New Android vulnerabilities leak sensitive information

New Android vulnerabilities leak sensitive information

IBM researchers found that about 86% of Android phones have a vulnerability. Hackers may obtain sensitive information about users, including keys for banking services and Virtual Private Networks (VPNs), and PIN codes or images used to unlock devices.

This vulnerability is located in the Android KeyStore, a sensitive area of the Android system and is used to store keys and similar identity information. With this vulnerability, hackers can execute malicious code to obtain users' sensitive information. The researchers said that Google only fixed this vulnerability in the Android 4.4 Qiqiao system, and other versions will still be affected by this vulnerability. The proportion of affected users among all Android users is approximately 86.4%.

If hackers want to successfully exploit this vulnerability, they must overcome multiple technical barriers. The Android system adopts modern software protection measures, including Data Execution Prevention modes, and solves the problem of Space Layout randomization. Both of these functions make it more difficult for hackers to execute malicious code.

Hackers must also install applications on mobile phones affected by this vulnerability. However, this vulnerability is critical because it exists in the most sensitive KeyStore of Android.