If an Android Has a Heart, Does It Bleed?The OpenSSL Heartbleed vulnerability “allows remote attackers to
obtain sensitive information from process memory via crafted packets
that trigger a buffer over-read” [ href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160">1].
Heartbleed surprised the public by allowing attackers to steal
sensitive information from vulnerable websites by sending crafted SSL
heartbeat messages. However, due to the fact that servers can send
heartbeats to clients as well, malicious servers can, in turn, attack
vulnerable clients and steal sensitive information. For the Android
platform, we find that roughly 150M downloads of Android apps contain
OpenSSL libraries vulnerable to Heartbleed.
Currently there are about 17 antivirus apps on Google Play branded
as “Heartbleed detectors”. Six of them scan the OpenSSL library
belonging to the Android platform for vulnerabilities. Unfortunately,
this method isn’t sufficient for detecting the Heartbleed
vulnerability on Android. Except in limited Android versions (mainly
4.1.0-4.1.1), the majority of Android platforms are not vulnerable, as
most versions use OpenSSL libraries that are not vulnerable or simply
have the OpenSSL heartbeat functionality disabled.
However, Android apps frequently use native libraries, which either
directly or indirectly leverage vulnerable OpenSSL libraries.
Therefore, even though the Android platform itself is not vulnerable,
attackers can still attack those vulnerable apps. They can hijack the
network traffic, redirect the app to a malicious server and then send
crafted heartbeats messages to the app to steal sensitive memory contents.
We studied apps with vulnerable OpenSSL libraries and confirmed this
attack. Most of the vulnerable apps are games, and some are
office-based applications. Although there is not much valuable
information in the game apps, attackers can steal OAuth tokens (access
tokens and refresh tokens) to hijack the game accounts; as such, the
information might be useful for hijacking those linked social network
accounts with incorrect configurations. Office apps vulnerable to
Heartbleed are much more dangerous due to further potential data leakage.
During our investigation of the office apps that contains a
vulnerable version of OpenSSL, we were surprised that they were not
vulnerable to the Heartbleed attack. How could it be? A deeper look
shows that these apps either make a mistake in the native code
linkage, or just contain dead code. Therefore, when they try to invoke
SSL functions, they directly use the non-vulnerable OpenSSL library
contained within the Android OS, instead of using the vulnerable
library provided by the app. The linkage mistake is common for Android
applications built with native code. As such, the side-effect of this
mistake helps reduce the apps’ overall risk profile.
Of the 17 Heartbleed detector apps on Google play, only 6 detectors
check installed apps on the device for Heartbleed vulnerability. And
of those 6, 2 report all apps installed as “Safe,” including those we
confirmed as vulnerable. One detector doesn’t show any app scan
results and another one doesn’t scan the OpenSSL version correctly.
Only 2 of them did a decent check on Heartbleed vulnerability of apps.
Although they conservatively labeled some non-vulnerable apps as
vulnerable, we agree it is a viable report which highlights both the
vulnerabilities and the linkage mistakes. We’ve also seen several fake
Heartbleed detectors among the 17 apps, which only serve as adware and
don’t perform real detections or display detection results to users.
On April 10th, we scanned more than 54K Google Play apps (each with
over 100K downloads) and found that there were at least 220 million
downloads affected by the Heartbleed vulnerability. We have notified
some of the app developers and library vendors about the OpenSSL
Heartbleed vulnerability found in their products. Fortunately, it
seems most app developers and library vendors take Heartbleed
seriously, as we have started to see apps updated with proper fixes.
The total number of vulnerable apps download has since decreased to
150 million on April 17th.
[ href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160">1]
href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160">Vulnerability
Summary for CVE-2014-0160
Source:
If an Android Has a Heart, Does It Bleed?
