Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Researchers use Woodpecker to single out vulnerable Android phones

North Carolina State University researchers say some Android smartphone makers' efforts to go above and beyond the Google mobile platform's basics open their devices to security breaches.

"Some of these pre-loaded applications, or features, are designed to make the smartphones more user-friendly, such as features that notify you of missed calls or text messages," says Xuxian Jiang, an assistant professor of computer science at NC State and co-author of a paper describing the research. "The problem is that these pre-loaded apps are built on top of the existing Android architecture in such a way as to create potential 'backdoors' that can be used to give third-parties direct access to personal information or other phone features."

SLIDESHOW: Best free Android apps of 2011 

Hackers could trick the apps into recording your phone calls or wiping out your settings, says Jiang, whose team used a tool dubbed "Woodpecker" to detect vulnerabilities.

Such smartphone flaws are welcome news to hackers, who see Android phones as an increasingly juicy target: Gartner says more than half of the smartphones sold worldwide in the third quarter run Android, and that's double the number from the third quarter last year.

Vendors such as McAfee and Juniper Networks have recently released study results showing a boom in malware targeting Android devices, though Google has countered that some vendors may just be trying to roil up the market to sell more of their security wares. 

NC State researchers have had their eyes on Android security for some time. Network World spoke with Xuxian Jiang in April about an effort to defend Android users from privacy thieves. The NC State team's privacy mode software - dubbed Taming Information-Stealing Smartphone Applications (TISSA) -- would give Android users more control over what information they divulge to makers of third-party apps, both at the time of downloading the app and while it's running.

Based on NC State's latest research, on eight different smartphone models, Motorola Droid and plain Google reference implementations fared best. However, HTC's Legend, EVO 4G and Wildfire S, Motorola's Droid X and Samsung's Epic 4G all showed significant vulnerabilities. NC State researchers say they notified manufacturers about the holes earlier this year.

The research, supported by the National Science Foundation and U.S. Army Research Office, will be presented Feb. 7 at the 19th Network and Distributed System Security Symposium in San Diego.

Follow our Alpha Doggs blog for more on network research and follow our Alpha Doggs page on Google+ 

Read more about anti-malware in Network World's Anti-malware section.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Alpha, Gartner, Google, HTC, Juniper, Juniper Networks, Legend, McAfee, Motorola, Samsung, SSA
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: consumer electronics, Google, networking, North Carolina State University, security, smartphones, wireless
Latest Blog Posts
Whitepapers
  • Best Practices for Implementing a Data Warehouse on the Oracle Exadata Database Machine
    Increasingly companies are recognizing the value of an enterprise data warehouse (EDW). A true EDW provides a single 360-degree view of the business and a powerful platform for a wide spectrum of business intelligence tasks ranging from predictive analysis to near real-time strategic and tactical decision support throughout the organization. Ensuring the EDW will get the desired performance and will scale out as your data grows you need to get three fundamental things correct, the hardware configuration, the physical data model and the data loading process. Read on.
    Learn more »
  • High Availability with Oracle Database 11g Release 2
    In this paper, we review the common causes of application downtime and discuss how technologies available in the Oracle Database can help avoid costly downtime and enable rapid recovery from unplanned failures and also minimize impact from planned outages. We also highlight new technologies introduced in Oracle Database 11g Release 2 that enable businesses to make their IT infrastructure even more robust and fault tolerant, maximize their return on investment on high availability infrastructure, and provide better quality of service to users.
    Learn more »
  • Why performance management? A guide for the midsize organisation
    Midsize organisations are uniquely positioned to take advantage of a performance management approach to business. Compared with larger companies, they have more agility to bring information and people together and respond faster to changing market conditions. With one performance management solution, midsize companies can turn disconnected data into information, turn information into valuable insight and turn insight into action.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.