Over half of Android devices have unpatched vulnerabilities, report says

Results from X-Ray vulnerability scanner show that over half of Android devices are vulnerable to root exploits

Over half of Android devices are vulnerable to known security flaws that can be exploited by malicious applications to gain complete access to the operating system and the data stored on it, according to a report from mobile security firm Duo Security.

This conclusion is based on scans performed during the last couple of months with X-Ray, a free Android vulnerability assessment tool developed by Duo Security. X-Ray scans devices for known privilege escalation vulnerabilities that exist in various versions of the mobile operating system.

"Since we launched X-Ray, we've already collected results from over 20,000 Android devices worldwide," security researcher Jon Oberheide, who is co-founder and CTO of Duo Security, said Wednesday in a blog post.

Privilege vulnerabilities can be exploited willingly by users in order to gain administrator (root) access on their devices and, for example, replace the firmware provided by the manufacturer with a custom-built one.

However, they can also be exploited by malware for malicious purposes and there have been multiple documented cases of Android malware that incorporated root exploits over the years.

"Since the launch of our mobile security solution, root exploits have been some of the most frequently encountered threats," Bogdan Botezatu, a senior e-threat analyst at antivirus vendor BitDefender, said Friday via email.

For example, during the first quarter of 2012, the top 10 detected Android threats included the "Rage Against The Cage" exploit, the "GingerBreak" exploit, the "Exploid" exploit and the "Asroot" exploit, Botezatu said.

Some of those cases might have been caused by users who were attempting to "root" their devices. However, others were likely generated by malicious apps that used those exploits, Botezatu said.

Over 50 percent is actually a fairly conservative estimate, Oberheide said. "Yes, it's a scary number, but it exemplifies how important expedient patching is to mobile security and how poorly the industry (carriers, device manufacturers, etc) has performed thus far."

The slow deployment of security patches to Android devices is a problem that has been known of for years. Manufacturers stop issuing updates for some device models too quickly and even when they do issue updates, some carriers don't distribute them in a timely manner.

"In the Microsoft ecosystem, desktop users know that patches are provided for quite a while, just like what happened with Windows XP," Botezatu said. "Mobile carriers, on the other side, see the mobile device, as well as the operating system running atop of it as a wearable item that rapidly goes out of fashion and has a shorter lifespan than desktops or laptops."

"While it's well-known in the security community that slow patching of vulnerabilities on mobile devices is a serious issue, we wanted to bring greater visibility to the problem," Oberheide said. The researcher will present the preliminary results from the X-Ray project at the United Security Summit conference in San Francisco on Friday.

Join the PC World newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?