Android through the Years: A Look into the Android Platform's Security (and Insecurity)

Over the past several years, Android has exploded in popularity, and with its massive development came a few notable bugs that peaked in the year 2014. Some users are aware that the rise of the Android platform officially began in 2008, but those early devices didn't have the features, such as a multi-touch interface and on-screen keyboard, that many couldn’t live without today. However, those early years saw the platform establish a foundation, along with other lasting recognizable features with the release of the HTC G1, the first Android-powered smartphone for consumers.

Today, the Android platform is one of the two (Apple's iOS is the other one) major mobile platforms that dominate the mobile market. Unfortunately, like with every mobile operating system or app, flaws and security issues will always be prevalent. As online and mobile banking became more popular with users over the past few years, cybercriminals have devised a number of ways to exploit the mobile platform for profit, such as with mobile malware and fake apps that can steal credentials and money. Additionally, since Google made its Android platform open to all developers to make it more attractive to customers, it allowed more hackers to understand the platform’s underlying architecture and source code. This made it easier for cybercriminals to find and exploit the platform's vulnerabilities.

[Read more on: Masque, FakeID, and Other Notable Mobile Threats of 2H 2014]

In 2014 alone, the number of Android malware and high-risk apps has steadily increased. As early as the first half of the previous year, mobile malware—particularly, coin miners, Deep Web apps, ransomware, and banking malware—have evolved to take advantage of vulnerabilities such as Android Custom Permission Vulnerability and Android System Crash Vulnerability resulted in loss of user data, and stolen financial information from online shopping apps.

Here is a list of Android vulnerabilities and exploits that plagued the Android OS over the years:

Ice cream Sandwich (4.0)

A proof-of-concept rootkit was developed that exploited a flaw in Android 4.0.4. The rootkit could be downloaded with an infected app and attacks the framework instead of the OS kernel without requiring a reboot. When running on a system, it can be used by an attacker to perform clickjacking attacks.

Jelly Bean (4.1 – 4.3)         

Webview Vulnerability – the WebView feature allowed users to view web-based content without having to open a browser app. The vulnerability, found on a number of Android apps, allowed hackers to remotely control affected devices, run commands, and install backdoor applications.

KitKat (4.4)

Master Key vulnerability – this flaw could be exploited by allowing attackers to inject malicious code into legitimate Android apps without invalidating the digital signature.

Android Fake ID vulnerability – The vulnerability allows malicious apps to impersonate legitimate ones.

Lollipop (5.0) and Improved Security

Smart Lock – users can pair a trusted device like a fitness tracker, or even headphones via Bluetooth. The OS will prompt a question asking if it’s a “trusted device”. If it is, the screen unlocks without requiring a security code, as long as the user’s smartphone is within range of the paired device. If it loses connection, it locks up again.

Security-enhanced Linux (SELinux) – previously made available in KitKat in “enforcing mode”, this Linux-based architecture was designed to protect the OS from threats that access the device during privilege escalation attacks.

Given the share of security woes Android has encountered over the years, and because updates are generally rare (Android version 5.1 Lollipop adoption is only at 3.3%), it’s high time for developers and users alike to pay attention and develop safe mobile habits. Here are a few tips on how to secure your mobile life for 2015 and beyond:

For developers

Put appropriate restrictions in the different components of apps. Components that are prone to abuse should be secured with permissions, with the proper protection level. App components should also be checked to ensure that access to them are restricted properly and accordingly.

Mobile users

Protect your app and online accounts by using strong passwords. This includes using secure password managers. The installation of a security app that scans for mobile malware or adware, and regularly updating operating systems and apps can also decrease the risks the chances of getting infected by mobile malware.

[Learn more about online and mobile banking challenges in: Magnified Losses, Amplified Need for Cyber-Attack Preparedness]