security vulnerability
According to Israeli researchers at Check Point, Ohad Bobrov and Avi Bashan, Certifi-Gate Android vulnerability lies in the way Google's partners (manufacturers) use certificates to sign remote support tools.
Remote support tools often have root level access to Android devices, even if your device is not rooted. Thus any installed app can use Certifi-Gate vulnerability to gain unrestricted device access, including:
- screen scraping
- keylogging
- exfiltrating private information
- installing malware apps, and more
The flaw affects thousands of millions of Android devices, and users cannot uninstall the vulnerable plugin from the device because it is part of the core system…
...Ironic, huh?
"An attacker can exploit mRATs to exfiltrate sensitive information from devices such as location, contacts, photos, screen capture, and even recordings of nearby sounds." Researchers explained in the published paper.
"While analyzing and classifying mRATs, our research team found some apps share common traits with mRST. Known mRAT players include HackingTeam, mSpy, and SpyBubble."
Video Demonstration:
Android Smartphones and tablets running the latest version of Android (Lollipop) are also at risk.
Am I vulnerable to Certifi-Gate vulnerability?
Checkpoint released an app that detects if your Android device is vulnerable to the Certifi-Gate exploits and also reveals if any attacks have already been launched on the user's phone.
The annoying news is that the vulnerability may not go away anytime soon, because Android phone manufacturer companies are notoriously slow in releasing patches to users.
